Normalise prompts before guardrail evaluation (Unicode, homoglyphs, encoded payloads)

Description

The guardrail chain evaluates prompt text as received; nothing normalises it first. There is no Unicode NFKC folding, no homoglyph/confusable mapping, no zero-width character stripping, no bidi/RTL override stripping, and no detection or decoding of encoded payloads (base64, hex, rot13) before scanning.

Requested: an optional normalisation stage ahead of the engines that performs the above, with a configurable response to encoded payloads (decode and rescan, flag, or block), and a record of what was normalised on the audit entry.

Why

Obfuscation that a model reads straight through but a classifier does not — homoglyphs, zero-width joiners, encoded instructions — is a documented prompt-injection bypass class and a standing line item on enterprise AI security checklists.

Because every engine sits behind one chain, normalising once raises the accuracy of all of them at the same time, including the third-party engines we do not control.

Priority

Medium.

Prior art

No surveyed product runs a normalisation stage before guardrail evaluation.

_{Surveyed 2026-07-15; every claim rests on a fetched docs/source page.}