Defending LLM applications against Unicode character smuggling (aws.amazon.com)

AWS published an analysis showing that Unicode “tag block” characters (U+E0000–U+E007F)—originally used as invisible markers for language and some flag emoji variants—can be abused to smuggle hidden instructions into LLM inputs, enabling prompt-injection attacks. Because these characters are invisible to users but can be interpreted by models and runtimes, attackers can embed payloads that bypass filters and cause unintended actions (e.g., an assistant “summarize” request that also executes a hidden “delete inbox” command). The post stresses this is a practical, cross-system threat because models, browsers and languages can render or normalize the same character sequences differently, creating security gaps at scale. Technically, AWS details why naive sanitization fails: Java’s UTF-16 uses surrogate pairs, so a one-pass filter can accidentally combine orphaned surrogates into valid hidden tag blocks; fixing this requires recursive removal or careful handling. Python’s Unicode model (UTF-8/Unicode strings) avoids some pitfalls but still benefits from explicit stripping of tag blocks and orphaned surrogates. AWS provides sample Java/Python sanitizers deployable as Lambda handlers and recommends using Amazon Bedrock Guardrails’ denied topics to block tag-block content (note: Guardrails block but don’t sanitize). Tradeoffs include some flag emoji losing regional variants; AWS recommends these mitigations as part of a defense-in-depth approach alongside other prompt-injection protections.