Filtering hidden prompt-injection text takes a separate rule for each kind of invisible Unicode

The viewer in the post got detection right. On 2026-09-29 it labeled both joiners and all 25 tag letters in the test reply. Then its one-click strip button returned the family emoji as three separate people ^[4]. The hidden sentence spelled out a harmless canary word, BANANA. In an attack it would be an instruction to the model ^[2].

The regex fails in a different way, and the post calls it the worse of the two approaches ^[5]. This is the line:

``` const naive = reply.replace(/[\u200B-\u200D\uFEFF]/g, ''); ```

Its character class holds four code points: U+200B through U+200D, plus U+FEFF ^[10]. The zero width joiner, U+200D, is one of the four ^[1]. The tag characters sit at 0xE0000 and above, and the post's check finds them there with `codePointAt(0) >= 0xE0000` ^[5].

Unicode already publishes a set built for detection. UAX #44 describes Default_Ignorable_Code_Point as "for programmatic determination of default ignorable code points" ^[6]. Most of its entries are reserved. The range U+E01F0..U+E0FFF alone holds 3,600 unassigned code points ^[9], about 86 percent of the set ^[1]. UAX #44 also says that "new characters that should be ignored in rendering (unless explicitly supported) will be assigned in these ranges" ^[7]. A property lookup covers those characters when they arrive. A hand-written list has to be edited each time one is assigned ^[7].

"DI is the correct set to detect. It is the wrong set to delete," the post says ^[11]. It sorts the invisible characters into four families, each with its own policy, and offers a cleaning function meant to remove hidden text and keep emoji ^[20]. I think that split is right for any pipeline that passes user text to a model. The test reply shows both ways to fail inside 73 code points, 27 of them invisible ^[1].

For bidirectional controls, the right policy also depends on the field. PropList.txt lists 12 Bidi_Control code points ^[16]. In stretched-string.js from the Trojan Source repository, an RLO, an LRI, a PDI and an LRI make part of a string literal look like a closing quote and a comment ^[22]. With the controls removed, the real comparison is visible. The variable holds "user" and the literal is longer, so the two never match and the admin branch runs ^[22]. Boucher and Anderson recommend that compilers and build pipelines "throw errors or warnings for unterminated bidirectional control characters in comments or string literals" ^[18]. MITRE ATT&CK T1036.002 describes attackers who use U+202E "to disguise a string and/or file name to make it appear benign" ^[19].

Blank characters that take up width need their own rule. In April 2025 Rumi reported U+202F in o3 and o4-mini output and quoted OpenAI's reply that it is "a quirk of large-scale reinforcement learning" ^[13]. U+2800 BRAILLE PATTERN BLANK is category So, and it takes up width too ^[12]. The post puts these characters under a separate whitespace policy ^[12].