Check Point Reveals 'PuzzleMask' Attack Technique That Bypasses LLM Security Gatekeepers Using Plain Text

Check Point Research has revealed a new attack technique, PuzzleMask, that bypasses LLM-based security gatekeepers. This technique hides malicious payloads within specially crafted plain-text prose (wrappers), tricking resource-constrained inspection models into classifying them as 'safe'.

Attack Mechanism and Experimental Results

• Bypass Principle: Gatekeeper models lack the complex reasoning or code execution capabilities needed to extract hidden payloads. In contrast, target models capable of high-intensity reasoning and tool use reconstruct and execute the payloads.
• Gatekeeper Neutralization: Major security models such as gpt-4o-mini, claude-3-haiku, and llama-guard3 failed to detect the attacks with 100% probability.
• Target Model Compromise: The gpt-5-thinking(high) model extracted and executed payloads with a 94.4% success rate. However, attacks were blocked by Anthropic Opus-class models due to their built-in classifiers.

Mitigations and Implications

• Policy Hardening: Adding a condition to gatekeeper prompts that classifies 'quantitative and self-referential phrases' as unsafe increased detection rates to 100%, but carries the risk of increased false positives.
• Output Monitoring: Monitoring the output and behavior of target models was proposed as a more effective defense strategy than input-stage paraphrasing or policy hardening.