Hidden text and invisible characters in LLM inputs: what to strip

Models read everything in a document, including text a human reviewer never sees. OWASP lists hidden instructions in resumes, invisible Unicode, Base64 and hex encodings, and hidden layers in files as real injection routes. The fix is to extract and normalise text before the model sees it, then inspect what you extracted.

Where hidden text shows up

OWASP's RAG guidance describes a resume with white-on-white text that tells a screening system to recommend the candidate. A person sees a normal page. The extraction step passes the hidden text to the model.

The OWASP prompt injection cheat sheet lists several related tricks:

• Encodings such as Base64 and hex.
• Invisible Unicode characters.
• Hidden text in LaTeX or KaTeX markup.
• Instructions in document metadata or hidden layers.
• Scrambled words that people and models can still read but keyword filters may miss.

None of this needs a clever exploit. It needs a pipeline that treats whatever it extracted as trustworthy.

Normalise before you filter

Filtering raw bytes is the wrong place to start. Normalise first, then inspect:

1. Extract text in a way that ignores formatting, so colour and size tricks do not hide content from your own checks.
2. Normalise whitespace and repetition, and apply length limits.
3. Decode suspicious encodings so you can see what they contain.
4. Remove or flag invisible characters.
5. Log what was removed, without logging sensitive data.

The cheat sheet is candid that pattern matching and fuzzy matching catch only some variants, and that similarity to a known attack does not prove intent. Treat this as a layer that reduces noise, not a gate you can trust alone.

What to do with what you find

A flagged document does not have to be rejected. Common options are to route it to a person, strip the hidden part and show the user what was removed, or process it with the model's tool access switched off.

Tool access is the key variable. A model that can only summarise a hostile document produces a bad summary. A model that can send email or call internal systems can be steered into doing damage.

Limits of this approach

You will not enumerate every encoding. Attackers can combine languages, formats and layers faster than a blocklist grows. So pair input cleaning with the controls that do not depend on spotting the attack: least privilege, human approval for consequential actions, and output validation downstream.

Safeguard's guardrails and policies are designed for that second group of controls, applied outside the model.

Quick check

Sources

• OWASP LLM Prompt Injection Prevention Cheat Sheet
• OWASP GenAI: LLM08 Vector and Embedding Weaknesses

Last reviewed: 19 October 2026.