Email security vendors spent the past two years replacing rule-based spam filters with large language models, promising a step-change in phishing detection. According to research published this week by Barracuda, the new generation of AI-powered filters is still being defeated by text salting — a dilution technique that predates the LLM era by two decades.
Text salting works by padding a malicious email with large volumes of benign or random content — invisible text set to zero-point font size, blocks of lorem ipsum hidden inside HTML comments, or strings of randomly inserted characters scattered between the actual phishing payload. The goal is to shift the ratio of suspicious to innocent content so that the message falls below the filter's detection threshold. A phishing email that is 90% malicious content becomes, after salting, perhaps 10% malicious — and the filter lets it through.
Barracuda's researchers identified more than one million phishing emails using text salting techniques in recent months. The attacks targeted organisations across multiple sectors, and the technique was effective against both traditional Bayesian spam filters and newer LLM-powered security gateways.
"Text salting appears simple, but its continued and growing use shows it remains effective," said Peterson Gutierrez, vice president of information security at Barracuda. He added that a technique widely associated with older spam-filter evasion is also influencing modern AI-based systems — though the full scope of that influence was not detailed in the advisory.
The technique is not new. Text salting was first documented in the early 2000s as a way to defeat Bayesian classifiers — statistical filters that scored emails based on word-frequency ratios. Spammers would insert paragraphs of innocuous text to dilute the concentration of suspicious terms. As filters improved, the technique faded from prominence. But the shift to LLM-based filtering, which evaluates semantic meaning rather than raw word counts, was assumed to have made salting obsolete.
Barracuda's research indicates that assumption was wrong. LLM-based filters, despite their ability to understand context and intent, are still vulnerable to content dilution at scale. When the ratio of malicious to benign content is sufficiently skewed, even a model trained to detect phishing semantics can be overwhelmed by the volume of padding.
A separate analysis published by Tech Jacks Solutions detailed one variant of the technique — HTML comment stuffing — in which attackers embed large volumes of invisible content inside HTML comment tags within phishing attachments. The comments are ignored by email clients when the message is rendered, but they are processed by the filtering engine, which reads the full HTML source. The result is a phishing email that appears clean to the recipient and statistically benign to the filter.
The findings raise questions about the security industry's reliance on AI as a substitute for layered defence. Text salting is not a sophisticated adversarial attack — it requires no machine-learning expertise, no model inversion, no carefully crafted adversarial examples. It is a brute-force dilution technique that any spam operator can implement with basic HTML knowledge. That it continues to work against filters built on billion-parameter models suggests that the underlying architecture of these systems has a structural blind spot, not a training gap.
Barracuda has not published a full technical paper alongside the findings, and the research was presented as a threat advisory rather than an academic study. Independent replication would strengthen the claims, though the scale of the detected attacks — one million emails — is itself evidence that the technique is in active, widespread use.
