Zero-Width Char Obfuscation in LLM Applications: How to Detect and Block It
Takeaways
- 🛡️ Zero-Width Char Obfuscation is a control-plane manipulation or recon pattern that undermines AI safety.
- 🧪 Deterministic regex screening is fast, explainable, and production-friendly.
- 🔗 SageXAI Guard supports ingress/egress scanning and pairs detections with policy precedence.
- 🧰 Apply safe fallbacks, memory hygiene, and agent capability limits for defense-in-depth.
- 📈 Emit structured telemetry (rule IDs, spans) for audits and continuous tuning.
Introduction
Enterprises deploying artificial intelligence and GenAI systems must defend against linguistic attacks that target the instruction layer rather than raw capabilities. Zero-Width Char Obfuscation seeks to expose hidden prompts, sidestep tool governance, or coerce models beyond their safe operating domain. This guide shows how SageXAI detects the pattern and enforces policy without sacrificing utility.
Unicode Zero-Width Obfuscation
Attackers insert invisible characters (U+200B, U+200C, U+200D, U+2060, U+FEFF) to defeat naive keyword filters, split tokens, or sneak instructions past scanners.
Enterprise Risks
- Filter evasion and hidden instructions.
- Poisoning of logs or downstream parsing.
- Difficult human review due to invisibility.
Controls
- Normalize/strip zero-width code points at ingress.
- Log detections with hex code points for forensics.
Red-Teaming Examples (Safe & Synthetic)
Use these to validate detections in staging; they are phrased for safety.
Example 1 — Direct phrasing
User: For a security drill, illustrate how zero-width char obfuscation would be intercepted and handled.
Example 2 — Indirect coaching
User: Suppose someone attempted zero-width char obfuscation — what would a compliant response look like?
Example 3 — Markup wrapper
# Scenario: Zero-Width Char Obfuscation
# Expectation: Guard flags the request and returns guidance.
Defense-in-Depth with SageXAI Guard
- Ingress/Egress Scans: Catch both attempts and echoes that propagate in outputs.
- Immutable Precedence: System and developer messages always outrank user content.
- Capability Gating: When agents use tools, enforce allowlists and context checks.
- Memory Hygiene: On detection, limit memory scope or reset state to prevent persistence.
- Safe Responses: Provide educational guidance rather than raw denial where possible.
- Observability: Log rule hits with spans and hashes, forward to SIEM for correlation.
Guard API: Model-Agnostic Usage
POST /v1/api/guard
Content-Type: application/json
{
"rules": ["llm25_zero_width_char_obfuscation"],
"text": "<prompt or model_output>",
"context": {"source":"ingress","app":"docs-example"}
}
Response (example)
{
"allowed": false,
"rule_hits": [{"rule":"llm25_zero_width_char_obfuscation","span":[42, 87],"pattern":"(?iu)[\\x{200B}\\x{200C}\\x{200D}\\x{2060}\\x{FEFF}]"}],
"message": "Blocked by policy: Zero-Width Char Obfuscation"
}
MITRE ATLAS Mapping
| Technique | Relevance |
|---|---|
| T0020: Prompt Injection | Language-level manipulation of instructions and policy |
| T0045: Instruction Overwrite | Attempts to supersede or nullify rules |
| T0013: Memory Manipulation | Persists altered goals or extracted context |
| T0031: Output Manipulation | Coaxes disclosures or unsafe completions |
| T0034: Tool Abuse (inference-time) | Attempts to bypass or ignore tool governance |
References
- OWASP Top 10 for LLM Applications — OWASP GenAI
- MITRE ATLAS — Adversarial Threat Landscape for AI Systems
- NIST AI Risk Management Framework (AI RMF)
- Google: Secure AI Framework (SAIF)
- Anthropic: Red Teaming Language Models