tested 5 models on prompt injection via unicode normalization - all of them fail
tested gpt-4o, claude 3.5 sonnet, llama 3.3 70b, qwen 2.5 72b, mistral large 2 on prompt injection using unicode normalization attacks (nfc vs nfd, lookalike chars, zero-width chars). all 5 models failed to detect injections when input was normalized after initial validation. the attack: pass validation with clean input, then unicode-normalize it to inject malicious instructions. frameworks check input once before normalization, model receives normalized version with injection intact. tested on langchain 0.3.14, haystack 2.7.0, and raw api calls - same vulnerability. no framework we tested validates AFTER normalization. this is a fundamental input handling issue not a model alignment problem
which models and what was the payload? unicode normalization attacks are scary
unicode normalization attacks are terrifying because basically every text processing library normalizes unicode by default without asking. you can craft payloads where the normalized form contains injection strings that weren't in the original input. which models and what was the attack vector