Prompt Injection Obfuscation and Evasion Reference

This reference covers prompts that look odd, fragmented, encoded, or harder to classify than usual. Obfuscation does not change the attacker goal. It changes the surface form so basic matching and shallow review miss what the payload is trying to do.

Common obfuscation families

Obfuscation family	What it looks like	Why it matters
Encoding	Base64, percent encoding, HTML entities, or similar reversible transforms	A surface scanner may inspect the encoded form instead of the meaning
Unicode deception	Homoglyphs, invisible characters, stylized forms, or mixed-width characters	Human-visible text and normalized text no longer match cleanly
Wrapper formats	JSON, XML, Markdown, quoted blocks, or structured payloads that hide the instruction in formatting	The malicious instruction can sit inside a field or wrapper that looks operationally normal
Fragmented payloads	Split tokens, multi-turn assembly, or instructions distributed across several fields	No single fragment looks severe until the system reassembles it
Carrier smuggling	Hidden instructions in links, metadata, files, images, or other indirect channels	The payload arrives through a place teams do not always treat as prompt text

Normalization order

Teams usually get better results when they normalize before they reason. In practice that means canonicalizing Unicode, decoding common transforms, extracting text from wrappers and files, and only then classifying the intent or technique. If you classify first and normalize later, many evasive prompts will look less suspicious than they really are.

What teams usually miss

The most common miss is assuming that Markdown, JSON, or a retrieved document is trustworthy because it looks structured. The second is assuming that one decoding pass is enough. Attackers often combine several disguises so that each one looks minor on its own.

Next steps

From here, read Map Prompt Injection Attack Surfaces or review Advanced Prompt Injection Paths.

Documentation

Quick Start

Learn

Prompt Injection Obfuscation and Evasion Reference

Common obfuscation families

Normalization order

What teams usually miss

Next steps

​Common obfuscation families

​Normalization order

​What teams usually miss

​Next steps

Common obfuscation families

Normalization order

What teams usually miss

Next steps