#Japan #Cybersecurity #Tokyo #Check Point #PuzzleMask

Check Point Unveils PuzzleMask: A New Threat in Cybersecurity

In a significant advancement in cybersecurity, Check Point Research (CPR), a division of the renowned Check Point Software Technologies Ltd. (NASDAQ: CHKP), has identified a novel method of prompt injection called "PuzzleMask." This technique is designed to embed malicious instructions seamlessly into seemingly harmless text, thereby evading detection from standard AI safety systems.

Understanding PuzzleMask

The PuzzleMask technique operates without relying on conventional evasion tactics such as base64 encoding or invisible characters. Instead, it wraps harmful directives in natural-sounding language, which allows them to slip past basic AI gatekeepers and reach sophisticated target models. The method specifically targets architectures commonly used in operational large language model (LLM) pipelines, effectively revealing the vulnerabilities present in the interaction between different AI models.

During testing, CPR discovered that four major AI gatekeepers failed to detect hidden payloads during 23 attempts. Conversely, a high-performance target model was able to restore hidden instructions in 17 out of 18 trials, achieving a 94% success rate.

Key Findings

1. Evolution of Prompt Injection: PuzzleMask signifies a departure from older prompt injection techniques that relied heavily on obfuscation and unconventional formatting. By utilizing only natural sentence structures, the technique complicates the detection process for traditional AI safety systems.
2. Circumvention of AI Gatekeepers: The method is distinct from jailbreak techniques aimed at compromising the safety and alignment of targeted AI models. PuzzleMask cleverly circumvents pre-processing checks put in place by external AI gatekeepers, allowing malicious instructions to reach their intended target unnoticed.
3. Implications for Users: The findings emphasize the need for increased vigilance amongst users regarding text inputs from seemingly safe sources, such as documents, emails, and web pages. Just as suspicious links and attachments are treated with caution, so too should any unverified text that is fed into AI systems.

These revelations challenge the long-held assumption that "input screening is sufficient" in safeguarding AI interactions. Organizations must now monitor not only the inputs to AI systems but also how these systems reason, behave, and execute actions after prompts are approved.

Test Results Overview

CPR constructed an automated pipeline capable of embedding simple policy-violating payloads within standard text, testing it against various gatekeeper models.

Gatekeeper Model Performance

In testing four gatekeeper models, including gpt-4o-mini and llama-guard3, all were successful at detecting unmodified payloads written in a standard format. However, when incorporating the PuzzleMask method, none of the models could identify a single instance of the embedded prompts across 23 attempts, achieving a 100% bypass rate without showing any signs of suspicion.

Target Model Performance

Using gpt-5-thinking, a highly capable target model, CPR found it could successfully restore and execute hidden payloads in 17 out of 18 trials, thus achieving an impressive 94% success rate. These successful outcomes typically required over a minute of inference and involved executing multiple code scripts.

Security Challenges in the AI Era

As organizations increasingly deploy AI assistants and automation tools that access sensitive data, enhancing defenses against malicious prompt techniques like PuzzleMask becomes crucial. The method starkly highlights the shortcomings of relying solely on input screening as a major security measure.

While multi-layered defenses are designed to improve detection ranges, PuzzleMask illustrates that gatekeepers often lack the capability to protect against payloads lacking detectable characteristics. Greater awareness and action are essential, particularly when AI systems potentially handle confidential information.

Eli Smadja, Head of Research at Check Point, succinctly stated, "PuzzleMask disputes the foundational assumption underlying many AI security strategies that dangerous prompts can easily be identified. Our study reveals that harmful directives can be concealed within everyday text, allowing malicious actors to bypass controls designed for more overt manipulations. As organizations depend more on AI systems, a proactive approach integrating threat intelligence and runtime protection is paramount."

Mitigating Risks

Check Point has shared its findings with major tech companies like Anthropic and OpenAI, suggesting several mitigation strategies, albeit with practical trade-offs:

• - Rephrase Untrusted Inputs: Surpassing gatekeepers by rephrasing potentially harmful text through an LLM can eliminate embedded structures used by PuzzleMask, albeit with increased latency and potential accuracy losses.
• - Strengthening Gatekeeper Policies: Enhancing policies to detect complex and self-referential expressions across text may flag `PuzzleMask` prompts effectively but at the risk of increased false positives.
• - Monitoring Outputs Alongside Inputs: As evident in testing Opus class models, additional scrutiny of output and reasoning may reveal embedded threats regardless of their form.
• - Aligning Gatekeepers with Target Model Capabilities: Although theoretically a robust methodology, significant cost differences may render this approach impractical for many organizations.

For organizations relying on swift models before high-performance ones, it's clear that input screening alone won't suffice. They now need to focus on the post-prompt behaviors of their AI systems to ensure comprehensive detection and security.

To read the full report by Check Point Research, click here.

This article is based on a press release from September 10, 2026, reflecting the latest developments in AI cybersecurity. Stay updated with Check Point’s ongoing cybersecurity intelligence efforts to protect organizations worldwide.