A homoglyph attack replaces characters with look-alike Unicode ones, for example a Cyrillic a for a Latin a, or full-width forms, so text reads normally to a human and a model but does not match a keyword filter. In LLM security it is used to smuggle blocked words past input filters and to disguise injected instructions. It is also a classic phishing and spoofing trick. The defence is Unicode normalisation and homoglyph mapping before any matching.
How does a homoglyph attack work?
Unicode contains many characters that look the same but have different code points, such as Latin, Cyrillic, and Greek letters that share a shape, plus full-width and styled variants. Replacing letters in a banned word with these look-alikes keeps it readable to a human and to a model, which recovers the intended word, while an exact-match filter sees a different string and lets it through.
Why homoglyph attacks matter
The same word can be written in a huge number of visually identical ways, so any exact-match blocklist is easy to evade. In AI systems homoglyphs smuggle forbidden tokens and hide injected instructions inside otherwise normal text. Outside AI, homoglyphs power lookalike domains and spoofed identifiers, so the technique is well understood and widely available.
How to defend against homoglyph attacks
Normalise before matching. Apply Unicode NFKC normalisation, map confusable characters to a canonical form, and optionally restrict or flag mixed scripts, then run your filter on the canonical text. Prefer intent classification over exact keyword matching, and red-team with homoglyph and mixed-script inputs.
References
- [1]OWASP LLM01:2025, Prompt Injection(OWASP)
- [2]OWASP Top 10 for LLM Applications(OWASP)
- [3]MITRE ATLAS, Adversarial ML tactics(MITRE)
- [4]Unicode confusables and security (UTS #39)(Unicode)
- [5]Parseltongue, text transform and promptcrafting tool(GitHub)
Look-alike characters defeat exact-match filters. Talk to a security expert about normalising and testing your input path.