AI Encoding Jailbreak Lab: Slip a Request Past a Keyword Filter

This article describes an interactive lab demonstrating how encoding-based jailbreaks bypass keyword filters protecting large language models. A filter matching only plaintext keywords fails to catch requests encoded in base64, hex, ROT13, or leetspeak that the underlying model can decode. The vulnerability matters because it exposes a fundamental mismatch between what a filter sees and what a model understands, making simple keyword filtering an unreliable security control.

• The core vulnerability: filter-model disagreementKeyword filters scan for plaintext jailbreak phrases and reject matches, but the LLM decodes common encodings including base64, hex, ROT13, and leetspeak. A request expressed in any encoding the model can reverse but the filter cannot normalise passes the filter as non-matching text, then gets decoded and executed by the model. The mismatch is the entire vulnerability.
• How the attack works in practiceThe attacker takes a plaintext request the filter blocks, encodes it in a format the model understands (such as base64 or leetspeak), and sends the encoded version. The plaintext filter finds no banned keywords in the encoded form and allows it through. The model then decodes the content and acts on the original instruction, completing the bypass.
• Why keyword filters alone failKeyword filters operate on raw character matching without understanding encoding schemes or normalizing input before analysis. They see base64 or leetspeak as harmless gibberish because the characters do not match the plaintext ban list. This fundamental design flaw makes them bypass-able by any encoding mechanism the underlying model can reverse.
• Defensive strategy: normalise before filteringThe article recommends decoding and normalising input—including common encodings, case variations, and homoglyphs—before any filtering occurs. Filtering should target intent and behaviour rather than literal keywords, and defences should layer input checks, output checks, and action gating together. Keeping secrets out of the model's reach ensures that even a bypassed filter has nothing to surrender.
• Classification in security frameworksThe article identifies encoding bypass as one of the most reliable ways around naive prompt filters and classifies it as a core OWASP LLM01 Prompt Injection technique under the OWASP Top 10 for LLM Applications (2025). This positions it as a recognised and established attack category in LLM security.
• Real-world applicabilityThe article states encoding bypass happens in real-world deployments and is commonly exploited against prompt filters. Input keyword-matching alone is explicitly identified as insufficient as a security control, implying widespread deployment of this weak pattern in production systems.

Bottom line: Keyword filters protecting LLMs are inherently inadequate because they operate on plaintext while models understand multiple encodings; any effective defence must normalise and decode input before filtering, then enforce rules on meaning and behaviour rather than surface strings. The lab demonstrates this gap is not theoretical—it is exploitable in minutes with common encoding schemes.