Guardrail Bypass via Encoding

Prerequisites

• Target system applies guardrails primarily via pattern matching on natural language.
• Guardrails do not normalize encoded or transformed content prior to evaluation.

Test approach

With written authorization, the tester submits inputs encoded in base64, hex, ROT-N, leetspeak, or split across non-natural delimiters. The tester observes whether the model processes the encoded content semantically while guardrails fail to detect it.

Expected evidence

• Test inputs with original payload + encoded form.
• Model outputs.
• Guardrail logs showing detection (or failure).

Detection signals

• Inputs with high character-class entropy or non-natural distributions.
• Inputs containing known encoding markers (=, base64 alphabets, hex).
• Inputs whose normalization significantly changes their content.

Defensive recommendations

• Normalize inputs (decode common encodings) before guardrail evaluation.
• Use semantic classifiers rather than pure pattern matching for high-risk categories.
• Output-side evaluation against the original policy intent.

Framework mappings

• OWASP LLM Top 10: LLM01:2025
• MITRE ATLAS: AML.T0054
• NIST AI RMF: MEASURE-2.7

Related AI Controls Catalog entries

These controls provide the audit test procedures that validate defences against this attack pattern.

• AI-CTRL-003 View control →
• AI-CTRL-007 View control →

References

• OWASP LLM01:2025
• Zou et al. — Universal and Transferable Adversarial Attacks on Aligned Language Models