PuzzleMask: Covert Prompt Injection Technique Threatens LLM Security

• •PuzzleMask allows payloads to bypass LLM policy checks using plain prose.
• •The technique achieved a 100% miss rate against four LLM gatekeepers in testing.
• •Mitigation strategies include paraphrasing user input and monitoring LLM behavior.

PuzzleMask is a newly disclosed technique that allows attackers to embed malicious payloads within plain prose, bypassing LLM-based policy checks. This method exploits the resource asymmetry between a fast gatekeeper model and a more capable target model. In tests, 23 crafted prompts successfully evaded detection by four different LLM gatekeepers, achieving a 100% miss rate. The downstream target model, gpt-5-thinking, executed the embedded payload in approximately 94% of trials. This attack does not involve traditional obfuscation techniques, making it particularly insidious. The technique has implications for various applications of LLMs, which are increasingly used in sensitive tasks. AI labs are encouraged to enhance their defenses against such prompt injection methods. Current mitigation strategies include using paraphrasing and monitoring LLM behavior. The research highlights the ongoing arms race between AI security measures and sophisticated attack techniques.