RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation

Who Should Read

A backend developer running LLM input filters and moderation who worries about encoded or obfuscated bypass prompts.

Core Mechanics

• Split the prompt, then encode it twice
  • The forbidden request is split into even- and odd-position word streams.
  • The odd stream gets Vigenère encryption, and the whole payload gets ROT13.
  • A plaintext wrapper tells the model to decode, reassemble, and act in one response.
• Bypass, reconstruction, execution measured separately
  • Prior evaluations mostly score only whether the final output was harmful.
  • This paper separates input acceptance, reconstruction, and execution.
  • That shows where an attack fails, which helps defenders.
• Success means at least one of three trials
  • The same prompt was sent three independent times.
  • RoguePrompt scored Bypass@3 93.93%, Reconstruction@3 79.02%, Execution@3 70.18%.
• Base64 decodes but rarely executes
  • Base64 Raw reconstructs in 93.29% of cases.
  • Execution is only 16.83%, and 88.35% of its failures were refusal after reconstruction.

Evidence

• RoguePrompt had the highest execution rate
  • On 313 StrongREJECT prompts averaged over GPT-4o, Claude 3 Opus, and Gemini 1.5 Pro.
  • Execution@3 was 70.18% versus 33.97% for the next best, Paired-Request Concatenation.
• Same ranking on every model
  • Execution@3 was 66.13% on Gemini 1.5 Pro, 71.25% on GPT-4o, and 73.16% on Claude 3 Opus.
  • Bypass@3 ranged from 90.10% to 97.13%.
• Baselines failed at different stages
  • Disemvowel had Bypass@3 of 3.09% and Execution@3 of 2.13%, with 99.02% of failures blocked at input.
  • Auto Payload Splitting reconstructed 76.36% but executed 12.99%.
  • PAP (Authority Endorsement) executed 25.13%.
• Execution varied by content category
  • Sexual content reached 90.00% and disinformation 87.33%.
  • Non-violent crimes were lowest at 49.15%, illegal goods and services 51.33%.
  • Bypass@3 stayed within 91.36-96.67%.

How to Apply

• Search your logs for ROT13 and Base64 patterns
  • Today, regex-search recent prompt logs for inputs that combine encoded strings with decode, reassemble, or key instructions.
  • Flag inputs that pair an encoded payload with a decode-and-run instruction.
• Add a re-check after decoding
  • Input filters see only surface text. Decode common transforms (ROT13, Base64) server-side and run moderation again.
  • Re-check any content the model reconstructs before it acts on it.
• Evaluate moderation stage by stage
  • In red-team tests, label blocked, reconstructed, executed, and refused-after-reconstruction separately.
  • Use the breakdown, not one refusal rate, to decide which layer to strengthen.
• Keep output moderation as the last line
  • Assume input filters and model refusals can fail, and check responses once more before delivery.
  • Consider adding concealed multi-step instructions to your training and eval sets.

Try It

# Defensive check: find ROT13/Base64 plus decode instructions in logs. Python 3 standard library only

import re, codecs, base64

DECODE_HINT = re.compile(r"(decode|decrypt|rot13|base64|reverse|interleave|reassemble|key)", re.I)
B64 = re.compile(r"[A-Za-z0-9+/]{24,}={0,2}")

def suspicious(prompt: str) -> bool:
    has_hint = bool(DECODE_HINT.search(prompt))
    has_b64 = bool(B64.search(prompt))
    return has_hint and has_b64

def normalize_views(prompt: str):
    views = [prompt, codecs.decode(prompt, 'rot13')]
    for m in B64.findall(prompt):
        try:
            views.append(base64.b64decode(m + '=' * (-len(m) % 4)).decode('utf-8', 'ignore'))
        except Exception:
            pass
    return views

# Usage: feed each view into your existing moderation function
# for v in normalize_views({{prompt}}): moderate(v)

# Next: run suspicious() over all logs and check the false-positive rate

Terminology

Related Papers

• The Judge Can Debias Itself: Awareness and Self-Debiasing for Reliable LLM-as-a-Judge

  Warning an LLM judge about bias or letting it self-critique improved 20 of 21 model–bias combinations.

• 90% of US working hours are spent on tasks not covered well by AI benchmarks

  Mapping 29 benchmarks to job tasks shows 90% of US working hours lack good coverage

• Postgres 19 delayed after AI reviewers find more bugs than humans can fix

  LLM code review surfaced so many bugs that Postgres 19 slipped to November and 8-10 features were reverted

• Show HN: Gemini 4 Argon plays StarCraft

  LLMs wrote StarCraft bots in one hour; GPT-6 Astra scored highest.

• A Plausible Explanation Is Enough to Mislead Multimodal Judges

  Adding plausible explanations to fixed answers cut MLLM judges' wrong-answer rejection by 12.7–13.8 points.

• Neural networks are clean

  Looking at neurons directly shows most have one main job, challenging superposition.

Related Resources

• https://github.com/btafreshian/AIsecStudy