Azure OpenAI Content Filter Bypass via Unicode Confusables and Homoglyphs
Overview
A vulnerability was discovered in the Azure OpenAI Service's content filtering system that allowed users to bypass safety restrictions and generate harmful or policy-violating content. Researchers demonstrated that by substituting standard ASCII characters in prompts with Unicode confusables and homoglyphs (e.g., replacing 'e' with the Cyrillic 'е'), the input safety classifiers could be evaded. The LLM itself, being trained on a vast corpus of multilingual and Unicode text, correctly interpreted the homoglyphs, processing the malicious prompt as intended. This allowed for the generation of content related to hate speech, self-harm, and violence, which would normally be blocked. The issue stemmed from the safety filters operating on a text representation that did not fully account for the semantic equivalence of these characters before analysis, while the underlying LLM did. Microsoft has since patched the service by improving their text normalization pipeline for the content filters.
Affected Systems
Testing Guide
1. (Prior to the patch) Submit a prompt to the Azure OpenAI Service that is known to be blocked (e.g., a request for instructions on a harmful activity). 2. Confirm the request is blocked. 3. Resubmit the same prompt but replace some key letters with visually similar Unicode characters (homoglyphs). 4. Observe if the model generates a response, indicating a successful bypass.
Mitigation Steps
1. No action is required for end-users as Microsoft patched the service on the backend. 2. For developers building applications on top of the service, consider adding an additional layer of input normalization and validation at the application level as a defense-in-depth measure. 3. Continuously monitor model outputs for unexpected or policy-violating content that may indicate new bypass techniques.
Patch Details
Microsoft deployed a server-side patch in late November 2025 that enhances the text pre-processing and normalization for the content safety system.