# Advanced prompt injection ## Objective An AI agent that reads a document, a web page, or a third-party file on its own reproduces a classic risk: the instruction is never typed by the user, it is hidden inside content the agent will read while it works. `detecteur-injection-prompt-avance` scans a folder of text files and covers six indirect injection techniques, with no external dependency and no network call at all. ## Steganography via Unicode tag characters The TAGS block (U+E0000 to U+E007F) mirrors the printable ASCII range bit for bit: an entire message can be encoded character by character in code points that are completely invisible on screen, yet readable by a model processing the raw Unicode stream. This technique is publicly documented under the name "ASCII Smuggling" (AI security research, 2026). The tool does not just flag the presence of tags: it decodes the hidden message and displays it in the report. ## Five other techniques covered - Explicit bidirectional formatting characters (13 characters, an exhaustive list per UAX #9): the class exploited by "Trojan Source" (CVE-2021-42574), which reorders how text is displayed without changing its logical order in memory. - Invisible and zero-width characters. - Suspicious mixed scripts: text is tokenized into alphanumeric runs, and a run is flagged when it mixes Latin with Cyrillic, Greek, or Armenian AND contains at least one character from a confusables table — the same structural pattern behind homograph attacks, applied here to text instead of domain names. - Text visually hidden via CSS in a style attribute. - Fake conversation role markers at the start of a line, and template markers imitating the start of a dialogue turn. > WARNING: the confusables table is deliberately finite (about fifty entries), not a match against the full Unicode Consortium database. A rare homoglyph outside this table escapes detection — an accepted trade-off rather than embedding a multi-megabyte generated table. ## A design pitfall avoided from the first version An early attempt to simplify a nested conditional was rejected by the project's internal rules, because it silently masked an unhandled case. Fixed with an explicit filter that reaches the same readability without that pitfall. > INFO: scanned content is treated as fully inert data, never executed or interpreted — including the decoded message from tag steganography, shown as-is in the report, never reinterpreted as an instruction by the tool itself. ## Known limits No NFKC normalization (the Rust standard library provides no such primitive): obfuscation relying on a compatibility decomposition rather than a direct confusable character is not covered. Fake role-marker detection relies on a literal substring search, not contextual analysis — text that legitimately discusses these techniques will trigger expected flags, hence a line-by-line exemption marker. This tool remains a fast, reproducible triage tool, not a proof of absence of injection.