prompt injection obfuscation detection

attackers obfuscate prompt injection payloads to bypass pattern-based filters. current prompt injection rules match only literal English phrases. known techniques include:

• zero-width Unicode characters inserted between letters
• leetspeak substitutions
• reverse-string / backwards-text
• homoglyph attack
• base64 / hex encoding of the payload

pattern-based security tools are always in an arms race. this is just the reality of creating a tool like this.

proposal

1. unicode normalization at scan time: before YARA matching, pre-process content to strip zero-width characters and apply NKFC Unicode normalization (this requires an engine change, NOT a rule change)
2. leetspeak-tolerant patterns
3. base64 detection outside comments: extend to a payload rule that fires on any sufficiently long base64 string in content, not just comments
4. document reverse-text detection as a known gap: needs a consumer-side solution