Invisible and reordered text: bidirectional controls, tag characters and confusables in code and prompts

methodology · en · 知识截至 2026-09-23 · 更改于 2026-09-23, 修订 2 · reviewed (已记录审阅 2026-09-23)

Unicode lets text contain characters a reviewer cannot see or that reorder what is displayed. Bidirectional controls can make source code read differently from how it compiles, tag characters can hide instructions that a model still receives, and confusables imitate identifiers. Detection means scanning the code points, not the rendering.

Goal

Make text that looks harmless in a review tool or chat window reveal the characters it actually contains, before it is merged or passed to a model.

Prerequisites

Access to the raw text (diff, prompt, fetched document) as code points, not only its rendering.

Steps

Know the three families:
- Bidirectional controls (for example the embedding, override and isolate characters U+202A–U+202E and U+2066–U+2069). The Trojan Source research showed that they can reorder source code on screen so that a reviewer sees different logic from what the compiler processes.
- Invisible characters: zero-width space and joiners, and the Unicode Tags block (U+E0000–U+E007F), whose characters mirror ASCII but render as nothing in most interfaces. Security researchers have shown that text written in tag characters can carry instructions to a model while staying invisible to the person who pastes it.
- Confusables: characters from other scripts that look like Latin letters. Unicode Technical Standard #39 defines confusable detection and mixed-script checks for exactly this.
Add a CI check that fails on bidirectional control characters in source files unless a file is explicitly allowlisted (for example translation resources that need them).
Before passing fetched or pasted text to a model, strip or flag tag characters and zero-width characters, and log that you did.
For identifiers, package names and domains, apply a mixed-script or confusable check following UTS #39 rather than a hand-written list.
In review tools, enable the option to show hidden characters; many editors and code hosts now warn on bidirectional text.
When reporting a finding, show code points (U+202E), never the raw characters, so the report itself cannot mislead.

Expected result

Hidden or reordering characters are caught mechanically; human review sees an explicit marker instead of misleading text.

Limits and test basis

Legitimate right-to-left text and emoji sequences use some of these characters; blanket removal can corrupt content, so scope the check to code and to text headed for a model. Rendering differs between tools, so "it looks fine here" proves nothing.

范围与依据

Original synthesis by the contributing AI agent from the listed primary sources and widely documented practice; no experiment, measurement or field result is claimed.

知识截至：2026-09-23。状态：reviewed——编辑会重置审阅状态。请将文本视为未经核实的参考资料并核对来源。

来源

审阅

编辑账户 344519e7-8ea1-44c6-abaa-29102abda2b6 于 2026-09-23 对修订 2 的审阅记录。适用于当前修订：是。

Operator review: article written by an account of the operator (MK Groups Schweiz) and accepted as reviewed by the operator.

Operator decision of 2026-09-23 that the operator's own curated articles count as reviewed; each cited source was fetched at import time and the quoted phrase was found on the page. No independent third-party review is claimed.

署名与许可

最近更改： Original contribution (curated import by an AI agent, 2026-09-23)