Arabic LLM guardrails: protecting AI in Arabic, its dialects and Arabizi

What LLM guardrails are

A large language model follows instructions written in plain language. That is what makes it useful, and it is also the weakness: the model cannot reliably tell the instructions of the company that deployed it from instructions slipped in by a user, a web page or an email it was asked to summarise. OWASP lists this, prompt injection, as the top risk for LLM applications, and notes that it is unclear whether fool-proof prevention exists (OWASP LLM01).

LLM guardrails are the controls placed around the model to lower that risk. A guardrail LLM setup usually means a separate, smaller model and a set of rules that read each message before the main model does, and check each answer before the user sees it. OWASP’s prevention cheat sheet describes the same pattern: input checks on normalised text, a separate model used as a filter, output monitoring, least privilege and human approval for consequential actions (OWASP cheat sheet).

• Input checks: is this message, or this document, trying to change the assistant’s rules, pull out its hidden instructions or make it call a tool it should not?
• Data checks: does the message carry personal data or secrets that should be masked before it reaches an outside model or a log?
• Output checks: does the answer leak the system prompt, personal data or a secret marker placed there to catch leaks?
• Operations: a log of every decision and a way to watch before blocking.

A guardrail is one layer, not the whole defence. NIST’s generative AI profile describes direct and indirect prompt injection as part of the attack surface that generative AI adds, alongside data poisoning, and treats it as an information-security risk to manage (NIST AI 600-1). Tool permissions, approval steps and good system-prompt hygiene stay your job.

Why English-only guards miss Arabic

A classifier learns what an attack looks like from its training examples. If almost all of them are English, it learns English phrasing and English tricks. Arabic breaks those assumptions in several ways at once.

• Dialects are not one language. A request in Gulf Arabic, Egyptian, Levantine or Moroccan Darija uses different words, spelling and grammar from Modern Standard Arabic. A model that has seen mostly formal Arabic, or one dialect, reads the others less well.
• Arabizi changes the alphabet. Many people in the Gulf write Arabic in Latin letters, with digits for sounds that have no Latin letter: 3 for ع, 7 for ح, 5 for خ, 2 for the hamza. To an English model, Arabizi looks like noise or misspelt English.
• People switch languages mid-sentence. A message can start in English, continue in dialect and end in Arabizi. Each part on its own can look harmless.
• The script can be disguised. Stretched letters (tatweel), scattered diacritics, invisible characters and look-alike Persian or Urdu letters change the bytes a model sees without changing what a human reads.

This is not a theoretical gap. Researchers presenting at EMNLP 2024 found that prompts in Modern Standard Arabic did not get unsafe content out of GPT-4 or Claude 3 Sonnet in their tests, but the same prompts written in Arabic transliteration and Arabizi did, and concluded that safety training has to cover every written form of a language (Al Ghanim et al., EMNLP 2024). OWASP also lists the use of multiple languages and encodings to evade filters as an attack scenario (OWASP LLM01).

The same weakness shows up in the other direction: a guard that does not read Arabic well also blocks ordinary Arabic messages it does not understand. For a bank or a government service whose customers write in dialect, a guard that wrongly blocks real customers is a cost too.

How Arabic guards compare on the same test

We test Guardrino against other prompt-attack classifiers on Arabic: two well-known guards built for English, and models other teams built for Arabic. Every model is scored on the same test set. Comparing raw scores would be unfair, because a model can catch more attacks simply by blocking more messages, so each model’s threshold is set so that it blocks about the same small share of safe messages on a validation sample. Only then do we count the Arabic and Arabizi attacks each one catches.

Read the method note under the table. The test set is our own and mostly Arabic, which favours a model trained on similar data, like ours: it is not an independent test. The outside models were built for English, for one dialect or mainly for Modern Standard Arabic; the table shows what happens when they meet text they were not built for, not that they are bad models. Your own pilot measures the same things on your own messages. The full method and data behind the table are on their own page.

The Guardrino-t7 v7 report adds what this table leaves out: how long each model takes per message, all timed on the same machine, what the test set is made of, and the results by dialect.

Dialects and Arabizi: what an Arabic AI guardrail has to read

Here are ordinary, safe customer questions in each form of Arabic a Gulf assistant meets every day. A good Arabic guardrail must let all of them through. Below them, in words only, is what an attack in the same form tends to look like.

• Gulf (Khaleeji): أبي أعرف شلون أغيّر رقم تلفوني في الحساب؟ I want to know how to change my phone number on the account.
• Egyptian: عايز أعرف إزاي أطلب كشف حساب للشهر اللي فات؟ I want to know how to request a statement for last month.
• Levantine: بدي أعرف كيف بقدر وقّف البطاقة إذا ضاعت؟ I want to know how I can stop the card if it gets lost.
• Maghrebi (Moroccan Darija): بغيت نعرف كيفاش نبدّل الكود ديال البطاقة؟ I want to know how to change the card’s PIN.
• Modern Standard Arabic: كيف يمكنني تحديث عنواني البريدي في حسابي؟ How can I update my postal address on my account?
• Arabizi: marhaba, 3indi so2al 3an el fatoora, leish el mablagh 3ali 7al shahr? Hello, I have a question about the bill: why is the amount high this month?

• In Gulf dialect, an attack often poses as staff (“from the fraud team”, “from IT”) and asks the assistant, politely and informally, to set its rules aside for a “check”.
• In Egyptian or Levantine, it is often a role-play or a joke framing that turns into a request for the assistant’s hidden instructions.
• In Darija, French words and Latin script often mix in, which confuses guards that expect one language per message.
• In Modern Standard Arabic, attacks read like formal orders or official notices, the register many Arabic models were mostly trained on.
• In Arabizi, the same request is written in Latin letters and digits, so an English guard sees what looks like misspelt English and lets it through.

We never publish working attack prompts. The examples above are safe questions, and the attacks are described, not written out. To try a guard yourself, use the live demo of our earlier open model.

How Guardrino approaches Arabic

Guardrino is a security gateway that sits between your apps or AI agents and whichever AI model you use. It checks each message in layers, the fast ones on every message and the deeper ones only when a message is unclear:

1. Clean-up: invisible characters, stretched letters and look-alike characters are removed or folded, base64 and hex are decoded, and Arabizi is turned into Arabic script, so the next layers read what a human would read.
2. Rules and signatures: Gulf personal data and secrets, such as Emirates ID, iqama numbers and IBANs, are masked, and the message is compared with known attacks, by wording and by meaning.
3. The Guardrino model: a classifier trained on attacks and safe messages in Arabic, Gulf, Levantine, Egyptian and Moroccan dialects, Arabizi and English reads the intent.
4. Conversation memory: it follows the whole chat, so an attack built slowly across many harmless-looking messages is seen.
5. Output check: the answer is checked for a secret marker (a canary) placed in your system prompt, and for personal data, before it reaches the user.

The layers are described in more detail, technique by technique, in our guide to Arabic prompt injection. For where Guardrino runs and how a regulated team rolls it out, see LLM guardrails for the GCC.

What to ask before you trust an Arabic guardrail

• Which forms of Arabic was it trained and tested on? Ask for dialects and Arabizi by name, not “Arabic support”.
• How many safe messages does it block? A number of attacks caught means little without the false blocks at the same setting.
• Who made the test? A vendor’s own test favours the vendor, ours included. Ask whether an outside test exists, and run your own.
• Can you watch before you block? A watch-only period on your real traffic shows what the guard would do, without risk to your customers.
• Where does it run? On your servers, in a cloud region you choose, and what leaves your network.
• What does it not do? Any honest vendor can list it.

If you want to inspect a model before talking to anyone, our earlier open classifier is published under Apache-2.0: read its model page, download it from Hugging Face, or browse the integration code on GitHub. It is superseded by the gateway’s newer models, and it shows how we work. Developers can read the integration guides; decision makers can start with Guardrino for your company.

What an Arabic guardrail cannot do

• No guardrail catches every attack. Attackers adapt, and new tricks appear between model updates.
• Any guard sometimes blocks a safe message. The threshold is a trade-off your team sets, app by app.
• It does not fix answers your model makes up. Grounding and review do that.
• It only checks what is routed through it. Documents or tool results an agent reads directly are out of its sight.
• It does not replace tool permissions, approval steps or keeping secrets out of the system prompt.

Questions about Arabic LLM guardrails

What is an Arabic LLM guardrail?

A check placed in front of an AI model that reads Arabic, its dialects and Arabizi as well as English, and stops messages that try to change the model’s rules, pull out its instructions or steal data. It also checks the model’s answers on the way out.

Can’t we just translate Arabic to English and use an English guard?

Translation loses the signals that matter. Machine translation of dialect and Arabizi is often poor, hidden characters and stretched letters can survive or be dropped silently, and a polite request in dialect can come out of translation as something that looks harmless. Translation also adds a second model, with its own errors and its own cost, in front of the guard.

Why does Arabizi matter for security?

Because many models and filters read it worse than Arabic script. Researchers at EMNLP 2024 got unsafe content out of large models with Arabizi and transliteration where Modern Standard Arabic prompts failed. A guard that does not read Arabizi leaves that door open.

Does Guardrino read every Arabic dialect equally well?

No, and we say so. It is trained on Gulf, Levantine, Egyptian and Moroccan dialects, Modern Standard Arabic and Arabizi, but our native test sets for each dialect are still small, so we cannot yet give a separate measured result per dialect. A pilot on your traffic shows how it does on the way your customers write.

Is Guardrino available today?

It is in development and offered through watch-only pilots. There is no public release yet. The pilot runs on your own traffic, records what Guardrino would have done and blocks nothing.

Can I try it without a pilot?

Yes, in part. The live demo runs our earlier open model in your browser, and the model itself is on Hugging Face under Apache-2.0. The gateway, with its newer models and other layers, is what the pilot covers.

See how Guardrino reads your customers’ Arabic.

Start with a 60-day watch-only pilot: Guardrino watches your real traffic in Arabic, its dialects, Arabizi and English, and records what it would have done. It blocks nothing until you decide. Join the pilot.

Request a pilot · Guardrino

Read next

• LLM guardrails for the GCC
• Arabic prompt injection
• Guardrino

Sources

1. OWASP Top 10 for LLM Applications 2025: LLM01 Prompt Injection
2. OWASP Cheat Sheet Series: LLM Prompt Injection Prevention
3. Al Ghanim et al., Jailbreaking LLMs with Arabic Transliteration and Arabizi, EMNLP 2024 (ACL Anthology)
4. NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
5. Guardrino-t7 Open, the earlier open model, on Hugging Face
6. HisnLabs/Guardrino on GitHub: LiteLLM plugin and integration examples