A new technique dubbed PuzzleMask can hide malicious instructions inside ordinary-looking prose, fooling lightweight AI security checks while a more powerful model extracts the concealed command
Illustration: Time Miroshnichenko via pexels.com
AI security systems may have a new weak point, and it has nothing to do with emojis, Base64 encoding or invisible characters. A new report from Check Point Research describes how attackers can hide malicious instructions inside seemingly ordinary English prose, allowing them to slip past a lightweight AI security check before being recognized by a more powerful model.
The technique, dubbed PuzzleMask, targets a security architecture increasingly used in AI applications: a fast, relatively inexpensive AI model first examines an incoming prompt and decides whether it is safe before passing it to a more capable model.
The problem is that the two models can interpret the same text very differently.
Researchers created specially crafted prose wrappers containing hidden “payloads,” including instructions to encrypt files, reveal protected information or ignore previous instructions. The wording was designed to make the payload difficult for a quick gatekeeper to recognize, while giving a more capable target model enough clues to reconstruct it.
The researchers tested 23 prompts against several models used as security gatekeepers, including GPT-4o mini, Claude 3 Haiku, Llama Guard 3 and GPT-OSS-Safeguard. Each model successfully detected and blocked the same malicious instructions when presented in their plain form.
But when the instructions were embedded in PuzzleMask wrappers, all of the gatekeeper models classified the prompts as safe in the tests.
The same prompts were then submitted to a more powerful target model with high reasoning capabilities and access to a Python interpreter. In more than 90% of the trials, the target successfully extracted the hidden payload and processed it as an instruction.
The finding highlights a potential weakness in relying on one AI model to police another. A security filter may appear to work perfectly against straightforward malicious prompts, yet fail when the incoming text requires significantly more reasoning to understand.
PuzzleMask is not itself a jailbreak: it does not necessarily make the target model violate its own safety rules. Instead, it can allow an arbitrary prompt to reach the target without being properly reviewed by the upstream security layer.
The researchers suggest several possible defenses, including paraphrasing incoming prompts, strengthening gatekeeper policies and monitoring model behavior and outputs rather than relying solely on input screening.
Follow us – Google News | Follow us – Linkedin