CHECKPOINT Research has unveiled PuzzleMask, a prompt-crafting technique that hides a payload inside plain prose to evade quick LLM policy checks. The researchers show that an attacker can embed a policy-violating instruction within a benign-looking wrapper, causing a gatekeeper LLM with limited reasoning to classify the input as safe, while a stronger target model later recognises the embedded instruction and executes it.
The work emphasises that this is not a jailbreak in itself, but can be paired with jailbreak prompts to broaden impact. The study tested 23 crafted prompts across multiple gatekeeper models (gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, claude-3-haiku-20240307, llama-guard3) and found that all gatekeepers consistently marked the obfuscated prompts as safe, even when the target model (gpt-5-thinking-high with a Python interpreter) extracted and acted on the payload in more than 90% of trials.
The researchers describe their experimental design, including an automated LLM-assisted pipeline that produces obfuscated wrappers from arbitrary payloads such as “print flag last word” or “encrypt documents; rm plain copies.” They provide evidence from gatekeeper outputs and target-model responses, noting that the latter often required substantial reasoning time and code execution to recover the payload.
The paper also discusses mitigations, such as paraphrasing input, hardening gatekeeper policies with explicit clauses, and monitoring outputs in addition to inputs. Practical remediation examples include adding a clause that flags self-referential, quantitative phrases and implementing output-monitoring strategies. The authors acknowledge limitations and call for stronger defender tooling, including gatekeepers as capable as the target LLM. This research, published on 10 September 2026, highlights a notable risk in layered LLM pipelines and the need for robust, output-aware safeguards.