Understanding Invisible Prompt Injection Attack

Prompt Injection attacks are evolving at a faster pace than many have anticipated. As Large Language Models (LLMs) become more deeply embedded in every application, attackers are discovering different sophisticated ways to exploit them. One of the newest and most concerning techniques is Invisible Prompt Injection.

Unlike traditional prompt injection attacks where the malicious input is visible in plain-text character, invisible prompt injection hides malicious instructions using special Unicode characters. It is invisible to the human eye, as in the bytes are present but not typically displayed in the application that processes them but fully interpreted by AI systems. This stealthy method allows attackers to manipulate AI behaviour without leaving any obvious trace for users or developers to notice.

In this blog we will explore how invisible prompt injection works and how it’s support in BreakingPoint and CyPerf.

Understanding Unicode Encoding

Before diving into the attack steps, it's important to understand the role of Unicode encoding. Unicode (formally The Unicode Standard) is a character encoding standard that supports invisible characters that occupy space in text but are not visually displayed. By adding the range E0000 to the original Unicode points (from E0000 to E007F), common characters such as English letters, digits, and punctuation marks can be "tagged" to make a prompt invisible with just a few lines of code.

While humans don't notice these characters, large language models (LLMs) process them normally because they interpret text at the token/character level, not based on human-visible output.

Attackers exploit this behaviour by embedding hidden instructions within normal-looking user input using invisible Unicode characters.

Key Steps of the Attack:

Picture 6, Picture

Figure 1: Invisible Prompt Injection Attack Steps

Crafting the Malicious Input:

The attacker first leveraged a special type of Unicode encoding to transform the malicious prompts into invisible symbols, as explained earlier, and then submitted the encoded input for processing by the LLM.

LLM Processing:

Once the attacker submits the input, the Large Language Model (LLM) processes it just like any other user input. Despite the malicious prompts being encoded as invisible Unicode characters, the LLM interprets and parses these hidden instructions -

The LLM doesn't distinguish between visible and invisible characters. It processes everything at the token level, which means it follows the embedded hidden commands, unaware of their malicious intent.
This behaviour allows the attacker to manipulate the model’s response or behaviour without raising any visible alarms.

Executing the Attack

After the LLM processes the input, the malicious instructions hidden within the invisible Unicode characters are silently executed, bypassing normal safeguards. This can lead to a range of harmful outcomes, such as bypassing content filters and generating inappropriate or harmful responses, exposing sensitive data and triggering unauthorized actions where the model performs tasks beyond its intended scope. The key aspect of this step is that the attack happens unnoticed, as the hidden commands manipulate the LLM's behaviour without raising alarms.

Leveraging Invisible Approach to Exploit LLMs

We tested the invisible prompt injection on Grok’s “grok-2-1212” model. We found that the model was easily tricked by this method, responding to prompts it would usually block. This showed a clear weakness in how it handles unusual input formats.

Picture 5, Picture

Figure 2: Sample Invisible Prompt Injection Attack Response From Grok

Invisible Prompt Injection Strike in BPS

At Keysight Technologies, our Application and Threat Intelligence (ATI) team added the support of this new type of Prompt Injection attack i.e. Invisible prompt injection in ATI-2025-08 StrikePack released on May 09, 2025.

This update includes a new Strike named “AI LLM Invisible Prompt Injection”. This strike sends an Invisible Unicode character-based prompt to the target LLM. This technique exploits the LLM by encoding text-based prompts using a special set of invisible Unicode characters, subtly coercing the model into producing progressively harmful responses. Note: This strike will randomly select a harmful category related to its questions and embed its Unicode converted format within the prompt.

Picture 1, Picture

Figure 3: Invisible Prompt Injection Strike in BPS

Invisible Prompt Injection Strike in Cyperf

CyPerf will soon release an update containing 3 new strike simulating invisible prompt injection targeting 3 different Large Language Models (LLMs), OpenAI, Gemini, and Grok. These strikes are designed to test LLM vulnerabilities by injecting malicious prompts in which characters are converted into special Unicode symbols. These characters remain invisible to the human eye but are fully interpreted by the AI system, making the attack difficult to detect.

Once the update is released, these strikes can be used in a test by searching in the CyPerf attack library with “invisible prompt injection”.

Figure 4: CyPerf UI Displaying Strike List

These strikes have some configurable properties for selecting the model, api version and api key. These enable the simulation and identification of potential threats in real-world traffic scenarios.

Figure 5: CyPerf UI Displaying Strike Configurations

The statistic view in Cyperf UI provides detailed statistics from the test run, including the number of connections made and the number of active client and server agents. Users can also view separate HTTP statistics for client and server, along with overall TCP statistics. The strike statistics view, there are stats to show whether the strike request to the server was allowed by the DUT, a positive value in the “Server Allowed” stats will indicate that the request was allowed through the DUT to the server. The client allowed stats can be used to check whether the client received the expected response to the strike request. Whether the request or response was blocked by the DUT, it should show 0 value.

Figure 6: Run-time stats view in CyPerf UI

Figure 7: Detailed view of the statistics after running the test on Cyperf

Leverage Subscription Service to Stay Ahead of Attacks

Keysight's Application and Threat Intelligence subscription provides daily malware and bi-weekly updates of the latest application protocols and vulnerabilities for use with Keysight test platforms. The ATI Research Centre continuously monitors threats as they appear in the wild. BreakingPoint and in the future, other tools like CyPerf, now provide customers with access to attack campaigns for different advanced persistent threats, enabling them to test their currently deployed security controls' ability to detect or block such attacks.

References

limit