PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector
Check Point details PuzzleMask, a plain-prose technique that bypasses LLM gatekeeper policy checks, letting hidden payloads reach target models unreviewed.
Check Point Research describes PuzzleMask, a prompt-crafting technique that hides policy-violating payloads inside plain-English prose wrappers, bypassing quick LLM-based policy checks without emojis, Base64, or invisible formatting. The researchers tested 23 automated prompts against gatekeepers including GPT-4o-mini, GPT-OSS-Safeguard 20b, Claude 3 Haiku, and Llama Guard 3, and all were classified as safe despite policies that flagged the plain versions. When submitted to GPT-5 in thinking-high mode with a Python interpreter, the target model extracted and acted on the payload in over 90% of trials. The technique is not itself a jailbreak but can carry a jailbreak prompt as payload; mitigations include input paraphrasing, hardened gatekeeper policies, and output monitoring.
- Hides payloads in plain prose, avoiding detectable artifacts like emojis or Base64
- All 23 crafted prompts bypassed four LLM gatekeepers with active policies
- GPT-5 with Python interpreter extracted payloads in over 90% of trials
- Not a jailbreak itself, but can combine with one as the payload
- Mitigations include input paraphrasing, policy wording, and output monitoring
- Vendors
- Check Point Research
- Organizations
- Check Point ResearchOpenAIAnthropicMeta
From the original article
13 min read at research.checkpoint.com
Executive Summary In this research we introduce a prompt-crafting technique for bypassing quick LLM-based policy checks — using plain English (no emojis, base64, invisible formatting, etc.) A policy-violating payload (e. g.
research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.