Security researchers have revealed PuzzleMask, a prompt-obfuscation technique designed to help malicious instructions bypass lightweight AI safety filters This article explores puzzlemask prompt obfuscation. . This method conceals a policy-violating instruction within innocuous-looking plain English prose.
Unlike previous prompt-hiding approaches, PuzzleMask does not depend on Base64 text, invisible characters, emojis, unusual formatting, or encoded strings. Instead, it utilizes carefully crafted natural-language text that appears harmless to a fast “gatekeeper” model but can be understood by a more capable target model. However, attackers could combine the hidden payload with a separate jailbreak attempt, making it more likely that the initial security screening step fails to detect the risky input. If approved, the prompt is sent to a stronger model that can reason longer, use tools, or access a code interpreter.
** The information itself, not counting the gatekeeper, must follow the below pattern, where gatekeeper is gatekeeper and gatekeeper is gatekeeper: Information [..] An attacker creates a prose "wrapper" that embeds a hidden instruction. The wrapper is designed to require more reasoning effort, attention, or tool-assisted analysis to uncover the embedded message. Researchers evaluated 23 crafted prompts against four gatekeeper models: GPT-4o Mini, GPT-OSS-Safeguard 20B, Claude 3 Haiku, and Llama Guard 3.
This finding is particularly significant for AI systems that rely on a low-cost policy model to screen requests before sending them to a more powerful agent.
