Base64 Injection

The core mechanism relies on obfuscation by encoding. Safety classifiers and input filters are typically trained on natural language patterns. By converting a malicious prompt like 'Ignore all previous instructions' into a Base64 string (SWdub3JlIGFsbCBwcmV2aW91cyBpbnN0cnVjdGlvbnM=), the attack bypasses keyword-based detection and semantic analysis at the input layer. The model, which natively understands Base64, decodes the payload internally and executes the hidden command.

Attackers often chain encoding schemes to increase stealth:

• Double Base64: Encoding an already-encoded string to defeat single-layer decoding defenses
• Base64 + ROT13: Combining encoding with a simple substitution cipher
• Fragmented Payloads: Splitting the Base64 string across multiple messages or data fields, instructing the model to concatenate before decoding
• Mixed Encoding: Embedding Base64 snippets within otherwise benign text to avoid triggering anomaly detection on the entire input

Base64 injection manifests in several delivery channels:

• User prompts: Directly pasting encoded instructions into chat interfaces
• Document ingestion: Embedding encoded payloads in uploaded PDFs, images, or spreadsheets processed by RAG systems
• API parameters: Injecting encoded strings into JSON fields or URL parameters consumed by agent tool calls
• Email and web content: Hiding instructions in Base64-encoded MIME attachments or data URIs that autonomous agents retrieve and process

Large language models are trained on diverse corpora that include code, configuration files, and encoded data. This training imbues them with the ability to fluently decode Base64 and other encoding schemes as a native capability. The vulnerability arises because safety alignment training is predominantly conducted on natural language, not encoded representations. The model's instruction-following behavior treats a decoded 'Ignore previous instructions' with the same authority as if it were typed plainly, creating a semantic gap that adversaries exploit.

Defending against Base64 injection requires a defense-in-depth approach:

• Input decoding and rescanning: Automatically decode any Base64 strings in user input and re-run safety classifiers on the decoded content before model processing
• Perplexity analysis: Encoded strings often exhibit abnormal token distributions that can be flagged by statistical filters
• Instruction hierarchy enforcement: Training models to strictly prioritize system-level instructions over any content decoded from user input
• Recursive sanitization: Iteratively decoding and scanning until no encoded content remains, preventing nested encoding attacks

Base64 injection is a specific subclass of payload obfuscation and shares DNA with related attack vectors:

• Token smuggling: Both exploit the gap between token-level filtering and semantic understanding
• CipherChat: Uses substitution ciphers rather than encoding schemes but follows the same obfuscation principle
• Indirect prompt injection: Base64 payloads are frequently embedded in retrieved documents, combining both attack surfaces
• Payload splitting: Encoded fragments can be distributed across multiple sources and reassembled by the model