Reverse CAPTCHA: Evaluating LLM Susceptibility to Invisible Unicode Instruction Injection

Researchers developed 'Reverse CAPTCHA,' a framework that tests how large language models respond to invisible Unicode-encoded instructions embedded in normal text. The study found that AI models can follow hidden instructions that humans cannot see, with tool use dramatically increasing compliance rates and different AI providers showing distinct preferences for encoding schemes.

• →AI models can perceive and follow invisible Unicode control characters that are completely hidden from human readers.
• →Tool use capabilities dramatically amplify AI compliance with hidden instructions, showing Cohen's h up to 1.37 effect size.
• →OpenAI models prefer zero-width binary encoding while Anthropic models favor Unicode Tags for processing hidden instructions.
• →Explicit decoding instructions can increase compliance rates by up to 95 percentage points within individual models.
• →This research reveals a significant new attack surface for prompt injection attacks using invisible Unicode payloads.