license: apache-2.0
language: [tr, en]
task_categories: [text-classification]
tags: [prompt-injection, unicode-security, turkish, case-folding, confusables, llm-security, ai-security, red-teaming]
pretty_name: "Turkish Case-Fold Evasion of Naive Injection Filters"
size_categories: [n<1K]
configs: [{config_name: default, data_files: evasion_dataset.jsonl}]
turkish-casefold-evasion
from datasets import load_dataset
ds = load_dataset("fevziegeyurtsevenler/turkish-casefold-evasion")
"İGNORE".lower() is not "ignore". Python's str.lower() maps the Turkish dotted capital
İ (U+0130) to i + a combining dot (U+0307), so prompt-injection filters that dotext.lower() + substring matching silently miss Turkish-cased and Unicode-confusable triggers.
This dataset pairs common injection trigger phrases with Turkish case-fold / confusable evasions and
records whether each bypassed a naive lower()+substring filter and whether the one-line
NFKC-normalize fix caught it.
Finding
| Evasion | Bypass rate vs naive filter | Caught after fix |
|---|---|---|
| dotless-i | 91% | 100% |
| confusable (Cyrillic/Greek) | 100% | 100% |
| combining-mark | 91% | 100% |
| overall | 94.6% | 100% |
Targets naive keyword/regex filters; ML guards are more robust (see the companion study).
Fields
trigger, evasion, evaded_text, original_caught_by_naive, evaded_caught_by_naive,evaded_caught_by_hardened, bypassed_naive_filter.
Code + the one-line fix
👉 github.com/fevziegeyurtsevenler/turkish-casefold-evasion
Related
🏁 guardrail-arena · 🕵️ uncloak · 🌐 AltaySec
Apache-2.0 · by AltaySec.