Why it matters
Character-level attacks bypass filters. Understanding shapes robust filtering.
Advertisement
The architecture
Original: 'bomb'.
Attack: 'b0mb', 'bcomb', 'b-o-m-b'.
Filter misses; LLM reads.
Advertisement
How it works end to end
Character substitution, homoglyphs, spaces.
Semantic filters better than exact-match.
Normalization pre-filter.