Encoding attacks and the defense layers that miss them
attack family:
ArtPrompt (ASCII)
base64 / leet
UTF-8 homoglyph
UTES (tree/JSON)
image modality
keyword filter:
misses
misses
misses
misses
misses
perplexity filter:
partial
partial
misses
partial
misses
paraphrase defense:
misses
partial
misses
misses
misses
output classifier:
catches
catches
catches
catches
partial
multimodal moderator:
catches
catches
catches
partial
catches
input-side defenses (keyword, PPL, paraphrase, retokenization) fail because recognition is visual / structural.
output-side and multimodal moderators are the reliable layer; every deployment should include at least one.