Normalise prompts before guardrail evaluation (Unicode, homoglyphs, encoded payloads)

[janiussyafiq]

Description

The guardrail chain evaluates prompt text as received; nothing normalises it first. There is no Unicode NFKC folding, no homoglyph/confusable mapping, no zero-width character stripping, no bidi/RTL override stripping, and no detection or decoding of encoded payloads (base64, hex, rot13) before scanning.

Requested: an optional normalisation stage ahead of the engines that performs the above, with a configurable response to encoded payloads (decode and rescan, flag, or block), and a record of what was normalised on the audit entry.

Why

Obfuscation that a model reads straight through but a classifier does not — homoglyphs, zero-width joiners, encoded instructions — is a documented prompt-injection bypass class and a standing line item on enterprise AI security checklists.

Because every engine sits behind one chain, normalising once raises the accuracy of all of them at the same time, including the third-party engines we do not control.

Priority

Medium.

---

Prior art

Product	Has it	Reference
LiteLLM	Partial	normalize() scoped to one checker, not a pre-guardrail stage
AWS Bedrock Guardrails	No	absent by stated design
Kong AI Gateway	No	invisible-character patterns only
Portkey	No	basic deterministic checks
Cloudflare AI Gateway	No	none found
Bifrost	No	none found
Envoy AI Gateway	No	none found
Presidio	No	none found
NVIDIA NeMo Guardrails	No	none found
Azure AI Content Safety Prompt Shields	Unknown	lists "Encoding Attacks" as a class; preprocessing undocumented
Lakera Guard	Unknown	closed classifier; preprocessing undocumented

No surveyed product runs a normalisation stage before guardrail evaluation.

_{Surveyed 2026-07-15; every claim rests on a fetched docs/source page.}