TIL you can smuggle "ignore previous instructions" into a completely normal-looking prompt using an invisible character
Got curious if my own filter would catch that style. It didn't. My detector did phrase matching, which works fine for typed-out "ignore previous instructions" but completely misses it if you drop a zero-width space (U+200B) in the middle of the sentence — looks 100% normal to a human, and to any filter that isn't specifically checking for invisible characters.
Screenshot is a prompt that reads as a totally ordinary "summarize this review" request. Nothing visibly wrong with it. It's blocked because of one invisible character sitting in the text.
Added a check for zero-width/bidi-override characters specifically — had to be careful to exclude the ones that are legitimate in Persian/Indic script rendering, RTL text, and files pasted with a BOM, since those use overlapping unicode ranges and you don't want to false-positive on someone typing in Farsi.
Anyone else run into this, or is most injection-detection work still focused on the "obvious" override-phrase style? Wrote up what's actually running here if anyone's curious: apptechlab.com/p/llmfirewall/how-it-works
Posted Aug 12, 2026, 8:16 PM UTC