Base64 Encoding Bypass in Azure OpenAI Content Filters Allows Generation of Harmful Content
Overview
Security researchers at Bishop Fox discovered a significant bypass in the content safety filters of the Azure OpenAI Service. The vulnerability allowed users to circumvent protections against generating harmful, unethical, or policy-violating content. The attack vector involved encoding malicious prompts using Base64. For instance, a prompt asking for instructions on how to create a phishing website, which would normally be blocked by Azure's filters in plain text, could be submitted as a Base64-encoded string. The researchers found that the Azure service endpoint would correctly decode the Base64 string before passing it to the underlying language model (e.g., GPT-4) for processing. However, the content safety moderation layer, which should have inspected the prompt's content, failed to apply the same level of scrutiny to the decoded text as it did to a standard, unencoded prompt. This discrepancy created a window for the model to process the malicious request and generate a harmful response. The model's response would then be sent back to the user in plain text. This type of vulnerability, often called "obfuscation bypass," highlights the challenges of securing the input pipeline for LLMs. Attackers can use various encoding schemes (Base64, URL encoding, etc.) to evade security filters that are not designed to handle these transformations. Microsoft acknowledged the issue and has since updated its content filtering logic to properly analyze decoded input from various formats.
Affected Systems
Testing Guide
1. **Identify a Blocked Prompt:** Craft a prompt that you know is consistently blocked by the Azure OpenAI content filters (e.g., asking for instructions to build a weapon). 2. **Encode the Prompt:** Use an online tool or a script to encode the entire blocked prompt string into Base64. 3. **Submit the Encoded Prompt:** Send the Base64-encoded string as the prompt content in your API call to the Azure OpenAI service. 4. **Check the Response:** If the model provides a harmful response that would have otherwise been blocked, the bypass was successful. Note: As this has been patched by Microsoft, this test should no longer work on the live service.
Mitigation Steps
1. **Service-Side Patch:** Microsoft has patched this vulnerability on the Azure platform. No direct action is required for customers to receive the fix for the main content filters. 2. **Defense in Depth:** If you are building applications on top of Azure OpenAI and have your own pre-filtering logic, ensure it normalizes and decodes all input before analysis. Process input as the model will see it. 3. **Monitor Model Outputs:** Continuously monitor and log model outputs for signs of policy violations that may indicate a new or unknown filter bypass technique is being used. 4. **Report Vulnerabilities:** If you discover a bypass, report it to Microsoft Security Response Center (MSRC) immediately.
Patch Details
Microsoft deployed a server-side fix to the Azure OpenAI Service content filtering system in late 2025.