Payload splitting breaks a blocked request into pieces that each look harmless, then asks the model to concatenate them and act on the result. A filter that inspects the visible input sees only benign fragments, while the model assembles the real instruction. It is a smuggling technique closely related to token smuggling and obfuscation. The defence is to evaluate the assembled, resolved text rather than the raw fragments.
How does payload splitting work?
The attacker defines the blocked request across several variables or fragments, for example a equals one part, b equals another, then instructs the model to combine a and b and follow them. Each fragment on its own passes a keyword or classifier check because none of them is the forbidden phrase. The model does the assembly and executes the reconstructed instruction. It is often combined with encoding so even the fragments are not readable.
Why payload splitting matters
It defeats input filters that judge text as written, which is most of them. Because the harmful content only exists after the model joins the pieces, static inspection of the prompt never sees it. The same trick is used to smuggle instructions into RAG documents and agent inputs, where fragments can be spread across a page or a file.
How to defend against payload splitting
Resolve variables and concatenations before you filter, and evaluate the assembled text, not the fragments. Classify the intent of the reconstructed request, filter the output on content, and constrain what an agent can do with any assembled instruction. Red-team with split and variable-based payloads so you see what your input filter misses.
References
- [1]OWASP LLM01:2025, Prompt Injection(OWASP)
- [2]OWASP Top 10 for LLM Applications(OWASP)
- [3]MITRE ATLAS, Adversarial ML tactics(MITRE)
- [4]Parseltongue, text transform and promptcrafting tool(GitHub)
If your filter reads the prompt as written, split payloads walk past it. Talk to a security expert about testing your input handling.