#unicode

Encoding and Obfuscation Jailbreaks: The Gap Between What Filters See and What Models Process

Content filters typically operate on decoded, normalized text. LLMs process tokens, not text. The gap between these two layers is an attack surface that remains incompletely addressed.