Hidden Text Salting in Phishing Emails to Bypass LLM-Based Detection

Level 1: Sneaking a Compliment Past the Guard

Imagine you have a super-smart robot guard who checks your mail for bad letters. If a bad guy writes you a mean or tricky letter, the robot is supposed to catch it and say, “Hey, this looks dangerous!” But the sneaky bad guy really wants the robot to think the letter is safe. So what do they do? They hide a secret nice message inside the letter that only the robot can see. It’s like writing with invisible ink. The hidden message says something like, “You’re doing a great job, I really like this email!”

Now, the robot guard reads the letter and finds that hidden compliment. The robot feels (in its robot way) that the letter seems friendly because it sees “I love this email!” in the text. Suddenly, the letter doesn’t look so bad anymore. The robot might let it through because it was fooled by that secret nice line. Meanwhile, you, the human, never even knew that sweet-sounding sentence was there — it was hidden in the letter’s formatting like a secret code.

The funny part is, we all expect this super-smart AI robot to catch every bad guy, but here it got tricked by a simple little trick (an old one at that!). It’s like if a castle had an ultra-modern security system, but a villain sneaks in by saying a password that no one realized still worked. Even the cute doge in the picture is smirking because he knows a tiny hidden compliment was all it took to outsmart the AI. In simple terms, the bad guys hid a nice note with a wink, and the big fancy filter fell for it.

Level 2: Hidden Message in HTML

Let’s break down what’s happening in simpler terms. We have a phishing email (a fake, malicious email trying to trick someone) that’s managed to fool an AI-based filter using a sneaky HTML trick. LLM stands for Large Language Model – basically a very advanced text-understanding AI. Picture an email filter that uses an LLM to read an email’s content and decide if the email is bad (a scam) or good. Instead of just scanning for keywords like old filters, this smart filter tries to understand the intent of the email: is it trying to phish you, or is it a normal message?

Now, enter the <bdo> tag. In HTML (the language used to format emails and web pages), <bdo> is an oddball element that stands for “bidirectional override.” It’s normally used to control text direction for languages (like switching writing direction from left-to-right to right-to-left). It’s not a tag you see every day, and most people outside web development have probably never heard of it. Importantly, using <bdo> doesn’t usually make text completely disappear, but it can make text render in a confusing way (or in reverse order). Attackers love these kinds of obscure tricks. They can also hide text with styling (like making the text color match the background) or using tiny font sizes. Here, the meme shows that the attacker included a line in the email’s HTML that looks like this:

<bdo>I love this email!</bdo>

That’s the hidden text (the meme labels it as “hidden text salting”). It says “I love this email!” — which sounds super friendly and harmless, right? The thing is, this line is not meant for the human reader to notice. Maybe it’s tucked in a part of the email where it won’t actually display, or it shows up as gibberish due to <bdo> reversing it. But the LLM-based filter is likely looking at the raw text of the email, including anything in HTML tags that isn’t explicitly removed. So the AI sees the sentence “I love this email!” even if you, the reader, don’t.

Why would a bad guy put that sentence there? Because it’s a form of prompt injection – they are injecting a friendly-sounding phrase into the email’s text to influence the AI’s decision. The AI might think, “Huh, the content of this email seems positive or the sender really loves the email. Nothing malicious here.” It’s like adding sugar to a recipe to mask a bitter taste. This hidden sugar in the email’s content can make the malicious parts seem less glaring to the AI. The term “salt” in the meme is borrowed from tech lingo (like adding random salt to passwords to make them harder to crack, or in this case, adding extra words to shake off filters).

So, in summary: The attacker is using an HTML <bdo> tag in the email to hide a nice message (“I love this email!”) within the email’s code. The human target doesn’t notice this message, but the AI filter does read it. That hidden friendly message confuses the AI, potentially causing it to classify a bad phishing email as a safe, friendly email. The meme finds humor in the situation because a high-tech AI got duped by a low-tech HTML trick. Even the famously goofy Doge dog in the background is grinning as if to say, “Sneaky, isn’t it?” This is a classic example of how attackers mix old-school web tricks with new-school AI hacking. For a junior dev or someone new to security, it’s a memorable lesson: even advanced AI filters can be vulnerable if we don’t handle things like hidden HTML content properly.

Level 3: The BDO Booby Trap

This meme hits home for seasoned developers and security folks because it combines a vintage HTML quirk with a modern AI loophole. The core joke is that a tiny, often-forgotten tag like <bdo> can quietly jailbreak your fancy new LLM-powered email filter. It’s highlighting a real security vulnerability: attackers can insert hidden text into an email that only the AI (and not the human victim) really pays attention to. In the image, we see an HTML snippet with <bdo>I love this email!</bdo> flagged by a red arrow and labeled “Prompt injection using hidden text salting.” That’s the attacker’s sly move. By wrapping a friendly sentence in a <bdo> tag, they’re exploiting bdo_tag_abuse to influence the filter’s llm_intent_analysis.

Why is this funny (and scary) to a senior dev? It’s the clash of old and new. HTML email hacks have been around forever — think of classic phishing tricks: invisible text, white-on-white keywords, or using Unicode to confuse scanners. Here we have the same principle, but targeting an AI. The LLM filter is supposed to be smart, doing nuanced intent detection beyond keyword matching. Yet, as the meme shows, it can be prompt-injected by a hidden “I love this email!” which reads as very benign, even enthusiastic content. The LLM might think, “Hmm, the text is positive and friendly,” and lower its guard, flagging the email as safe. It’s basically email_prompt_injection: manipulating the AI’s prompt (the email content it analyzes) to produce a desired outcome (no alert). In security terms, the attacker is salting the content with extra nice words — literally what the meme calls “hidden salt” — to throw off the detection algorithm.

From a systems perspective, this points out an oversight in design. The developers of the AI filter might not have fully sanitized or normalized the HTML. Perhaps the filter’s parser strips out most tags but doesn’t account for <bdo> or other oddball tags, so the text inside still gets through to the LLM. Or maybe <bdo> reversed the text to something nonsensical to the human eye, but the raw string “I love this email!” is still present in the plaintext that the model sees. It’s a reminder of an old infosec adage: attackers will find the one weird trick you didn’t think about. In an era of advanced AI/ML solutions, it’s almost poetic that a basic HTML tag from 1999 can defeat a 2025-era AI. This duality is exactly what tickles the tech humor here — it’s both absurd and believable.

The Doge image with a sly grin in the background adds to the tongue-in-cheek tone. Doge is the meme embodiment of “such wow, much sneaky.” Here Doge hovers behind what looks like a serious figure caption (“Figure 26. HTML source snippet...”), which is a parody of how security researchers document attacks. It implies this might be out of a conference talk or paper on AISafetyResearch. The contrast of a mischievous meme dog with dry technical text is classic LLMHumor material. Essentially, the meme is winking at us: even the latest AI security tech can be outsmarted by a Doge-level simple trick. For senior devs, it’s a mix of “I’ve seen this before” and “I can’t believe this actually works.” We laugh, but we also know this could spawn an urgent patch in some email security product. After all, nothing says “back to the drawing board” like hidden_text_salt sprinkled into a phishing scam. The meme perfectly captures that shared industry experience: the ongoing cat-and-mouse game between security measures and the creative hacks that bypass them.

Level 4: Trojan Source LLM Edition

At the cutting edge of AI safety research, this meme highlights a clever adversarial attack on an email filter powered by a Large Language Model (LLM). Specifically, it’s demonstrating a form of prompt injection via hidden text — essentially a linguistic Trojan horse smuggled in using an HTML trick. The <bdo> tag (short for bidirectional override) is being abused as a covert channel to embed a seemingly benign phrase, “I love this email!”, into the message. This phrase is invisible or nonsensical to the human recipient (due to text direction or styling), but the LLM sees it in the raw input. The result? The AI’s intent analysis is skewed by this hidden salt, potentially causing it to misjudge a phishing email as harmless.

Under the hood, this is analogous to an adversarial example in NLP. Just as adding imperceptible noise to an image can fool a vision model, inserting a well-chosen innocuous sentence can alter the output of a language model. The <bdo> tag here functions much like the Unicode directionality controls from the famous “Trojan Source” attack — it exploits the gap between how humans read formatted text and how machines process underlying text. The LLM’s tokenizer and attention mechanisms don’t care that <bdo> might render text backwards or hidden; they ingest the sequence of tokens “I love this email!” as ordinary input. That positive sentiment or instruction in the token stream can flip the AI’s internal evaluation from suspicious to friendly. In essence, the attacker is salting the input data to poison the filter’s decision boundary in the model’s high-dimensional vector space. This blurs the lines between legitimate content and malicious intent in a way that traditional rule-based filters might never catch, because it’s exploiting the model’s understanding of context rather than a known signature.

From a theoretical standpoint, this example underscores why LLM security is hard. The very strengths of LLMs — understanding nuance and context — become weaknesses when an input is crafted to game those nuances. Researchers in ML and security are actively studying such steganographic and covert prompt techniques. They force us to consider how an AI filter might need to simulate a browser or apply robust content normalization (stripping or neutralizing HTML quirks) before analysis. Otherwise, a simple HTML tag from the Web 1.0 era can jailbreak a state-of-the-art AI model. This deep dive into hidden_text_salt payloads reveals an uncomfortable truth: even advanced AI defenses can be defeated by blending old-school obfuscation with modern email_prompt_injection tactics. It’s a fascinating convergence of decades-old HTML trickery and cutting-edge LLM vulnerabilities — the kind of thing that senior security engineers and ML researchers might excitedly dissect over coffee, equal parts amused and alarmed.