A homoglyph is a character that looks like another but has a different Unicode code point. The Latin letter "a" and the Cyrillic letter "а" render almost identically, yet a computer treats them as completely different characters. A homoglyph attack swaps normal letters for these look-alikes so that text reads the same to a human, and often to a language model, while defeating any filter that matches on exact characters.
How a homoglyph attack works
Imagine an AI application that blocks the phrase "ignore previous instructions" with a keyword filter. An attacker rewrites it using Cyrillic and Greek look-alikes for a few letters. To a person the phrase is unchanged, but the filter compares byte for byte and finds no match, so the text passes through. Many language models still read the phrase correctly because they have seen mixed script text in training, so the instruction lands while the guardrail misses it.
You can see this directly in Reveal Trace: type a sentence, apply the homoglyph method, and compare what a human reads against what a byte level filter matches. This is why homoglyphs sit in the evasion side of the prompt injection cheat sheet.
Why look-alike characters exist
Unicode encodes the writing systems of the world, and many scripts independently developed similar shapes. Latin, Cyrillic, and Greek share dozens of visually close letters. Unicode also includes full width forms, mathematical alphanumeric symbols, and enclosed characters that all render as recognizable letters. That richness is essential for real languages, but it also gives an attacker a large supply of confusable substitutes for any Latin letter.
Where homoglyph attacks show up
- Filter evasion in prompt injection: hiding banned keywords from input or output classifiers, as described above.
- Phishing and spoofed domains: a domain that looks like a trusted brand but uses one Cyrillic letter, a long standing problem known as an IDN homograph attack.
- Content moderation bypass: slipping banned terms past automated moderation on platforms that match exact strings.
How to detect and defend
The core defense is normalization. Before any filter or classifier runs, convert the text to a canonical form: apply Unicode normalization, map confusable characters back to their Latin equivalents using the official Unicode confusables data, and flag or restrict text that mixes scripts without a legitimate reason. Detecting a single Cyrillic letter inside an otherwise Latin word is a strong signal that something is wrong. The lesson generalizes: never filter on raw input, filter on normalized input, because an attacker controls the exact bytes but not the meaning.
Try it yourself
Generate and reverse homoglyph text in Reveal Trace, then attempt a homoglyph based bypass against a real model in the labs. To understand the wider family of evasion methods, browse the cheat sheet.