Guardrino™-t7 is coming. It is the guardrail model at the heart of Guardrino, the AI firewall we are building at HisnLabs, a company licensed in the IFZA free zone at Dubai Silicon Oasis. Its job is simple to state: read every message sent to a company’s AI assistant or AI agent, in Arabic, Arabizi or English, and say whether someone is trying to manipulate the AI. It runs on the company’s own servers in the UAE, and the check never needs to send a message anywhere else.
It is not released yet. We are now taking pilot partners: UAE businesses that run, or plan to run, an AI chatbot or agent for customers or staff and want to try it on their own traffic, in watch-only mode, before anything is blocked. This article explains what Guardrino-t7 does today, how it keeps your data in the country, what it is trained against, and where it stops.
Guardrino-t7: UAE AI guardrails built in Dubai for chatbots and agents
Banks, telecoms, clinics, real estate developers and government services across the Emirates now answer customers through AI assistants, and more of them are giving AI agents real tasks: reading emails, filling forms, talking to other companies’ agents. Every one of those assistants can be talked to by anyone. OWASP puts prompt injection at the top of its Top 10 for LLM applications, as LLM01, and describes it as input that “alters the behavior of the model in unintended or unexpected ways” [1].
A guardrail is the check that sits in front of the model and reads what comes in. Guardrino-t7 is a classifier: it gives one decision per message, a risk score, and writes no text of its own. It is small, about 118 MB once compressed, and it answers in milliseconds on an ordinary server CPU, so it does not need a GPU or a cloud service. That size is a deliberate choice: a model this small can sit on every message without slowing the assistant down, and it can live on a server the company already owns.
Sovereign AI security: it runs on your own servers in the UAE
For many UAE organisations, the question about any AI security tool is not only “does it work?” but “where do our customers’ messages go?”. The UAE’s Federal Decree-Law No. 45 of 2021 on personal data protection came into force on 2 January 2022 and “sets out the requirements for the cross-border transfer and sharing of personal data for processing purposes”; the DIFC has its own Data Protection Law, DIFC Law No. 5 of 2020 [2]. A guardrail that sends every message abroad to be checked adds one more transfer to explain.
Guardrino-t7 is built the other way round. The model and its rules are files you install on your own machines, in your data centre or your UAE cloud tenancy, so the message is checked where it already is and does not leave the company’s servers for the check. Nothing in the check needs an internet connection, which means it can run on an air-gapped network. You keep the hardware, the keys and the logs.
- On-premise or in your own UAE cloud account: the check runs next to your assistant.
- No call to an outside service to decide on a message.
- Small enough for an ordinary server CPU: milliseconds per message, no GPU.
- Usable in front of whichever model you already chose, hosted abroad, in a UAE region or on your own hardware.
Arabic, Arabizi and dialects: what UAE AI chatbot security has to read
A customer in Dubai does not write like a test set. She may start in Gulf dialect, switch to English for a product name and finish in Arabizi, Arabic typed in Latin letters and numerals, where 3 stands for ع and 7 for ح [3]. Staff and customers in the Emirates come from across the Arab world, so the same assistant hears Egyptian, Levantine and Iraqi Arabic in one afternoon. A guardrail that only reads English either misses an attack written in dialect or blocks an ordinary question because it looks unfamiliar.
Guardrino-t7 is built in the UAE for Arabic, Arabizi and English together. It is trained on Modern Standard Arabic and on Gulf and Emirati, Egyptian, Levantine, Maghrebi, Iraqi and Sudanese dialects, written plainly, with full diacritics, with the scattered diacritics attackers add to dodge filters, and in Arabizi, alongside English and mixed Arabic and English. French messages are in our tests too; the training today is focused on Arabic and English.
Arabic prompt injection protection: the attack families it is trained on
We do not say Guardrino-t7 stops every attack, and no honest vendor can: OWASP itself writes that “it is unclear if there are fool-proof methods of prevention for prompt injection” [1]. What we can say precisely is what it is trained on. Guardrino-t7 is trained on the main families of known attacks on chatbot assistants, in Arabic, Arabizi and English:
- Instruction override: “ignore your instructions”, “forget the rules above”, and their dialect and Arabizi forms.
- System-prompt extraction: attempts to make the assistant reveal its hidden instructions, settings or secrets.
- Role-play and persona jailbreaks: “you are now a different AI with no rules”, stories and hypotheticals used as a cover.
- Fake staff or official authority: messages that claim to come from the bank’s IT team, a manager or a regulator to unlock something.
- Instructions hidden in pasted emails and documents, the indirect injection researchers showed against real applications in 2023 [4].
- Encoded or disguised text: instructions hidden in encodings, look-alike letters or deliberate misspellings, which OWASP lists among the attack scenarios [1].
- Arabizi and dialect attacks: the same tricks written in Gulf, Egyptian or Levantine Arabic, or typed in Latin letters, to slip past English-only filters.
Arabic jailbreak detection that leaves angry customers alone
Catching attacks is half of the job. The other half is not blocking the people the assistant is there to serve. A customer who writes in capital letters that he has called three times about his bill is angry, not dangerous. A question about the weather in a bank’s chat is off-topic, not an attack. A student who pastes a fully vowelled verse is not hiding anything.
So Guardrino-t7 is trained just as hard on safe look-alikes: rude and frustrated customers, off-topic questions, everyday security vocabulary such as “password” or “reset”, emails and tool results that contain no instruction, and religious, medical and legal questions in Arabic. We wrote more about this balance in guardrails that don’t annoy your users.
Policy as code: rules your CISO controls, and an audit log without message text
Guardrino-t7 gives a score; it does not decide what happens to the message. That decision belongs to a policy file, plain text that your security team writes, reviews and keeps under version control like any other configuration. For each kind of finding, the policy chooses one action on a short ladder: allow, mask, warn, ask the user to rephrase, or block. The same file chooses the threshold for the model’s score, and whether each layer enforces or only watches. A setting the file does not recognise is refused rather than ignored, so a typing mistake cannot silently switch a rule off.
Every decision is written to an audit log, one line per check, with the action, the score and the time. By default the log keeps no message text. It keeps a keyed fingerprint of the message instead: repeats can be counted inside your deployment, but without the key, which stays on your server, nobody can test a guess such as an Emirates ID against the log. Storing the text, masked or as sent, is an explicit setting you turn on only where your own rules allow it.
Watch-only first: how the pilot programme works
Nobody should put a new guardrail in front of real customers on day one. Guardrino has a watch-only mode for exactly this: every message passes unchanged, and Guardrino records what it would have done. In this mode the model’s check runs off the request path, so a slow or failed check never delays a customer. One switch moves a deployment from watching to enforcing, when you are ready and not before.
- A short call about your assistant or agent, the languages your customers use and your data rules.
- Guardrino installed on your servers or in your UAE cloud account, in watch-only mode, in front of your existing model.
- A daily report of what it would have allowed, masked, warned about, asked to rephrase or blocked, which we review with you.
- Your security team tunes the policy file; you decide if and when anything is enforced.
If you run an AI assistant or agent in the UAE, request a pilot or proof of concept with HisnLabs. The background to the project is in why we are building Guardrino for the Middle East.
Where it stops
We would rather you hear the limits from us than discover them in production.
- No guardrail catches everything. Guardrino-t7 lowers the risk; it does not remove it.
- Long disguised documents are the hardest case today: a convincing fake memo or policy with one instruction buried in the middle. This is what we are improving now, and why we wrote up how injected documents fool AI assistants.
- Guardrino-t7 judges whether a message tries to manipulate the AI. Harmful content without a trick, and attacks spread slowly over a long conversation, need other layers.
- It is one layer. Content safety on the model’s answers, sensible permissions for your agents and human review of important actions remain necessary.
- It starts in watch-only mode, and results will only be published once they have been measured with a public method.
Frequently asked questions about UAE AI guardrails
What is Guardrino-t7?
Guardrino-t7 is the guardrail model HisnLabs is building in Dubai for AI chatbots and agents. It reads messages in Arabic, its dialects, Arabizi and English and scores whether they try to manipulate the AI, such as prompt injection or a jailbreak. It is coming soon and available today through the pilot programme.
Does it protect against Arabic prompt injection and Arabizi?
Yes, that is what it is built for. Guardrino-t7 is trained on instruction override, system-prompt extraction, role-play jailbreaks, fake authority, hidden instructions in documents and disguised text, written in Modern Standard Arabic, Gulf, Egyptian, Levantine, Maghrebi, Iraqi and Sudanese dialects, Arabizi and English. Like any guardrail, it reduces the risk rather than removing it.
Can it run on-premise in Dubai, or air-gapped?
Yes. Guardrino-t7 runs on your own servers in the UAE, on an ordinary CPU, and the check does not call any outside service, so it can run on a network with no internet access. Messages do not leave your company’s servers for the check.
What does sovereign AI security mean here?
It means you keep control of the whole check: the model runs on your hardware, the rules are a file your CISO owns, and the audit log stays with you and keeps no message text by default. HisnLabs does not need to see your traffic for Guardrino to work.
Will it block my customers by mistake?
That risk is why every pilot starts in watch-only mode, where nothing is blocked and you see what Guardrino would have done. The model is also trained on angry customers, off-topic questions and other safe messages that look like attacks, and your policy decides whether a finding means warn, ask to rephrase or block.
Is Guardrino-t7 available now?
Not as a public release. HisnLabs is now taking pilot partners in the UAE; request early access on the Guardrino page.
How Guardrino and HisnLabs fit in
Guardrino-t7 is coming, and the pilot programme is how a UAE company can start using it early: on its own servers, in watch-only mode, with its own rules. The simulation below shows the kind of messages it is built for.