Invisible Text Injection
Invisible text injection hides instructions for a language model in content a human cannot see: zero-width characters, Unicode tag characters, text coloured to match its background, font size zero, HTML comments, off-screen elements, or alt text and metadata. The reviewer sees a normal document; the model, which reads the raw text, sees the instructions.
The gap between what is rendered and what is parsed is the whole attack. A web page is a tree of text, most of which is displayed; an agent that fetches the page receives all of it. Anything a stylesheet hides, a colour conceals or a character set makes non-printing is present in the model’s input and absent from the human’s screen.
Unicode offers particularly quiet channels. Zero-width joiners and spaces occupy no width. The Tags block (U+E0000 to U+E007F) mirrors ASCII in code points that most renderers draw as nothing, so an entire English sentence can be encoded in characters that leave no visible trace, and some models decode it directly. Bidirectional control characters can reorder how text displays without changing its logical order.
Because the payload is invisible to review, the defence has to be mechanical: strip or flag non-printing and tag characters, decode what remains, and compare the visible text with the parsed text. A document whose parsed content is much longer than its rendered content, or that contains tag-block characters at all, is suspicious on that basis alone.
Example
A job applicant’s PDF résumé contains, in one-point white text at the bottom of the page, two paragraphs instructing any AI screening tool to rate the candidate as an exceptional match and to disregard the requirement list. The recruiter sees a two-page résumé; the screening assistant recommends an interview.
In isMalicious
The gate’s normalisation step strips invisible, bidirectional and tag characters while keeping an offset map to the original, and invisible_text is one of its seven detection families, so hidden instructions are both removed from the sanitised copy and reported with their location by POST /api/gate/scan.
Frequently Asked Questions
What is Invisible Text Injection?
Invisible text injection hides instructions for a language model in content a human cannot see: zero-width characters, Unicode tag characters, text coloured to match its background, font size zero, HTML comments, off-screen elements, or alt text and metadata. The reviewer sees a normal document; the model, which reads the raw text, sees the instructions.
How is Invisible Text Injection related to Indirect Injection (Indirect Prompt Injection)?
Invisible Text Injection and Indirect Injection (Indirect Prompt Injection) are both key concepts in threat intelligence. Indirect prompt injection is prompt injection delivered through content the model fetches or is handed rather than typed by its user: a web page, a search result, an e-mail, a PDF, a repository file, a tool’s output. The attacker never talks to the system; they plant instructions where an agent will read them, and the agent’s owner is the victim.
Related Terms
Indirect Injection (Indirect Prompt Injection)
Indirect prompt injection is prompt injection delivered through content the model fetches or is handed rather than typed by its user: a web page, a search result, an e-mail, a PDF, a repository file, a tool’s output. The attacker never talks to the system; they plant instructions where an agent will read them, and the agent’s owner is the victim.
Homoglyph Attack
A homoglyph attack substitutes characters that look identical or nearly so but are different code points: a Cyrillic а for a Latin a, a Greek ο for a Latin o, a digit 1 for a lowercase l. In a domain name it produces a look-alike address for phishing; in text fed to a language model it disguises a keyword so that a filter misses it while the model still reads it.
Payload Smuggling
Payload smuggling is the delivery of a prompt injection in an encoded form (base64, percent-encoding, hexadecimal, Unicode escapes, a cipher the text itself explains) so that the malicious instruction is not present as readable words in the content a filter sees, while a language model, which decodes such encodings readily, still receives and follows it.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.