PuzzleMask Hides Attacks Inside Plain Prose Text
A small model reads a text and answers “safe.” Then the very same text reaches a more powerful AI, which finds a hidden command within and executes it. Check Point Research has laid bare this gap with a new technique called PuzzleMask, capable of slipping past the quick filters placed before large language models.
No Base64, No Invisible Characters, Just Prose
PuzzleMask requires no Base64, no invisible characters, no emojis, and no suspicious markup. The malicious instruction is concealed within ordinary, coherent text, and outwardly the request may appear entirely innocuous. Such attacks belong to the broader class of prompt injection, yet Check Point aimed not at the main model but at a separate AI filter meant to weed out dangerous requests before processing.
Exploiting the Gap Between Filter and Model
Many services build their defenses on a “quick filter, then powerful model” scheme. A small, inexpensive LLM receives the request first, classifies the content as safe or dangerous, and only after the check passes the text to the more expensive model. PuzzleMask exploits the difference in computational capability between the two links. The filter lacks the resources to notice the hidden structure, whereas the strong model can reconstruct the embedded message.
The Test Results
Check Point prepared 23 special requests bearing commands such as reading a file or encrypting documents. GPT-4o-mini, gpt-oss-safeguard:20b, and Claude 3 Haiku deemed all 23 tested variants safe. Llama Guard 3 likewise let through the five requests on which it was tested. The danger of such instructions grows especially acute with AI agents able to work with files, mail, and other tools.
After passing the filter, the requests were sent to GPT-5 Thinking High with access to a Python interpreter. The model extracted the hidden instruction and acted upon it in 17 of 18 trials, roughly 94% of cases. By the team’s observations, successful extraction required about a minute of reasoning and several Python runs. This disparity neatly explains why the quick classifier fails to notice what the more powerful system then uncovers.
Not a Jailbreak, but a Delivery Mechanism
The authors specifically stress that PuzzleMask is not itself a jailbreak. The technique merely delivers an arbitrary instruction past the external filter, without guaranteeing a bypass of the target model’s built-in restrictions. However, one can place a ready-made jailbreak or another malicious command inside PuzzleMask. A similar problem with commands a human scarcely notices was previously demonstrated by the InkJect attack, which hid instructions within an image.
Defenses and Their Costs
For defense, Check Point proposes paraphrasing incoming text before passing it to the main model, adding markers of such constructions to the filters, and monitoring not only input requests but also the responses and actions of the LLM. In one experiment, an additional rule allowed GPT-4o-mini to detect all 23 prepared requests. The full PuzzleMask research also reveals the price of such an approach: deeper inspection raises computational costs, while rigid rules can produce false positives.
A Fundamental Risk for AI Agents
The problem grows especially conspicuous where a model receives external documents and decides for itself which actions to perform. Analysis of attacks on AI agents reveals the same fundamental risk: data from a website, a repository, or an email may unexpectedly transform, for the LLM, into an instruction.
Check Point has already demonstrated another form of abusing trust in AI services. In one study, hidden commands allowed popular neural networks to be used as part of a malware command channel. PuzzleMask transfers a similar problem to the level of the defensive architecture itself, where the weak link may lie not in the main model but before it.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
