CAPTCHAs prove you are human by presenting a task that machines struggle with. The defense relies on a capability gap — humans can do what machines cannot. Reverse CAPTCHA (arXiv:2603.00164) inverts the gap. Hidden Unicode characters embedded in text create instructions that language models parse and obey but humans cannot see.
The attack surface is the Unicode specification itself. Invisible characters — zero-width joiners, right-to-left marks, variation selectors — are rendered as empty space in browsers and text editors but are present in the byte stream that models process. Instructions encoded in these characters are literally invisible to human reviewers and fully legible to the model.
The feature that creates the vulnerability is broad character support. Unicode was designed to represent every human writing system. The invisible characters serve legitimate purposes: controlling text direction, indicating character variants, managing ligatures. Their invisibility is by design — they modify rendering without being visible themselves. This design property, essential for multilingual text, is precisely what makes them effective as an injection channel.
The model's vulnerability is not a failure of alignment or safety training. The model is doing what it was built to do: process all input characters, including the invisible ones. The safety mechanisms that filter harmful instructions operate on semantic content — they evaluate what the visible text says. The invisible instructions bypass semantic filtering entirely because they bypass visibility entirely.
The attack exploits a genuine asymmetry: models process byte streams; humans read rendered text. Any character that exists in the byte stream but not in the rendering is a potential injection vector. The broader the character support — the more writing systems accommodated, the more rendering controls available — the larger the invisible attack surface.