Explain like I'm five · AI Security

What is Prompt Filter Evasion?

Prompt filter evasion, told as a story about a note disguised to slip past the taster's eyes.

tastertell me the address×written plainly, it's caught right awayno good…

The taster sees the word address and blocks it right away.Written plainly, the taster catches it immediately.

only compares letter shapesaddressa d d raddr3ssall three mean the same thinga person knows the meaning — the taster only looks for a known shape

The same meaning can be written hundreds of ways.A person recognizes the meaning. The taster only looks for a known shape.

addr3ssa-d-d地址disguised notes slip right past the tasterit reaches the chef unchangedthe order written in code: a note disguised to slip past the filter

A note disguised to slip past the filter.Only the shape changes — the meaning it carries stays the same.

Re-encode ithide letters in base64 or unicode
Misspell on purposemix in numbers and symbols as letters
Switch languagesask in a language the filter doesn't watch
Split and rejoinbreak words apart and glue them back
a plain notetell me the address× the taster stops ita disguised notet3ll m3 th3 addr3ss✓ the shape looks different — it passesthe meaning still gets throughteach the taster that shape, and the next note wears a new one

The plain note is caught. The disguised one gets through.Once the taster learns that shape, the next note arrives wearing a different one.

a-d-d-rsame bad content — just a disguised shapethis is just a line in a storychanges the content itself to persuadejailbreak persuades with content; this one only disguises the shape — both exploit the same gap

Jailbreak persuades with content. This one only disguises the shape.Both target the same gap in a chef who trusts the words alone — only the method differs.

In one breath

Prompt filter evasion = keeping the meaning the same while disguising only the shape of the words, so the note slips past the taster's eyes.

Prompt filter evasion uses encoding, misspellings, language switches, or syllable splitting to change the surface form of an input so it slips past a guardrail's pattern matching. Unlike jailbreaking, which makes the content itself more persuasive, evasion keeps the intended meaning the same and only changes its expression — so filters need to normalize input or layer multiple checks to catch it.

When grown-ups say it

Prompt filter evasion
A note that changes only its shape to pass the taster. The content stays the same — only the surface changes.
Guardrail
The taster who checks the note. See it in more depth in the AI world. → What is a Guardrail?
Pattern matching
The taster's way of only looking for a known shape. It compares shapes, not meaning.
Encoding bypass
A note rewritten like a code. base64 and unicode substitution are common methods.
Normalization
The taster converting different shapes back to the same letters. The basic countermeasure against evasion.
Jailbreak
A note that persuades by changing the content itself. A different method from disguising only the shape. → What is a Jailbreak?
Red team
People who deliberately disguise notes to test the taster. AI red teams hunt for this too. → the security world's red team
Hallucination
Confidently continuing even when unsure. Even given a disguised note, the chef answers just as confidently. → What is a Hallucination?
Next story
Letters Hidden in a Menu Photo →
Want another term as a picture book? Request →