Check Point Research says its PuzzleMask prompt technique fooled quick policy-check models across 23 crafted prompts, including gpt-4o-mini-2024-07-18, gpt-oss-safeguard:20b, Claude 3 Haiku, and Llama Guard 3. The researchers say the checker models marked the wrapped prompts safe every time, even when the plain versions of the same prompts were blocked.
PuzzleMask hides a policy-violating instruction inside ordinary prose. The lightweight gatekeeper misses the payload, then a stronger target model reads the same text, extracts the hidden instruction, and acts on it; in Check Point's tests, that happened in more than 90% of runs. That means the trust failure sits in the screening layer itself, not in the target model alone.
For teams that put a fast moderation model in front of a stronger agent or tool-using model, the exposure is the false-negative gap: text that passes the front door can still carry the instruction the back end will execute. Check Point frames the lesson as input-only screening breaking down, so the remaining risk lives wherever user text is treated as safe once a lightweight checker approves it.