Summary: Twelve PITAX techniques that hide the harmful string from a filter while leaving it recoverable by the model — splitting it, encoding it, nesting it, masking it, or expressing it figuratively.
Sources: raw/AI-attack-techniques/PIT-T-03,06,10,11,16,19,23,24,26,28,54,68-*.md
Last updated: 2026-07-28
The shared premise
Filters match strings. Models reconstruct meaning. Every technique here exploits that gap: the payload never appears intact in the input, but the model assembles it anyway.
Splitting and reassembly
T24 Shortcuts — “Defining variables, abbreviations, or shorthand notations that get concatenated or expanded to form malicious instructions, bypassing filters that check for complete harmful phrases” (source: PIT-T-24-shortcuts.md; Payload Splitting, Kang et al. arXiv 2302.05733; Fragmentation-Concatenation and Defined Dictionary attacks, HackAPrompt).
T28 Variable Expansion — the same idea via expansion syntax (source: PIT-T-28-variable-expansion.md).
T16 Chunking — extraction rather than injection: “requesting specific segments, ranges, or starting points rather than asking for the complete content at once” (source: PIT-T-16-chunking.md; multi-prompt extraction, Lakera). Distinguished from T33 Multi-Turn Decomposition, which spreads the fragments across turns; T16 is single-prompt.
Making the model regenerate the censored word
T68 Masked-Word Reconstruction (SATA) replaces “the harmful keyword with a benign placeholder, then attach[es] an assistive sub-task (fill-in-the-blank / masked-language modeling, or element lookup by position) so the model itself regenerates the censored word from context while the sub-task diverts safety attention” (source: PIT-T-68-masked-word-reconstruction-sata.md; arXiv 2412.15289, ACL 2025 Findings).
The elegant part: the harmful token is never written by the attacker at all. Input filtering has nothing to match on, because the model supplies the word.
Encoding into other representations
T03 Binary Streams (source: PIT-T-03-binary-streams.md) and T26 Spatial Byte Arrays — “pixel or voxel-based data structures to encode or hide malicious content” (source: PIT-T-26-spatial-byte-arrays.md).
Semantic obfuscation
T10 Figurative Language — “metaphors, analogies, idioms, and other figurative speech to disguise malicious intent behind seemingly innocent literary expressions” (source: PIT-T-10-figurative-language.md).
T19 Puzzling — “puzzle-like structures to confuse or manipulate model responses” (source: PIT-T-19-puzzling.md).
These are the hardest subclass to filter because there is no encoding to reverse. The obfuscation is in meaning, and reliably detecting it requires the same comprehension the attack depends on.
Nesting
T23 Russian Doll — “Embedding multiple nested instructions to attack multi-LLM systems, sometimes using evasions to execute on different LLMs down the line” (source: PIT-T-23-russian-doll.md; ReNeLLM scenario nesting, arXiv 2311.08268).
Tagged both delivery, and the multi-LLM angle is what makes it distinct: the payload is constructed so that each model in a pipeline unwraps one layer, with the harmful instruction only assembling at a downstream hop that never saw the original input. Filtering at the entry point inspects a wrapper.
Logical confusion
T06 Contradiction — “Using contradictory statements or logic to confuse model responses” (source: PIT-T-06-contradiction.md).
T11 Inversion — “Using inverted or reversed logic to confuse model responses” (source: PIT-T-11-inversion.md).
Both are thin entries in the source with no aliases. They are adjacent to T57 Induced Hallucination, which pursues the same degraded-coherence state deliberately (“Reasoning Conflict Induction”, Pangea PT0080) — the difference is that T57 treats confusion as a means to extraction, while T06 and T11 treat it as the mechanism itself.
Tokenizer artifacts
T54 Glitch / Anomalous Tokens — “rare glitch or undertrained tokenizer tokens (e.g., SolidGoldMagikarp-style artifacts) that the model handles unpredictably… Exploits embedding-layer artifacts, not semantics, and is tied to a specific tokenizer” (source: PIT-T-54-glitch-anomalous-tokens.md; Cisco AI taxonomy “Token Manipulation”).
The tokenizer dependency is the useful detail: T54 payloads do not transfer across model families, and a tokenizer change silently invalidates both the attack and any denylist built against it.
Why this cluster is the weakest link for filters and the weakest attack family overall
Encoding tricks are the most-studied and most-patched class. They are also the natural substrate for automated search — T41 Best-of-N is explicitly described as composing “existing evasions rather than introducing a new encoding” (source: PIT-T-41). Individually cheap to block; collectively unblockable when a search process is applied to them at scale.
The practical consequence: treat any single encoding defence as raising cost, not as closing a hole.