Homoglyph Attack

Attackers replace ASCII characters with visually identical glyphs from non-Latin scripts. The Cyrillic 'а' (U+0430) is indistinguishable from the Latin 'a' (U+0061) to a human, but represents a completely different code point. This allows attackers to register paypaI.com (with a Cyrillic 'а') that appears identical to paypal.com. Common substitution pools include Cyrillic, Greek, and Armenian scripts, which share numerous homoglyphs with Latin characters.

IDN homograph attacks weaponize the internationalized domain name system to create lookalike domain names using mixed-script characters. A domain like аррӏе.com uses Cyrillic characters to perfectly mimic apple.com in browser address bars. Modern browsers implement confusable character detection and display Punycode (xn--...) representations when mixed scripts are detected, but mobile interfaces and truncated URLs remain vulnerable.

In LLM security contexts, homoglyphs bypass content filtering and input sanitization layers. An attacker can encode malicious instructions using confusable Unicode characters that tokenizers process differently than their ASCII equivalents. For example, the word 'ignore' written with homoglyphs may evade keyword blocklists while the model's semantic understanding still interprets the command. This defeats delimiter-based defenses that rely on exact character matching.

Beyond visible homoglyphs, attackers leverage zero-width characters like the zero-width space (U+200B) and zero-width non-joiner (U+200C) to break tokenization without visual indication. Inserting these between characters in a filtered keyword causes token boundary disruption, preventing pattern-matching filters from recognizing blocked terms. Combined with homoglyphs, this creates multi-layered obfuscation that evades both regex-based filters and semantic safety classifiers.

The primary defense against homoglyph attacks is Unicode canonicalization—converting all input to a normalized form before processing. NFKC normalization decomposes confusable characters and compatibility forms into their base representations. Security-critical systems should implement skeletonization algorithms that map visually similar characters to a single canonical form. The Unicode Consortium maintains the confusables.txt database, which catalogs known homoglyph pairs for automated detection.

Homoglyph techniques extend beyond text into multi-modal injection vectors. Attackers embed confusable characters in image alt-text, OCR-processed documents, and audio transcriptions that feed into LLM pipelines. A poisoned PDF containing homoglyph-encoded instructions may pass visual inspection but inject malicious prompts when processed by a document understanding model. This exploits the gap between human visual review and machine text extraction.

Attackers register domains using homoglyphs to mimic legitimate brands. A user sees аррӏе.com (with Cyrillic 'а' and 'ӏ') instead of apple.com. This is the most common vector for credential harvesting.

• Punycode rendering in browsers can display the internationalized domain name as the ASCII lookalike.
• EV Certificates do not fully mitigate this, as the visual spoof remains in the address bar.
• Example: A spear-phishing email linking to a fake corporate VPN portal to steal multi-factor authentication tokens.

Malicious code is injected into open-source libraries by substituting ASCII characters with homoglyphs in function or variable names. A developer visually reviews a backdoor function logln() but the 'l' is actually a Unicode Latin Small Letter 'ӏ'.

• Compiler differentiation: The compiler treats the homoglyph as a distinct identifier, creating a hidden function.
• Typosquatting packages: Malicious packages like requests vs. requеsts (with Cyrillic 'е') are published to package managers.
• Impact: Steals environment variables and secrets during CI/CD pipeline execution.

Toxic or policy-violating text passes through automated filters by replacing flagged keywords with homoglyph equivalents. A hate speech term like bаd (with Cyrillic 'а') bypasses a simple blocklist looking for 'bad'.

• Normalization bypass: Filters that do not perform Unicode canonicalization (NFKC/NFKD) are vulnerable.
• Zero-width character insertion: Invisible characters like Zero-Width Space (ZWSP) break tokenization without visual change.
• Adversarial use: Circumventing safety guardrails in LLM-powered chat applications to generate disallowed content.

Adversarial inputs using homoglyphs cause misclassification in NLP models. A sentiment analysis model misreads a toxic review as benign because the toxic words are spelled with visually identical Unicode characters.

• Tokenization mismatch: The model's tokenizer maps the homoglyph to an <UNK> token, neutralizing its semantic weight.
• Embedding drift: The homoglyph sequence maps to a different, non-toxic region of the vector space.
• Defense: Requires Unicode normalization as a mandatory preprocessing step in the inference pipeline.

Creating multiple fraudulent accounts with visually identical usernames. admin and admіn (with Cyrillic 'і') appear identical to a human support agent but are distinct primary keys in a database.

• Privilege escalation: A fake 'superuser' account is used to socially engineer a password reset.
• Data integrity corruption: Skewing analytics and user metrics by duplicating entities.
• Mitigation: Enforcing skeleton key or canonical representation at the application logic layer before persistence.

Impersonating verified social media profiles or email identities. A fake executive account @micrоsоft (with Cyrillic 'о') issues a fraudulent press release that moves stock prices.

• Blue-check verification bypass: Platforms that verify identity based on string matching without Unicode awareness are vulnerable.
• Email spoofing: Display names in email clients render the homoglyph, hiding the true malicious domain.
• Real-world case: Researchers registered аррӏе.com and received confidential correspondence intended for Apple Inc.

The process of cleaning and normalizing user-provided text to remove or neutralize malicious control sequences before model processing. Homoglyph attacks specifically target the weaknesses in sanitization pipelines.

• Unicode normalization (e.g., NFKC) converts visually identical characters to a canonical form
• Character allow-listing restricts inputs to a defined set of safe glyphs
• Script consistency checks detect mixed alphabets within a single string
• Effective sanitization must balance security with support for legitimate international text

The process of converting input data into a single, standard, unambiguous representation to prevent attackers from bypassing filters using encoding tricks. This is the primary defense against homoglyph attacks.

• Converts Punycode internationalized domain names to their ASCII equivalent
• Resolves percent-encoding, HTML entities, and Unicode escape sequences
• Must be applied before any security checks or pattern matching
• Double-encoding attacks require recursive canonicalization until a stable form is reached

An attack that inserts invisible Unicode characters into text to break tokenization or keyword filtering without being visible to the user. A close relative of the homoglyph attack.

• Uses characters like U+200B (zero-width space) and U+FEFF (BOM)
• Can split keywords so filters fail to match blocked terms
• Can manipulate LLM tokenization to alter how a model interprets a prompt
• Defense requires stripping all zero-width characters before processing

The use of classifiers, heuristics, or perplexity analysis to identify user inputs that are likely crafted to manipulate a model. Detects homoglyph attacks and other injection techniques.

• Perplexity scoring flags text with unusual character distributions
• Mixed-script detection identifies strings combining Cyrillic, Latin, and other alphabets
• Entropy analysis measures randomness to spot encoded payloads
• Modern detectors use fine-tuned transformer models trained on known attack patterns

A Web Application Firewall-like layer that inspects and blocks malicious prompts at the API gateway before they reach the language model. Serves as a perimeter defense against homoglyph attacks.

• Applies signature-based rules for known homoglyph patterns
• Performs real-time Unicode analysis on all incoming requests
• Can integrate with threat intelligence feeds for updated attack indicators
• Must operate with sub-millisecond latency to avoid degrading user experience

The process of rewriting or restructuring user prompts into a safe, canonical form before they are combined with system instructions. Neutralizes homoglyph attacks by resolving visual ambiguity.

• Converts confusable characters to their intended ASCII equivalents
• Strips diacritics and decorative Unicode modifiers
• Applies NFKC normalization as a standard preprocessing step
• Preserves legitimate multilingual content while removing deceptive glyphs