> ## Documentation Index
> Fetch the complete documentation index at: https://anthale.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Prompt Injection Obfuscation and Evasion Reference

> Understand the disguises attackers use to hide prompt injection attempts so you can evaluate indirect, encoded, or reformatted attack content.

This reference covers prompts that look odd, fragmented, encoded, or harder to classify than usual.

Obfuscation does not change the attacker goal. It changes the surface form so basic matching and shallow review miss what the payload is trying to do.

## Common obfuscation families

| Obfuscation family  | What it looks like                                                                                 | Why it matters                                                                              |
| ------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| Encoding            | Base64, percent encoding, HTML entities, or similar reversible transforms                          | A surface scanner may inspect the encoded form instead of the meaning                       |
| Unicode deception   | Homoglyphs, invisible characters, stylized forms, or mixed-width characters                        | Human-visible text and normalized text no longer match cleanly                              |
| Wrapper formats     | JSON, XML, Markdown, quoted blocks, or structured payloads that hide the instruction in formatting | The malicious instruction can sit inside a field or wrapper that looks operationally normal |
| Fragmented payloads | Split tokens, multi-turn assembly, or instructions distributed across several fields               | No single fragment looks severe until the system reassembles it                             |
| Carrier smuggling   | Hidden instructions in links, metadata, files, images, or other indirect channels                  | The payload arrives through a place teams do not always treat as prompt text                |

## Normalization order

Teams usually get better results when they normalize before they reason. In practice that means canonicalizing Unicode, decoding common transforms, extracting text from wrappers and files, and only then classifying the intent or technique. If you classify first and normalize later, many evasive prompts will look less suspicious than they really are.

## What teams usually miss

The most common miss is assuming that Markdown, JSON, or a retrieved document is trustworthy because it looks structured. The second is assuming that one decoding pass is enough. Attackers often combine several disguises so that each one looks minor on its own.

## Next steps

From here, read [Map Prompt Injection Attack Surfaces](/docs/learn/guardrails/prompt-injection/attack-surfaces) or review [Advanced Prompt Injection Paths](/docs/learn/guardrails/prompt-injection/advanced-attack-paths).