Guide · Arabic AI security

Arabic LLM guardrails: protecting AI in Arabic, its dialects and Arabizi

An LLM guardrail checks what goes into and comes out of an AI model, so that the people and documents it reads cannot talk it out of its rules. Most guardrails were built and tested in English. This guide explains what an Arabic AI guardrail has to handle, how we compare guards on Arabic, and what to ask before you trust one.

Guardrino is in development and offered through watch-only pilots: it records what it would have done on your traffic and blocks nothing until you decide.

Request a pilot

What LLM guardrails are

A large language model follows instructions written in plain language. That is what makes it useful, and it is also the weakness: the model cannot reliably tell the instructions of the company that deployed it from instructions slipped in by a user, a web page or an email it was asked to summarise. OWASP lists this, prompt injection, as the top risk for LLM applications, and notes that it is unclear whether fool-proof prevention exists (OWASP LLM01).

LLM guardrails are the controls placed around the model to lower that risk. A guardrail LLM setup usually means a separate, smaller model and a set of rules that read each message before the main model does, and check each answer before the user sees it. OWASP’s prevention cheat sheet describes the same pattern: input checks on normalised text, a separate model used as a filter, output monitoring, least privilege and human approval for consequential actions (OWASP cheat sheet).

Input checks: is this message, or this document, trying to change the assistant’s rules, pull out its hidden instructions or make it call a tool it should not?
Data checks: does the message carry personal data or secrets that should be masked before it reaches an outside model or a log?
Output checks: does the answer leak the system prompt, personal data or a secret marker placed there to catch leaks?
Operations: a log of every decision and a way to watch before blocking.

A guardrail is one layer, not the whole defence. NIST’s generative AI profile describes direct and indirect prompt injection as part of the attack surface that generative AI adds, alongside data poisoning, and treats it as an information-security risk to manage (NIST AI 600-1). Tool permissions, approval steps and good system-prompt hygiene stay your job.

Why English-only guards miss Arabic

A classifier learns what an attack looks like from its training examples. If almost all of them are English, it learns English phrasing and English tricks. Arabic breaks those assumptions in several ways at once.

Dialects are not one language. A request in Gulf Arabic, Egyptian, Levantine or Moroccan Darija uses different words, spelling and grammar from Modern Standard Arabic. A model that has seen mostly formal Arabic, or one dialect, reads the others less well.
Arabizi changes the alphabet. Many people in the Gulf write Arabic in Latin letters, with digits for sounds that have no Latin letter: 3 for ع, 7 for ح, 5 for خ, 2 for the hamza. To an English model, Arabizi looks like noise or misspelt English.
People switch languages mid-sentence. A message can start in English, continue in dialect and end in Arabizi. Each part on its own can look harmless.
The script can be disguised. Stretched letters (tatweel), scattered diacritics, invisible characters and look-alike Persian or Urdu letters change the bytes a model sees without changing what a human reads.

This is not a theoretical gap. Researchers presenting at EMNLP 2024 found that prompts in Modern Standard Arabic did not get unsafe content out of GPT-4 or Claude 3 Sonnet in their tests, but the same prompts written in Arabic transliteration and Arabizi did, and concluded that safety training has to cover every written form of a language (Al Ghanim et al., EMNLP 2024). OWASP also lists the use of multiple languages and encodings to evade filters as an attack scenario (OWASP LLM01).

The same weakness shows up in the other direction: a guard that does not read Arabic well also blocks ordinary Arabic messages it does not understand. For a bank or a government service whose customers write in dialect, a guard that wrongly blocks real customers is a cost too.

How Arabic guards compare on the same test

We test Guardrino against other prompt-attack classifiers on Arabic: two well-known guards built for English, and models other teams built for Arabic. Every model is scored on the same test set. Comparing raw scores would be unfair, because a model can catch more attacks simply by blocking more messages, so each model’s threshold is set so that it blocks about the same small share of safe messages on a validation sample. Only then do we count the Arabic and Arabizi attacks each one catches.

阿拉伯语，正面对比

为阿拉伯语而生。在我们自己的测试中，Guardrino 拦下了近十分之九的阿拉伯语攻击，而最知名的英语防护模型只拦下约七分之一。

The measured table, with its method and its limits:

模型	拦下的阿拉伯语攻击（共 7,874）	拦下的 Arabizi 攻击（共 1,523）	被拦截的安全消息（共 31,348）
Guardrino-t7 v7	7,874 中的 6,814 (86.5%)	1,523 中的 1,319 (87%)	31,348 中的 804 (2.6%)
Guardrino-t7 v7，调到与 ArabGuard 相同的误拦率同一模型，阈值更严格，使其误拦的安全消息与 ArabGuard 一样少。	7,874 中的 6,520 (82.8%)	1,523 中的 1,214 (80%)	31,348 中的 519 (1.7%)
Ara-Prompt-Guard V1 (NAMAA, Arabic) 由另一个团队为阿拉伯语打造，以同样方式评分。	7,874 中的 2,033 (25.8%)	1,523 中的 99 (7%)	31,348 中的 615 (2.0%)
ArabGuard (Egyptian) 由另一个团队为阿拉伯语打造，以同样方式评分。	7,874 中的 1,553 (19.7%)	1,523 中的 2 (0%)	31,348 中的 519 (1.7%)
HARIS 由另一个团队为阿拉伯语打造，以同样方式评分。	7,874 中的 561 (7.1%)	1,523 中的 0 (0%)	31,348 中的 459 (1.5%)
Prompt Guard 2 (Meta)	7,874 中的 1,128 (14.3%)	1,523 中的 73 (5%)	31,348 中的 882 (2.8%)
Protect AI v2	7,874 中的 894 (11.4%)	1,523 中的 95 (6%)	31,348 中的 589 (1.9%)

方法：HisnLabs 自有测试集，包含 13,249 次攻击和 31,348 条安全消息，大多为阿拉伯语。这有利于用类似数据训练的模型（例如我们的模型），因此这不是独立测试。每个模型的阈值都设定为在验证样本上每 100 条安全消息拦截 1 条。测试日期：2026/10/26–2026/10/27。外部模型是为英语、单一方言或主要为现代标准阿拉伯语打造的；这并非对它们的批评。测试集中有一个公开来源（arabic-guardrail，2,271 次攻击）可能在其他模型的训练数据中，而它的训练部分在我们的训练数据中；去掉它后，Guardrino-t7 拦下 5,603 次阿拉伯语攻击中的 4,596 次（82%）。

Read the method note under the table. The test set is our own and mostly Arabic, which favours a model trained on similar data, like ours: it is not an independent test. The outside models were built for English, for one dialect or mainly for Modern Standard Arabic; the table shows what happens when they meet text they were not built for, not that they are bad models. Your own pilot measures the same things on your own messages. The full method and data behind the table are on their own page.

The Guardrino-t7 v7 report adds what this table leaves out: how long each model takes per message, all timed on the same machine, what the test set is made of, and the results by dialect.

Dialects and Arabizi: what an Arabic AI guardrail has to read

Here are ordinary, safe customer questions in each form of Arabic a Gulf assistant meets every day. A good Arabic guardrail must let all of them through. Below them, in words only, is what an attack in the same form tends to look like.

Gulf (Khaleeji): أبي أعرف شلون أغيّر رقم تلفوني في الحساب؟ I want to know how to change my phone number on the account.
Egyptian: عايز أعرف إزاي أطلب كشف حساب للشهر اللي فات؟ I want to know how to request a statement for last month.
Levantine: بدي أعرف كيف بقدر وقّف البطاقة إذا ضاعت؟ I want to know how I can stop the card if it gets lost.
Maghrebi (Moroccan Darija): بغيت نعرف كيفاش نبدّل الكود ديال البطاقة؟ I want to know how to change the card’s PIN.
Modern Standard Arabic: كيف يمكنني تحديث عنواني البريدي في حسابي؟ How can I update my postal address on my account?
Arabizi: marhaba, 3indi so2al 3an el fatoora, leish el mablagh 3ali 7al shahr? Hello, I have a question about the bill: why is the amount high this month?

In Gulf dialect, an attack often poses as staff (“from the fraud team”, “from IT”) and asks the assistant, politely and informally, to set its rules aside for a “check”.
In Egyptian or Levantine, it is often a role-play or a joke framing that turns into a request for the assistant’s hidden instructions.
In Darija, French words and Latin script often mix in, which confuses guards that expect one language per message.
In Modern Standard Arabic, attacks read like formal orders or official notices, the register many Arabic models were mostly trained on.
In Arabizi, the same request is written in Latin letters and digits, so an English guard sees what looks like misspelt English and lets it through.

We never publish working attack prompts. The examples above are safe questions, and the attacks are described, not written out. To try a guard yourself, use the live demo of our earlier open model.

How Guardrino approaches Arabic

Guardrino is a security gateway that sits between your apps or AI agents and whichever AI model you use. It checks each message in layers, the fast ones on every message and the deeper ones only when a message is unclear:

Clean-up: invisible characters, stretched letters and look-alike characters are removed or folded, base64 and hex are decoded, and Arabizi is turned into Arabic script, so the next layers read what a human would read.
Rules and signatures: Gulf personal data and secrets, such as Emirates ID, iqama numbers and IBANs, are masked, and the message is compared with known attacks, by wording and by meaning.
The Guardrino model: a classifier trained on attacks and safe messages in Arabic, Gulf, Levantine, Egyptian and Moroccan dialects, Arabizi and English reads the intent.
Conversation memory: it follows the whole chat, so an attack built slowly across many harmless-looking messages is seen.
Output check: the answer is checked for a secret marker (a canary) placed in your system prompt, and for personal data, before it reaches the user.

The layers are described in more detail, technique by technique, in our guide to Arabic prompt injection. For where Guardrino runs and how a regulated team rolls it out, see LLM guardrails for the GCC.

What to ask before you trust an Arabic guardrail

Which forms of Arabic was it trained and tested on? Ask for dialects and Arabizi by name, not “Arabic support”.
How many safe messages does it block? A number of attacks caught means little without the false blocks at the same setting.
Who made the test? A vendor’s own test favours the vendor, ours included. Ask whether an outside test exists, and run your own.
Can you watch before you block? A watch-only period on your real traffic shows what the guard would do, without risk to your customers.
Where does it run? On your servers, in a cloud region you choose, and what leaves your network.
What does it not do? Any honest vendor can list it.

If you want to inspect a model before talking to anyone, our earlier open classifier is published under Apache-2.0: read its model page, download it from Hugging Face, or browse the integration code on GitHub. It is superseded by the gateway’s newer models, and it shows how we work. Developers can read the integration guides; decision makers can start with Guardrino for your company.

What an Arabic guardrail cannot do

No guardrail catches every attack. Attackers adapt, and new tricks appear between model updates.
Any guard sometimes blocks a safe message. The threshold is a trade-off your team sets, app by app.
It does not fix answers your model makes up. Grounding and review do that.
It only checks what is routed through it. Documents or tool results an agent reads directly are out of its sight.
It does not replace tool permissions, approval steps or keeping secrets out of the system prompt.

Questions about Arabic LLM guardrails

What is an Arabic LLM guardrail?

A check placed in front of an AI model that reads Arabic, its dialects and Arabizi as well as English, and stops messages that try to change the model’s rules, pull out its instructions or steal data. It also checks the model’s answers on the way out.

Can’t we just translate Arabic to English and use an English guard?

Translation loses the signals that matter. Machine translation of dialect and Arabizi is often poor, hidden characters and stretched letters can survive or be dropped silently, and a polite request in dialect can come out of translation as something that looks harmless. Translation also adds a second model, with its own errors and its own cost, in front of the guard.

Why does Arabizi matter for security?

Because many models and filters read it worse than Arabic script. Researchers at EMNLP 2024 got unsafe content out of large models with Arabizi and transliteration where Modern Standard Arabic prompts failed. A guard that does not read Arabizi leaves that door open.

Does Guardrino read every Arabic dialect equally well?

No, and we say so. It is trained on Gulf, Levantine, Egyptian and Moroccan dialects, Modern Standard Arabic and Arabizi, but our native test sets for each dialect are still small, so we cannot yet give a separate measured result per dialect. A pilot on your traffic shows how it does on the way your customers write.

Is Guardrino available today?

It is in development and offered through watch-only pilots. There is no public release yet. The pilot runs on your own traffic, records what Guardrino would have done and blocks nothing.

Can I try it without a pilot?

Yes, in part. The live demo runs our earlier open model in your browser, and the model itself is on Hugging Face under Apache-2.0. The gateway, with its newer models and other layers, is what the pilot covers.

See how Guardrino reads your customers’ Arabic.

Start with a 60-day watch-only pilot: Guardrino watches your real traffic in Arabic, its dialects, Arabizi and English, and records what it would have done. It blocks nothing until you decide. Join the pilot.

Request a pilot · Guardrino