Decoy Fonts: Bypassing Claude's Vision

Visual adversarial attacks are usually complex noise patterns, but "Decoy Font" proves that simple typography can trick top-tier LLMs. By overlaying normal letters with thin, outlined decoy characters, this typeface creates a dual-layered message: humans see the intended text, but the image recognition systems in Claude, Gemini, and ChatGPT latch onto the decoy characters instead.

This is a fascinating approach to LLM security and prompt engineering because it targets the vision encoder rather than the linguistic logic. Essentially, the AI is "hallucinating" the decoy text because its OCR process prioritizes the high-contrast outlines over the actual letterforms.

If you're building an AI workflow that relies on OCR or vision-based data extraction, this is a reminder that visual inputs aren't absolute truth. A few strategic lines in a font can completely redirect an AI's interpretation of a document. It's a low-tech solution to a high-tech problem—basically a visual "magic prompt" that works before the text even hits the model's context window.

For anyone interested in a deep dive into vision-based bypasses, looking into how these models tokenize visual patches might explain why these thin decoys are so effective at hijacking the attention mechanism.