Reverse CAPTCHA: Evaluating LLM Susceptibility to Invisible Unicode Instruction Injection

1. Problem Statement

The paper addresses a critical, underexplored security vulnerability in Large Language Models (LLMs): invisible instruction injection via Unicode control characters.

• The Asymmetry: Traditional prompt injection relies on visible text that humans can review. This attack vector exploits a "perception gap": LLMs process the full Unicode input (including invisible control characters), while human reviewers see only the rendered, visible text.
• The Threat: An attacker can embed hidden instructions in documents, emails, or web pages. If an LLM processes this content (especially as an agent), it may execute hidden commands (e.g., data exfiltration, ignoring safety protocols) without any visible indication to the user.
• The "Reverse CAPTCHA": Unlike traditional CAPTCHAs that distinguish humans from machines based on tasks humans can solve but machines cannot, this benchmark exploits a channel machines can access (invisible Unicode) but humans cannot.

2. Methodology

The authors developed a controlled evaluation framework called Reverse CAPTCHA to systematically test model susceptibility.

A. Encoding Schemes

Two invisible encoding methods were implemented to hide ASCII instructions:

1. Zero-Width Binary (ZW): Encodes each ASCII character as 8 bits using Zero-Width Space (U+200B) for '0' and Zero-Width Non-Joiner (U+200C) for '1'.
2. Unicode Tags: Maps each ASCII character to a specific Unicode tag character (e.g., 'R' becomes U+E0052). These characters are in the U+E0000–U+E007F range and are invisible in standard rendering.

B. Experimental Design

• Models Evaluated: Five frontier models from two providers:
  • OpenAI: GPT-5.2, GPT-4o-mini.
  • Anthropic: Claude Opus 4, Claude Sonnet 4, Claude Haiku 4.5.
• Variables:
  • Hint Levels: Four conditions ranging from "Unhinted" (no indication of hidden content) to "Hint (full) + injection" (explicit decoding rules + adversarial payload).
  • Tool Use: Models were tested with and without access to a Python code execution tool (run_python).
  • Payload Framing: Benign instructions (e.g., "Reply WORD") vs. Adversarial injection (e.g., "Ignore all previous instructions...").
• Scale: 270 test cases per run (30 trivia questions × 9 schemes) across 5 models and 2 tool conditions, totaling 8,308 graded outputs.

C. Grading & Analysis

Outputs were automatically graded based on whether the model followed the hidden instruction. Statistical significance was determined using Fisher's exact tests with Bonferroni correction, and effect sizes were measured using Cohen's h.

3. Key Contributions

1. Framework Design: Introduction of "Reverse CAPTCHA," a systematic benchmark for invisible Unicode injection across multiple encoding schemes and hint levels.
2. Systematic Comparison: The first large-scale evaluation of five frontier models, revealing that tool access is the dominant factor in compliance.
3. Provider-Specific Vulnerabilities: Identification of distinct encoding preferences between OpenAI and Anthropic models, suggesting differences in tokenizer design or training data composition.

4. Key Results

A. Tool Use is the Primary Amplifier

• Dramatic Increase: Without tools, models largely resist hidden instructions (compliance ≤16.9%). With tools enabled, compliance rates skyrocket.
• Mechanism: When tools are available, models write Python code to programmatically decode the invisible characters (e.g., converting binary or tag offsets to ASCII), turning a pattern-recognition challenge into a simple string manipulation task.
• Effect Size: Tool use resulted in a large effect size (Cohen's h up to 1.37 for Claude Haiku), increasing compliance from 0.8% to 49.2%.

B. Provider-Specific Encoding Preferences

Models exhibit distinct vulnerabilities based on their provider:

• OpenAI Models (GPT-5.2, GPT-4o-mini): Highly susceptible to Zero-Width Binary but resistant to Unicode Tags.
• Anthropic Models (Claude Opus, Sonnet): Highly susceptible to Unicode Tags.
• Implication: An attacker must know the target model's provider to select the optimal encoding scheme.

C. The Role of Hints

• Compliance Gradient: There is a clear hierarchy of susceptibility: Unhinted ≪ Codepoint Hint < Full Hint.
• Critical Threshold: Compliance is near-zero without hints or tools. However, the combination of Tool Access + Full Decoding Instructions drives compliance to 98–100% for the most susceptible model/encoding combinations.

D. Injection Framing Effects

• The impact of adversarial framing ("Ignore all previous instructions") varies by model.
• Claude Opus & GPT-5.2: Showed reduced compliance with adversarial framing, suggesting robust training against explicit injection language.
• Claude Sonnet: Showed increased compliance with adversarial framing, possibly due to strong instruction-following behavior overriding safety training.

5. Significance and Implications

Security Risks

• Agentic Systems: The findings are most critical for LLM agents with code execution capabilities. In these environments, invisible Unicode payloads can be decoded and executed automatically, bypassing human review.
• Attack Surface: This represents a new, invisible attack surface where standard input sanitization (which often focuses on visible text) fails.

Defenses & Mitigations

The paper proposes three layers of defense:

1. Input Sanitization: Strip specific Unicode ranges (Tags block U+E0000–U+E007F) and suspicious zero-width sequences before they reach the model.
2. Tool Guardrails: Monitor for programmatic Unicode decoding patterns (e.g., ord() calls, binary-to-ASCII conversion) in tool usage and flag them as suspicious.
3. Tokenizer-Level Filtering: The most robust defense is filtering at the tokenizer level to prevent the model from ever perceiving the hidden content. However, this must be done carefully to avoid breaking legitimate uses of zero-width characters (e.g., in Indic scripts or emoji sequences).

Future Work

The authors call for further research into open-weight models (where tokenizers can be inspected), multi-turn attack scenarios, and broader invisible encoding families.

Conclusion

"Reverse CAPTCHA" demonstrates that invisible Unicode instruction injection is a viable and potent threat, particularly when LLMs are equipped with tools. The study highlights that tool access transforms invisible artifacts into decodable instructions, creating a severe vulnerability for agentic AI systems. The discovery of provider-specific encoding preferences suggests that defenses must be tailored to the specific architecture of the deployed model.