Guide · Attack techniques

Arabic prompt injection: how attackers use dialects, Arabizi and hidden text

Prompt injection is any attempt to make an AI model follow instructions it should not, written by a user or hidden in content the model reads. In Arabic, attackers have more ways to disguise those instructions than in English. This guide describes the techniques at a high level, how Guardrino’s layers respond to each, and where any guard, ours included, falls short.

Guardrino is in development and offered through watch-only pilots: it records what it would have done on your traffic and blocks nothing until you decide.

Request a pilot

What prompt injection is

OWASP separates two kinds. Direct prompt injection is a user typing input that changes the model’s behaviour. Indirect prompt injection comes from outside content the model reads, such as a web page, a file or a document in a retrieval index, and changes its behaviour without the user knowing (OWASP LLM01). NIST describes the indirect kind as attackers injecting prompts “into data likely to be retrieved”, without a direct interface to the system (NIST AI 600-1), a term introduced by researchers who showed it working against real LLM-integrated applications (Greshake et al.).

The goals are usually the same: get the assistant to ignore its rules, reveal its hidden instructions, leak data, or call a tool on the attacker’s behalf. What changes in Arabic is the disguise.

Arabic prompt injection techniques

Each technique below changes how a message looks to a machine without changing what a human, or a capable AI model, understands. That gap is what an attacker exploits: the guard sees noise, the model sees an order. We describe them so defenders can recognise them; we do not publish working prompts.

Stretched letters (tatweel or kashida)

Arabic has a stretching character, the tatweel (ـ), used for layout and calligraphy. Inserted inside a word, it leaves the word perfectly readable to a person and to most large models, but breaks the exact match a keyword filter or a simple classifier relies on.

Diacritics noise (tashkeel)

Short-vowel marks are optional in everyday Arabic. Scattering them, correctly or not, over an instruction changes its characters again while the meaning stays clear.

Arabizi digits and transliteration

Arabic written in Latin letters, with 3 for ع, 7 for ح, 5 for خ and 2 for the hamza, is how many people in the Gulf type every day. It also slips past models and filters trained on Arabic script or on English. In research presented at EMNLP 2024, prompts that failed in Modern Standard Arabic produced unsafe content from GPT-4 and Claude 3 Sonnet once written in Arabizi or transliteration (Al Ghanim et al.).

Code-switching between Arabic and English

The attacker starts in English, continues in Gulf dialect and ends in Arabizi, or puts the harmful part in one language and the cover story in another. A guard that reads one language well sees only part of the request. OWASP lists using multiple languages to evade filters as an attack scenario (OWASP LLM01).

Look-alike letters from Persian and Urdu

Several Persian and Urdu letters look identical, or nearly, to Arabic ones, such as the Persian kaf and yeh, but are different characters. The same applies to Arabic-Indic and Persian digits. Unicode’s security standard documents these confusables and mixed-script text as a known spoofing problem (Unicode UTS #39).

Invisible characters

Zero-width characters, direction marks and similar code points take no space on screen. They can split a word so no filter matches it, or carry a hidden message. OWASP’s cheat sheet lists Unicode smuggling with invisible characters next to base64 and hex encoding (OWASP cheat sheet).

Hidden instructions in documents, RAG and email (indirect injection)

An invoice, a CV, a supplier email, a web page or a chunk in a retrieval index carries text addressed to the assistant: in white text, in a footnote, in a comment, or in Arabic inside an otherwise English document. Nobody types an attack. The assistant reads the document as part of its job and reads the order with it.

Agents that search the web meet the same problem at a larger scale. Hisn Agent Search, the HisnLabs web search for AI agents now in development, will check every page with Guardrino before the agent reads it.

Slow build-up across a conversation

Each message is harmless; together they lead the assistant somewhere it would refuse if asked directly. In Arabic this often comes with politeness and social pressure that make each step feel reasonable.

What it looks like, safely

These examples show the disguises on harmless text, so you can see the effect without an attack. Each one reads the same to a person.

Plain: مرحبا، كيف حالك؟ Hello, how are you?
Stretched with tatweel: مـــرحـــبا، كـــيف حـــالك؟ The same greeting, with stretching characters inside the words.
With scattered diacritics: مَرْحَبًا، كَيْفَ حَالُكَ؟ The same greeting, with short-vowel marks added.
Arabizi: mar7aba, kaif 7alak? The same greeting in Latin letters, with 7 for ح.
Code-switched: Hi, شلونك؟ hope all good English with a Gulf Arabic “how are you” in the middle.

An attacker applies the same disguises to an instruction instead of a greeting. To see how a classifier scores real messages, try the live demo of our earlier open model in your browser.

How Guardrino detects Arabic prompt injection

No single check handles every disguise, so Guardrino works in layers. Each one is aimed at a different part of the problem, and a message has to get past all of them.

Guardrino’s layers, from the offer document. Optional layers for content safety and for text inside documents and images also exist.
Layer	What it does	Techniques it is aimed at
L0 clean-up	Removes invisible and direction characters and tatweel, folds diacritics and look-alike letters and digits, decodes base64 and hex, and turns Arabizi into Arabic script. The hidden text is kept and checked too.	Tatweel, diacritics noise, look-alike letters, invisible characters, encodings, Arabizi
L1 rules and signatures	Masks Gulf personal data and secrets, checks links against an allow list and reputation feeds, and compares the message with known attacks by wording and by meaning. A newly confirmed attack can be added the same day.	Known attacks and their near copies in any language, data leaks
L2 Guardrino model	A classifier trained on attacks and safe messages in Arabic, its dialects, Arabizi and English reads the intent behind the wording. Unclear messages can go to a deeper review.	Dialects, code-switching, new wording of old tricks
Conversation memory	Follows the whole chat and raises the risk when an attack is being built across messages.	Slow build-ups, split instructions
Output check	Checks the answer for a canary, a secret marker placed in your system prompt, and for personal data before the user sees it.	System-prompt leaks, data leaks that got past the input checks

For indirect injection, the documents, emails and tool results your assistant reads have to be routed through Guardrino too, through the inspect API, the proxy or the MCP security proxy. The gateway also gives automated attack tools as little as possible to learn from: minimal answers, uniform timing, rate limits and a cooldown for senders that keep probing.

The canary is worth a word. OWASP’s system-prompt leakage entry warns that the system prompt is not a secret and must not be used as a security control (OWASP LLM07). A canary does not make it secret; it tells you, and blocks the answer, when someone gets the model to repeat it.

The Guardrino-t7 v7 report measures the L2 model on its own against other prompt-attack classifiers, on the same messages and the same machine, with its method and its limits.

Limits: what no guard, including Guardrino, can promise

Our measured results on Arabic, dialects and Arabizi come from our own test set: see the full method and data and its limits.
No guard catches everything. OWASP notes it is unclear whether fool-proof prevention of prompt injection exists. Guardrino lowers the risk; it does not remove it.
False blocks happen. Any threshold that catches more attacks also blocks more safe messages. Your team chooses the trade-off per app, after a watch-only period.
New techniques appear. Attackers invent new encodings and phrasings, including codes they define inside the chat itself. Signatures and model updates close gaps after they are seen, not before.
Some disguises are still harder. In our own tests, Arabic covered in random diacritics is caught less often than the same text without them, and messages buried in very long text are harder too. We are working on both and say so here.
Dialect coverage is uneven. Our native test sets for individual dialects are still too small to give a separate measured result for each.
It does not fix hallucinations. Answers your model makes up are not attacks, and a guardrail does not correct them.
It only sees what is routed through it. Content an agent reads directly, outside the gateway, is out of its sight.
Agent tool controls are planned. Today the MCP security proxy checks what passes between agents and tools; finer per-tool permissions and argument checks are planned. Keep your own approvals for consequential actions, as OWASP recommends.

What to do now

Keep secrets, credentials and internal rules out of system prompts and retrieval indexes.
Give assistants and agents the fewest permissions that work, and require human approval for payments, account changes and other consequential actions.
Treat every document, email and web page an assistant reads as untrusted input, and check it like user input.
Test your assistant in the dialects, Arabizi and mixed language your users really write, not only in English and formal Arabic.
Put a guard in watch-only mode on real traffic, look at what it sees, then decide where to block.

For the wider picture of Arabic guardrails and how we compare them, read Arabic LLM guardrails. For deployment, data residency and regulators, read LLM guardrails for the GCC. Developers can start from the integration guides and the open model; everyone else from Guardrino for your company or the Guardrino home page.

Questions about Arabic prompt injection

What is Arabic prompt injection?

Prompt injection written in Arabic, its dialects or Arabizi, or disguised with Arabic-specific tricks such as stretched letters, diacritics noise and look-alike letters, to make an AI model follow instructions it should not.

Is Arabic prompt injection more dangerous than English?

Not by nature. The risk is that many guards were trained mostly on English, so the same attack written in dialect or Arabizi is more likely to get past them. Research at EMNLP 2024 showed Arabizi getting unsafe content out of large models where Modern Standard Arabic did not.

What is indirect prompt injection?

Instructions hidden in content the AI reads, such as a document, an email, a web page or a retrieval index, instead of typed by the user. The assistant reads the content as part of its job and the order with it.

Will you publish example attack prompts?

No. We describe techniques so defenders can recognise them, and we show disguises on harmless text only.

Can a guardrail stop every prompt injection?

No. Guardrino lowers the risk with several layers and can be updated the same day a new attack is confirmed, but no guard catches everything, and every guard sometimes blocks a safe message.

Does removing diacritics and tatweel solve the problem?

It removes one disguise. Guardrino’s clean-up layer does it before the other checks run, but an attack in clean dialect or Arabizi still needs a model that understands the intent, and an attack built over many messages needs conversation memory.

Find out what reaches your assistant today.

In a 60-day watch-only pilot, Guardrino reads your real traffic, in Arabic, its dialects, Arabizi and English, and reports the attacks it would have stopped and the safe messages it would have blocked. Nothing changes for your users. Join the pilot.

Request a pilot · Guardrino