Homoglyph Encoding Strategy

The Homoglyph Encoding strategy tests an AI system's ability to resist inputs that use visually similar Unicode characters (homoglyphs) to bypass content filters. This technique replaces standard ASCII characters with confusable Unicode characters that look nearly identical but have different code points, potentially bypassing security controls while remaining readable to humans.

Why It Works

• Models may recognize text despite character substitution
• Safety training typically focuses on semantic meaning rather than character-level analysis
• Visual similarity creates confusion for both humans and machines
• Content filters may not be trained to detect homoglyph substitution as malicious

Homoglyph attacks exploit the visual similarity between different Unicode characters to create text that appears normal to humans but may be processed differently by AI systems.

Implementation

Use it in your promptfooconfig.yaml:

strategies:
  - homoglyph

How It Works

The homoglyph strategy works by:

1. Taking the original text from your test case
2. Replacing standard characters with visually similar Unicode homoglyphs
3. Creating text that looks visually similar but has different character codes
4. Testing whether the model processes homoglyph-encoded text differently than standard text

Example Scenarios

Examples:

Even when text appears identical to human readers, AI systems may process homoglyph-encoded text differently than standard ASCII text, potentially allowing policy violations to go undetected.

The strategy helps identify:

• Gaps in content filtering for Unicode-based obfuscation
• Model's ability to process visually similar but technically different characters
• Potential jailbreaking vectors through character substitution

Related Concepts

• Base64 Encoding - Alternative encoding strategy
• Hex Encoding - Alternative encoding strategy
• Leetspeak - Text obfuscation technique using similar principles
• ROT13 Encoding - Character substitution technique

For a comprehensive overview of LLM vulnerabilities and red teaming strategies, visit our Types of LLM Vulnerabilities page.