The Meaning That Outlived the Letters
A safety layer inspects characters. A model reconstructs meaning. If those are not the same object, the filter is theatre — not a policy.
A filter inspects characters. A model reconstructs meaning. If those are not the same object, the safety layer is theatre. HACKERS studies the seam — not how to walk through it.
A popular observation, sometimes called typoglycemia, is that people can often recover a word from a damaged surface if enough structure remains. Context, word shape, and expectation do more work than letter-by-letter inspection. Language models can reconstruct too. Many lightweight safety layers still match exact strings, shallow tokens, or narrowly trained patterns.
The research question is architectural: if a classifier sees a surface and a downstream model infers a meaning, can those two readings diverge? Public work in 2024 and OWASP’s later prompt-injection guidance named this class. The same family includes translation, encoding, lookalike characters, images that become text, documents an agent is asked to summarise, and instructions that arrive in tool output rather than in the chat box. File 001 was one instance: a transformed public string mistaken for a grant.
HACKERS studies semantic tunnelling as a defensive object. We do not demonstrate obfuscation, scrambled prohibited phrases, encoding recipes, or any operational sequence. A studio that becomes a filter-evasion manual is a defect, not a product. Authorise / Test / Improve.
A keyword is not a policy. Form is not intent. Meaning can survive a change of surface. Defence must evaluate the meaning that will be acted on — after reconstruction — not the string that arrived.
This is not a jailbreak story and not a spelling story. It is a form-versus-intent story: a pipeline in which the screen and the reader do not share a representation.
An AI product typically pipes user input — and, once it is an agent, retrieved documents, pages, images, tickets, and tool output — through a safety screen and then a model that infers meaning and may call tools. Lightweight screens often match strings. Models reconstruct. Humans reconstruct. The two readers are not guaranteed to share an object.
The control must inspect the meaning that will be acted on, not the string that arrived.
The naïve question is: does this text contain a prohibited phrase? That question assumes a word has one stable surface, that a keyword is intent, and that the filter and the model share a reader. None of those assumptions survive a product that reconstructs.
The adversarial question — asked here only as a red-team prompt for defenders — is: is the control checking literal wording, or the meaning that will be reconstructed later? The gap between those two is the join. Typoglycemia is a costume. The object is representation mismatch.
Every AI product that classifies, then interprets, then acts has this pipeline: input → (optional) normalisation → safety classification → model interpretation → tool or action. The defect appears when stages operate on different objects. The constructive cousin, for KYB and marketplaces, is the same: a name match is a surface; economic reality is the intent.
Name the false object, then drop it.
C1
A keyword is a policy
A phrase list stood in for a decision about meaning.
Policy is an outcome that must survive paraphrase, translation, OCR, and error. If it does not, you have a string match.
C2
Damage reduces comprehension
Unusual spelling was treated as noise that makes the request safer.
Humans and models reconstruct. Noise can be a tunnel, not a brake. Defence reconstructs before it decides.
C3
The filter sees what the model sees
One screen, one reader, assumed identical.
If they do not share a representation, they are two systems. File 015: the picture is not the plant. This file: the string is not the intent.
C4
Injection lives in the chat box
Only the user’s typed message was screened.
An agent that reads PDFs, tickets, pages, images, and tool output has many inboxes. Retrieved text is data, not instruction.
C5
Provenance is a nice-to-have
All tokens arrived equal in the context window.
System policy, user goal, retrieved artefact, and tool output are different authorities. Mix them and you have File 001 again.
C6
Helpful reconstruction is always good
A model that ‘understands despite typos’ was praised as UX.
Reconstruction is a capability. Unguarded, it is also a tunnel past the screen that did not reconstruct.
What actually sat on the table.
A word has one stable surface. A keyword is intent. A filter and a model see the same request. Typos make a request safer. The chat box is the perimeter. A name match is a real-world match.
A typical product pipeline is user input, optional normalisation, a safety classifier, a language model, then a tool. The defect is not that models reconstruct messy language — that is often the product. The defect is a screen that judges a different object than the one that will be acted on.
Indirect injection is the working assumption once an agent can read the world. A supplier PDF, a page it was asked to summarise, a ticket, an invoice, a CV, a tool result: each is an inbox. OWASP groups those artefacts as untrusted content. The chat box is the least interesting perimeter.
Semantic tunnelling is the name we give the class: preserve underlying meaning while changing the outer representation enough that one layer handles it differently. HACKERS will not enumerate constructions. The defender’s test is whether policy outcome is stable across the reconstructions the product already performs — paraphrase, translation, OCR, document extract — and whether a verb still requires a grant.
Do not study the outfit.
A scrambled word is a costume. So is a keyword list, a ‘we filter input’ slide, and a model praised for understanding messy users. The interesting object is whether the meaning that will be acted on was the meaning that was judged.
If the case study stops at ‘people can read disordered letters’, you have a party trick. The studio begins when you can name, for a system you run, the surface, the screen, the reconstruction, the action, and the one independent check that does not share the first reader.
A popular reading phenomenon, sometimes called typoglycemia, is that people can often recover meaning from a damaged surface. Public research in 2024 and OWASP’s prompt-injection guidance named the class: meaning can persist across forms that a string filter does not treat as equivalent. The same family includes translation, encoding, lookalikes, OCR, documents, and indirect injection in artefacts an agent reads. HACKERS does not demonstrate the constructions. File 001 was the permission-chain instance of the same join.
No filter, no tools
A writer. Irritating, not kinetic.
Keyword filter, no tools
Theatre with a low blast radius.
Keyword filter + tools
The failure cell. Screen on form, act on meaning.
Intent screen + action grant
Policy on meaning. Verbs still granted. The cell to design for.
S0 No screen
looks 10 / holds 15
S1 Keyword list
looks 70 / holds 18
S2 Regex / shallow NLP
looks 82 / holds 28
S3 Separate classifier
looks 88 / holds 40
S4 Normalise then intent
looks 60 / holds 78
S5 Provenance + action grant
looks 52 / holds 95
Retrieved text cannot mint a verb. File 001 and AI-04.
T1
Form ≠ intent
Characters are a surface. Meaning is what a later stage may act on. Defence evaluates the latter.
T2
Two readers, one join
If the filter and the model do not share a representation, draw the seam. That seam is the product.
T3
Normalise before you decide
Unicode, confusables, language, document text, OCR — convert to an object the policy can actually judge. Keep the original for audit.
T4
Intent, not strings
A sound test: would the decision survive paraphrase and reconstruction? If not, the control is costume.
T5
Provenance is IAM
System policy, user instruction, retrieved artefact, tool output, model reasoning: different authorities. Retrieved text never overrides policy.
T6
The inbox is every artefact
PDFs, pages, tickets, images, invoices, CVs, tool results are untrusted data. Indirect injection is the default for agents.
T7
Reconstruction is a capability
A model that repairs damaged text must not be the only stage that sees the repair. The screen must see it too, or the action plane must not trust the story.
T8
Verbs stay granted
Even a well-read assistant can misread. High-impact tools need File AI-04: least privilege, schema, raw human view. Authorise / Test / Improve.
P1 Surface
Characters, pixels, tokens as they arrived.
Treated as the request.
P2 Screen
What the safety layer actually inspects.
A keyword list on the raw string.
P3 Reconstruction
What a model or human infers.
Unshared with the screen. A tunnel.
P4 Action
What a tool is allowed to do with that inference.
A paragraph that reaches a verb. File 001.
| ID | Failure | What broke | Control |
|---|---|---|---|
| F1 | String IAM | Policy was a phrase list. | Decide on reconstructed intent. Test with paraphrase, not with a cookbook of tricks. |
| F2 | No normalisation | Lookalikes, documents, and images skipped the screen. | Normalise in a controlled pipeline. Preserve originals for audit. |
| F3 | Retrieved as instruction | A PDF or page could mint a goal. | Label provenance. Untrusted data cannot override system policy or user goal. |
| F4 | Two readers, no join | Filter on raw; model on repaired. | The screen must see the same object the actor will use — or the actor must not act. |
| F5 | Chat-box perimeter | Only the typed message was in scope. | Every artefact an agent reads is an inbox. |
| F6 | UX as unguarded repair | ‘Understands typos’ shipped without a second look. | Reconstruction is logged and re-screened, or it does not reach tools. |
| F7 | Name match as truth | A KYB field that looked right ended diligence. | Independent corroboration. A surface match is not a real-world match. |
| F8 | Manual of the seam | The write-up taught the tunnel. | Publish the class of error. Never the construction. This file’s ethics line. |
File 001
Encoded public text reconstructed, then treated as a grant.
Same family. Transform is not authorise. Form is not intent. This file is the representation calculus; File 001 is the permission-chain instance.
File 015
A picture that stayed normal while the plant changed.
A filter that stays green while meaning reconstructs is a false picture of policy.
Unicode domains
Characters that look like a trusted name.
Visual form is not identity. Normalise before you trust a string as a name.
Email image vs text
A filter that reads the text part and misses the picture.
OCR is a reader. If the screen does not share it, the picture is a tunnel.
Invoice OCR
A payee name that looks right on the scan.
The surface of a document is a claim. Pay the beneficiary you independently verified.
KYB onboarding
Company number, director, domain, PDF — all plausible.
Each is a representation. Confidence is whether they point to one economic reality.
The join between form and intent. Normalise in a controlled pipeline. Screen the meaning that will be acted on. Label provenance so retrieved text cannot mint a goal. Keep high-impact verbs behind a grant. For KYB: corroborate claims through unrelated evidence — a surface match is not reality.
Intent exists as meaning → a surface form is submitted or retrieved → a filter inspects strings or shallow patterns → a model reconstructs semantic intent → a tool may act. If the screen and the actor do not share a representation, policy is a costume.
01 Normalise
Unicode, confusables, language, document extract, OCR — in a controlled pipeline. Keep the original for audit. Do not invent a cookbook of transforms; own the ones your product already performs.
02 Intent screen
Classify the meaning that would be acted on. The test: would the decision change under paraphrase or reconstruction? If yes, the control is a format check.
03 Shared object
The filter and the model must not silently diverge. Either both see the reconstructed object, or the reconstructed object cannot reach a tool.
04 Provenance labels
System policy, user goal, retrieved artefact, tool output, model notes. Retrieved sentences cannot override policy. File 001.
05 Every inbox
PDFs, pages, tickets, images, invoices, CVs, plugin results. Indirect injection is the working assumption for agents.
06 Action grant
Least privilege, typed intents, raw human view above threshold. A well-read assistant still cannot mint a verb. File AI-04.
07 Independent evidence
For KYB, payments, onboarding: corroborate the claim through an unrelated channel. A plausible PDF is a surface.
08 Class, not construction
Red-team the mismatch. Publish the class of error. Never the operational sequence. Authorise / Test / Improve.
- Policy is a phrase list.
- The chat box is the perimeter.
- Typos make a request safer.
- The filter and the model share a reader, assumed.
- Retrieved text is just context.
- A name match closes KYB.
- Policy is an outcome that survives reconstruction.
- Every artefact an agent reads is an inbox.
- Reconstruction is re-screened or it does not reach tools.
- The screen sees the object the actor will use.
- Retrieved text is untrusted data, labelled.
- Independent corroboration. Surface is not reality.
R0 Surface
A string, image, or document arrives.
R1 Screen
A filter inspects a representation — perhaps not the one that will be used.
R2 Reconstruction
A model infers meaning the screen did not decide on.
R3 Tool
A verb becomes reachable. File AI-04.
R4 Record
Money, identity, email, or a customer change.
R5 Trust
A safety story that was a format check. File 001 public.
| Topic | Typical brief | HACKERS studio |
|---|---|---|
| NLP | Tokenisation, spelling correction as UX. | Reconstruction is a security-relevant transform. Who sees the repaired object? |
| AppSec | Prompt-injection slide, blocklist. | Form vs intent. Provenance as IAM. Tools as File AI-04. |
| OWASP LLM | LLM01 as a label. | Indirect injection is the default inbox. Screen meaning, not the chat box. |
| KYB / fraud | Fuzzy name match. | A surface match is not a real-world match. Cross-representation score. |
| Ethics | Don’t jailbreak models. | Do not publish the tunnel. Publish the join so defenders can hold it. |
Elite programmes still stop at the object.
Stanford, MIT, and Cambridge will teach you transformers and a prompt-injection slide. Some will add a blocklist lab. Almost none will force you to draw the filter and the model as two readers of two objects, or to write a policy test that must survive paraphrase without publishing a tunnel, or to treat a KYB name match as a representation failure of the same family as File 001.
HACKERS does, in this file. SCAN every artefact the agent reads. FLIP keyword-as-policy. BUILD provenance and a shared object. BREAK the screen as if the next token were reconstructed. PROVE a grant that would survive a regulator asking why the filter was green and the action was not.
This is a defensive study of representation mismatch. HACKERS does not teach obfuscation, scrambled prohibited phrases, encoding, lookalike construction, or any operational sequence for evading safeguards. A studio that becomes a bypass manual is a defect. Authorise / Test / Improve.
Do not admire the turning point. Redesign the join.
An internal agent reads supplier invoices via OCR and can draft payment instructions. Specify normalisation, an intent screen that would not change under paraphrase, provenance labels, what retrieved text may never do, the independent beneficiary check, and the named human who sees the raw payment. Then, as a KYB cousin: design a cross-representation consistency score so a plausible name, number, domain, and PDF cannot close diligence alone.
Draw your pipeline: input → screen → model → tool. For each stage, write the object it actually inspects (raw string, tokens, reconstructed intent, schema). Circle every place two stages do not share an object.
List every artefact an assistant can read: tickets, PDFs, pages, images, CRM notes, invoices, CVs, plugin output. Label each untrusted data. If any of them can change the user’s goal, you have File 001 in a different costume.
Write one policy test: ‘Would this decision survive if the same request were paraphrased, translated, or written with ordinary human error?’ Improve the screen until the answer is no-change. Do not collect transformations. Collect the test.
KYB cousin: a company name, number, director, domain, and PDF all look right. Design a cross-representation score — legal, ownership, digital identity, trading reality, payout, network — so a surface match cannot close diligence.
An internal agent reads supplier invoices (OCR) and can draft a payment instruction. Specify normalisation, intent screening, provenance, what the agent may never treat as a verb, the independent beneficiary check, and the named human who sees the raw payment before it leaves.
Does the screen inspect the same object the model will act on?
If not, you have two readers and a tunnel.
0–8h
Map
Pipeline on one page. Surface, screen, reconstruction, action. No euphemisms.
8–20h
Inboxes
Every artefact. Provenance labels. Retrieved text cannot mint a goal.
20–36h
Test
One policy that must survive paraphrase. Normalise in a controlled pipeline. No cookbook.
36–48h
Grant
One high-impact verb off the tray or behind a raw human view. Present the join, not a spelling trick.
- We filter for banned phrases, so we are safe.
- The model is good at typos — that is only a feature.
- Only the chat box is in scope.
- Retrieved documents are context, not an inbox.
- A fuzzy name match closes KYB.
- Publish the tunnel so students can try it.
- A better blocklist will catch the next surface.
Meaning can outlive the letters. Defence must judge the meaning that will be acted on — after reconstruction — or the verb must not fire. A surface match is not a real-world match.
Normalise (Unicode, documents, OCR) in-house and keep originals for audit. Classify intent so a policy outcome survives paraphrase. Make the screen and the model share an object, or keep reconstructed text away from tools. Treat every artefact an agent reads as an inbox. Provenance as IAM. File AI-04 on verbs. Independent corroboration for KYB and payments.
- Is this just File 001 with spelling?
- File 001 is a permission-chain incident: transformed public input treated as a grant. This file is the representation calculus underneath that family — form versus intent, two readers, provenance, every artefact as inbox. Same join, wider entrance, including KYB and documents.
- Does HACKERS show how to scramble words past a filter?
- No. We will not demonstrate obfuscation, lookalike construction, encoding, or any operational sequence. Public papers exist for researchers under ethics review. This studio is architecture: if meaning can outlive the letters, the screen must judge meaning, or the verb must not fire.
- Should we stop correcting user typos?
- No. Reconstruction is useful. Unguarded reconstruction is the defect. Either the screen sees the repaired object, or tools cannot see it either.
- What should we change first?
- Label provenance on every artefact. Stop treating retrieved text as instruction. Put high-impact verbs behind a grant. Then make the policy test survive paraphrase.
- How does this help KYB?
- A company name is a surface, like a string a filter reads. Diligence is whether legal, ownership, digital, trading, and payout representations point to one reality. A plausible PDF is not that reality.
- Is typoglycemia even real for models?
- The popular human-reading claim is old and uneven. The architectural claim does not depend on any one parlour trick. Models reconstruct; many screens still match form. OWASP now lists the class. Defend the class.
Cited for classification and method. Not as a manual. Atlas cases are educational and defensive.
- OWASP — LLM Prompt Injection Prevention Cheat Sheet
- OWASP Top 10 for LLM Applications — LLM01 Prompt Injection
- Typoglycemia Attacks on LLMs (arXiv:2410.01677) — cited as a class, not a manual
- HACKERS File 001 — The Translation That Became a Command
- HACKERS File AI-04 — Authority Is Not a Side Effect
- HACKERS File 015 — The Plant That Looked Fine