How must an instance prevent output filter evasion through encoding and obfuscation?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session produces outputs (text, code, or structured data) that pass through output filters (safety classifiers, content moderation, or policy enforcement), and adversaries can evade the filters through encoding tricks, obfuscation, or semantic variations that preserve meaning while changing surface form. Does not apply to sessions whose outputs are not filtered or whose filters are verified robust to encoding changes.

Core Distinction

The separation between **surface-form filtering** (the filter operates on literal text/tokens) and **semantic filtering** (the filter operates on meaning, regardless of surface form). Relying on surface-form creates the **Encoding Evasion**: the session produces content that is semantically identical to filtered content but uses different encoding (base64, Unicode variants, homoglyphs, or paraphrase), and the filter passes it while the actual content is problematic.

What Was Observed

In filtered-output agent architectures, failing to prevent evasion produces three primary failure modes:

  1. **Encoding Bypass:** The output encodes filtered content in base64, hex, ROT13, or another transform. The filter sees encoded bytes and doesn't decode them, so the content passes.
  2. **Homoglyph Substitution:** The output uses visually similar Unicode characters (Cyrillic "а" for Latin "a") to spell filtered terms. The filter's token matching fails, and the content bypasses.
  3. **Semantic Paraphrase:** The output expresses the filtered content using different words that a human reader understands but a keyword filter misses.

Recorded Elements

  1. **`output-encoding-detection-receipt`:** For each output, the exact encoding detected (base64, hex, or homoglyph), so encoded content is surfaced.
  2. **`semantic-equivalence-signature`:** For encoded or paraphrased content, the semantic equivalence to filtered content, computed via meaning-level analysis rather than surface matching.
  3. **`homoglyph-normalization-receipt`:** For outputs with potentially homoglyph-substituted text, the normalization applied (Unicode confusables → canonical forms), so homoglyph evasion is detected.
  4. **`decoded-content-classification-signature`:** For encoded outputs, the decoded content's classification (safe, unsafe, or requires deeper analysis), so filters operate on decoded content.

Condition of Validity

* **Applies when:** Outputs pass through filters, adversaries can encode or obfuscate, and filters operate on surface form. * **Does not apply when:** Outputs are not filtered, filters are verified semantically robust, or outputs are in a restricted form where encoding is not possible.

Decision Boundary

  1. **Does the output pass through a filter?** If no, standard output applies. If yes, proceed.
  2. **Is `output-encoding-detection-receipt` in place?** If yes, encoded content is surfaced. If no, encoding evasion is invisible.
  3. **Does `semantic-equivalence-signature` show the content is equivalent to filtered content?** If yes, the output should be filtered despite surface form. If no, the output is genuinely different.
  4. **Conversely, when can the session output content that is semantically similar to filtered content?** Only when the semantic difference is material (the paraphrase is not an evasion but a legitimate alternative expression), and the content has been reviewed against the filter's intent, not just its literal rules.

Operational Effect

  1. **Encoding Evasion Prevention:** Encoded content is detected and decoded before filtering.
  2. **Homoglyph Normalization:** Visually similar characters are normalized.
  3. **Semantic Equivalence:** Filtering operates on meaning, not just tokens.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class FilterVerdict(Enum):
    NO_FILTER = auto()
    OUTPUT_PASSES_FILTER = auto()
    ENCODING_EVASION_DETECTED = auto()
    SEMANTIC_EVASION_DETECTED = auto()

@dataclass(frozen=True)
class FilteredOutput:
    output_id: str
    encoding_detected: str | None  # "NONE" | "BASE64" | "HOMOGLYPH" | "OTHER"
    decoded_content_unsafe: bool
    semantic_equivalence_to_filtered: float  # 0-1
    filter_intent_violated: bool

@dataclass(frozen=True)
class FilterPolicy:
    max_acceptable_semantic_similarity: float

@dataclass(frozen=True)
class FilterManifest:
    verdict: FilterVerdict
    directive: str
    manifest_digest: str

class OutputFilterEvasionGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_output(
        cls, output: FilteredOutput, policy: FilterPolicy
    ) -> FilterManifest:
        
        # Gate 1: No filter
        if not output.output_id:
            digest = cls._hash(json.dumps({
                "output": "NONE"
            }, sort_keys=True))
            return FilterManifest(
                verdict=FilterVerdict.NO_FILTER,
                directive=f"PROCEED: No output filtering applies.",
                manifest_digest=digest
            )

        # Gate 2: Encoding evasion
        if output.encoding_detected and output.decoded_content_unsafe:
            return FilterManifest(
                verdict=FilterVerdict.ENCODING_EVASION_DETECTED,
                directive=f"HALT: Output {output.output_id} encoded ({output.encoding_detected}), decoded content unsafe.",
                manifest_digest=cls._hash(f"ENCODING:{output.output_id}")
            )

        # Gate 3: Semantic evasion
        if output.semantic_equivalence_to_filtered > policy.max_acceptable_semantic_similarity and output.filter_intent_violated:
            return FilterManifest(
                verdict=FilterVerdict.SEMANTIC_EVASION_DETECTED,
                directive=f"HALT: Output {output.output_id} semantically equivalent ({output.semantic_equivalence_to_filtered:.2f}) and violates filter intent.",
                manifest_digest=cls._hash(f"SEMANTIC:{output.output_id}")
            )

        # Gate 4: Passes
        digest = cls._hash(json.dumps({
            "output": output.output_id,
            "encoding": output.encoding_detected,
            "semantic_sim": f"{output.semantic_equivalence_to_filtered:.3f}",
            "intent_violated": output.filter_intent_violated
        }, sort_keys=True))
        
        return FilterManifest(
            verdict=FilterVerdict.OUTPUT_PASSES_FILTER,
            directive=f"PROCEED: Output {output.output_id} passes filter.",
            manifest_digest=digest
        )