PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector

This research demonstrates a prompt-crafting technique that embeds malicious or policy-violating payloads inside benign prose wrappers to evade fast LLM-based gatekeepers and be recovered by stronger target models (with higher reasoning and tool access). The authors tested 23 obfuscated prompts against several gatekeeper models (which uniformly classified them as safe) and a powerful target model with a code interpreter (which recovered and executed payloads in ~94% of target trials), and discuss mitigations such as paraphrasing, policy clauses for gatekeepers, monitoring outputs, and stronger gatekeeper resources.