This reference covers prompts that look odd, fragmented, encoded, or harder to classify than usual.
Obfuscation does not change the attacker goal. It changes the surface form so basic matching and shallow review miss what the payload is trying to do.
Common obfuscation families
Normalization order
Teams usually get better results when they normalize before they reason. In practice that means canonicalizing Unicode, decoding common transforms, extracting text from wrappers and files, and only then classifying the intent or technique. If you classify first and normalize later, many evasive prompts will look less suspicious than they really are.
What teams usually miss
The most common miss is assuming that Markdown, JSON, or a retrieved document is trustworthy because it looks structured. The second is assuming that one decoding pass is enough. Attackers often combine several disguises so that each one looks minor on its own.
Next steps
From here, read Map Prompt Injection Attack Surfaces or review Advanced Prompt Injection Paths. Last modified on March 19, 2026
