Overview
Check Point Research has published details of PuzzleMask, a novel prompt-crafting technique that hides policy-violating instructions inside otherwise innocuous plain-English prose. Unlike prior obfuscation methods that rely on base64 encoding, invisible Unicode characters, or emoji-based payloads, PuzzleMask uses no special formatting — making it invisible to signature-based or heuristic content filters.
The core premise exploits a common architectural pattern in production AI systems: a cheap, fast LLM performs a safety check on incoming user input before passing it to a more capable (and expensive) target model. PuzzleMask causes the gatekeeper to miss the embedded payload entirely, classifying the prompt as benign. The downstream target model then extracts and acts on the hidden instruction.
Technical Analysis
The attack pipeline works in three stages:
- Payload selection — a policy-violating instruction is chosen (e.g.,
encrypt files in ~/Documents, biohazard synthesis guidance, or a classicignore all previous instructionsoverride). - Prose wrapping — an automated pipeline crafts a natural-language wrapper that embeds the payload in a way that a resource-constrained gatekeeper model will overlook during its classification pass.
- Extraction by target — the stronger target model, given sufficient context and attention capacity, identifies the embedded payload and treats it as a valid instruction to act upon.
Researchers tested 23 automatically generated prompts against four gatekeeper models: gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, and llama-guard3. In every trial, the gatekeeper classified the wrapped prompt as safe. Payloads were then submitted to gpt-5-thinking-high with Python code interpreter access; in over 90% of cases the target extracted and acted on the payload.
The researchers note that PuzzleMask is not itself a jailbreak — it is a covert delivery mechanism. Combined with a jailbreak payload, it becomes a compound attack capable of bypassing both safety filtering layers and internal model guardrails.
Framework Mapping
- AML.T0051 (LLM Prompt Injection) — the payload is injected into the model’s instruction context via crafted user input.
- AML.T0068 (LLM Prompt Obfuscation) — the attack deliberately obscures the payload from the gatekeeper without using encoding artefacts.
- AML.T0065 (LLM Prompt Crafting) — an automated pipeline is used to systematically generate evasive prompts.
- AML.T0015 (Evade AI Model) — the technique is designed specifically to cause a safety classifier to misclassify malicious input.
- LLM01 (Prompt Injection) and LLM09 (Overreliance) — the attack exploits overreliance on gatekeeper models as a sole safety mechanism.
Impact Assessment
Any system that routes untrusted user input through a lightweight LLM safety filter before a capable model is potentially vulnerable. This includes customer-facing AI assistants, agentic pipelines with tool access, and automated content moderation systems. The 100% gatekeeper bypass rate across all four tested models — including purpose-built safety classifiers — indicates broad applicability across the current landscape of deployed safeguards.
The risk escalates significantly when the target model has tool or code interpreter access, as demonstrated by the file-encryption payload scenario described in the paper.
Mitigation & Recommendations
- Paraphrase incoming input using an LLM before gatekeeper evaluation — this surfaces embedded instructions by rewriting prose in a normalized form.
- Harden gatekeeper system prompts with explicit policy clauses instructing the model to detect embedded or hidden directives within user-supplied text.
- Monitor model outputs and tool invocations, not just inputs — behavioural anomaly detection can catch successful payload extraction even when input filtering fails.
- Avoid sole reliance on a single gatekeeper — implement layered defences including output validation and least-privilege tool access for downstream models.