Follow-up to #42 / PR #43. Confirmed via review on PR #43: the deterministic Unicode-obfuscation filter added there (_detect_unicode_obfuscation in guardrail/adr_agent/adr_baseline.py) covers the Tag Block range (U+E0000–U+E007F) and bidi control characters, but not the Variation Selectors Supplement block (U+E0100–U+E01EF) — a second, related range with no legitimate use in ordinary text that can be used for the same class of "ASCII/instruction smuggling" technique (encoding hidden characters that render invisibly but are still read by an LLM's tokenizer).
Deliberately scoped out of PR #43 rather than bundled in: closing this properly needs its own regex range, its own reason-string/decoding handling (the encoding scheme for this block differs from Tag Block's direct offset mapping), a dedicated benchmark fixture proving detection end-to-end (mirroring content_localization_service.py's pattern), and its own tests — bundling it into an already-large review round risked bloating the re-review rather than landing it cleanly.
Happy to pick this up as a focused follow-up once #43 lands.
Follow-up to #42 / PR #43. Confirmed via review on PR #43: the deterministic Unicode-obfuscation filter added there (
_detect_unicode_obfuscationinguardrail/adr_agent/adr_baseline.py) covers the Tag Block range (U+E0000–U+E007F) and bidi control characters, but not the Variation Selectors Supplement block (U+E0100–U+E01EF) — a second, related range with no legitimate use in ordinary text that can be used for the same class of "ASCII/instruction smuggling" technique (encoding hidden characters that render invisibly but are still read by an LLM's tokenizer).Deliberately scoped out of PR #43 rather than bundled in: closing this properly needs its own regex range, its own reason-string/decoding handling (the encoding scheme for this block differs from Tag Block's direct offset mapping), a dedicated benchmark fixture proving detection end-to-end (mirroring
content_localization_service.py's pattern), and its own tests — bundling it into an already-large review round risked bloating the re-review rather than landing it cleanly.Happy to pick this up as a focused follow-up once #43 lands.