Unicode Prompt Canonicalization for GenAI Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are ineffective in detecting and preventing prompt injection attacks on artificial intelligence models, particularly those obfuscated using unicode characters.
Innovation Solution
A system that receives prompts intended for a generative artificial intelligence (GenAI) model, identifies and translates unicode fonts into plaintext, determines the validity of unicode characters based on associated tags, and either converts valid characters to plaintext or removes invalid characters before passing the modified prompt to the GenAI model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If unicode characters are used in prompts, then the model can process diverse languages and characters, but prompt injection attacks using unicode obfuscation become more difficult to detect and prevent
Solution Approach 1:
The system performs preliminary canonicalization of unicode characters before the prompt reaches the GenAI model. By converting all unicode characters to their normalized forms and removing invalid characters in advance, the system prevents prompt injection attacks while preserving legitimate multilingual content. This preliminary action resolves the contradiction by establishing security before the model processes the prompt.
Solution Approach 2:
The patent introduces an intermediary processing layer (the proxy system) between the user input and the GenAI model. This intermediary canonicalizes unicode characters and filters invalid content, acting as a mediator that allows diverse language input while blocking malicious unicode-based prompt injections. The intermediary resolves the contradiction by decoupling language support from security vulnerability.
2Difficulty of detecting and measuring
If unicode characters are converted to plaintext representation, then prompt injection attacks become more detectable, but the complexity of the processing system increases
Solution Approach 1:
The system changes the parameter representation of unicode characters by converting them to their canonical forms and plaintext equivalents. This parameter transformation makes hidden malicious patterns visible to detection systems while maintaining a relatively simple processing pipeline. The parameter change resolves the contradiction by transforming obfuscated attacks into detectable forms without requiring complex analysis systems.
3Reliability
If invalid unicode characters are removed from prompts, then model security is improved, but information loss occurs in the prompt
Solution Approach 1:
The system applies local quality filtering by examining each unicode character individually to determine validity. Only invalid characters are removed while preserving valid unicode content, allowing the system to maintain information integrity while improving security. This localized approach resolves the contradiction by being selective rather than blanket removal.
Data Source
AI summary
A prompt for a generative artificial intelligence (GenAI) model is received which includes unicode. Unicode fonts in the prompt are identified and then translated into a plaintext representation. Further, unicode characters in the prompt are identified which each have an associated unicode tag. It is determined, based on the associated unicode tags, whether at least a portion of the unicode characters are valid. When at least a portion of the unicode characters are determined to be valid, the unicode characters in the prompt are converted into a plaintext representation. The prompt with the translated fonts and the converted unicode fonts are passed into the GenAI model. When at least a portion of the unicode characters are not determined to be valid, the unicode characters are removed from the prompt. This prompt with the translated unicode fonts, after the unicode characters are removed, is input into the GenAI model.