v0.2.0 — Obfuscation / evasion resilience

Dual-scan obfuscation/evasion normalization. The firewall now catches attacks hidden by zero-width characters, Unicode homoglyphs, or base64 — without over-blocking normal prompts.

Highlights

• Dual-scan pre-pass — the same injection / secret / PII detectors run a second time on a de-obfuscated copy; the original text is still what gets forwarded and masked, and obfuscation alone is never a block reason — only a decoded attack is.
  • Tier 1 — strip zero-width & bidi controls (Trojan-Source, CVE-2021-42574)
  • Tier 2 — NFKC fold + curated Unicode-confusable (UTS #39) Cyrillic/Greek → ASCII
  • Tier 3 (opt-in) — decode base64-looking segments and scan the payload
• Proxy normalize config block; benchmark --no-normalize / --normalize-base64 flags; scripts/obfuscate-dataset.py.

Validation

• Offline rule-layer recall on obfuscated attacks: 0.0% → 14.5% (base64 0.0% → 30.6%) at 0.00% FPR on a multilingual benign control.
• External check with NVIDIA garak encoding.InjectBase64 — see docs/garak-validation.md (honestly framed, incl. the base64 output-side over-defense caveat).

Container image

```
docker pull ghcr.io/carbon-evolution/llm-firewall:0.2.0
```

Full changelog: CHANGELOG.md