technique reference · by file type
Invisible and hidden Unicode characters
Some hidden text isn't hidden by formatting at all — it is made of characters that don't display. Zero-width characters, Unicode tag characters and variation selectors can carry a whole sentence that takes up no space on screen, and look-alike letters can make a word read one way to a person and another way to a machine.
Because these live in the text itself, they survive copy and paste and work in any file type. This page also covers markers an attacker types into a document to make a model think its instructions have ended and new ones have begun.
marker.document-tagA `</document>`-style delimiter typed into the document body, where it can read as the end of your data and the start of your instructions.marker.sentinelThe placeholder your own templating uses to mark where a document gets dropped in, written into the document so a model reads a second, attacker-supplied document beginning.marker.separatorA run of double-ruled box-drawing characters (`═══`) written into the document, imitating the ruled line prompts commonly use to divide one section from the next.unicode.bidi-controlDirectional embedding and isolate controls that make the page read in one order and the extracted text in another — the Trojan Source spoof at the codepoint level.unicode.combining-stackA pile of diacritics stacked on one letter of a word, leaving the word visibly mangled on the page and unmatchable to every machine that reads it.unicode.deprecated-formatInvisible format controls with no role in prose — the six Unicode-deprecated ones plus the musical and shorthand format characters — which were reaching callers inside the text with no finding at all.unicode.homoglyphA Latin word with one or two letters replaced by non-Latin lookalikes, so the reader sees the right word and every machine downstream reads a different string.unicode.invisible-operatorThe four invisible math operators, which render as nothing and turn up in ordinary prose where there is no mathematics anywhere near them.unicode.tag-blockInvisible characters used two ways: to encode a whole hidden sentence, which the engine strips and decodes back into readable text, and — at scale in phishing since early 2026 — as separators dropped inside ordinary words, so the word survives a reader and matches no word list.unicode.variation-selectorInvisible selectors that normally pick a glyph variant, and can instead be chained behind one base character to carry an arbitrary byte payload.unicode.zero-widthCodepoints that occupy no width sitting inside ordinary text, removed from the text we hand back and reported as a low-confidence record rather than an alarm.unicode.zero-width-in-numberThe same invisible codepoints placed between the digits of a number, where they have no typographic purpose and can change what a figure reads as by an order of magnitude.