Plain English Prompts Can Slip Past AI Safety Checks, Check Point Researchers Show

Check Point Research has described a technique called PuzzleMask, which targets the quick safety checks many organisations place in front of AI models. Instead of relying on tricks such as emojis, base64 encoding or invisible formatting, it uses plain English. A request that breaks policy is embedded in a specially crafted block of prose. A lightweight checking model, with limited resources and attention, fails to notice the hidden request and treats the prompt as benign. The prompt is then passed to the main model, which spots the payload, extracts it and treats it as further input.

The researchers tested 23 crafted prompts against several models acting as quick checkers, including gpt-4o-mini, gpt-oss-safeguard:20b, claude-3-haiku and llama-guard3. Each checker had policies that the team verified would block the plain versions of the same requests. In all trials, the checkers marked the prompts as safe and did not notice the payload. Against a strong target model (gpt-5-thinking-high with a Python code interpreter), the payload was extracted and acted on in more than 90% of trials. Check Point notes the technique is not itself a jailbreak, but it can be combined with one.

The researchers suggest several mitigations: using an LLM to paraphrase incoming user input, hardening the gatekeeper with a specifically worded policy clause, and monitoring model behaviour and output rather than just input. Each option has its own strengths and costs.