06 — moorai terms

Normalization pre-pass

A bounded decode-and-fold stage that runs before the detectors: strip zero-width and bidirectional control characters, fold homoglyphs and leetspeak, remove separator padding, and speculatively decode base64, hex, ROT13, Caesar shifts and character or word reversal — then re-run the detectors over each recovered variant. It is bounded and ReDoS-capped on purpose, because unbounded speculative decoding is itself a denial-of-service surface.

Related terms

  • Obfuscation / encoding Attack concepts

    Rewriting a payload so it survives the defence but is still recoverable by the model — base64, hex, ROT13 and Caesar shifts, character or word reversal…

  • CipherChat Attack families

    The harmful request is encoded in a cipher — Caesar shift, ROT13, base64, hex, a custom substitution — and the model is asked to work in that cipher.

  • FlipAttack Attack families

    A reversal attack: the payload is written backwards — by character, by word, or by line — and the model is instructed to un-reverse it before following…

  • Homoglyph Attack concepts

    A character that looks identical or near-identical to another but has a different Unicode code point — Cyrillic а for Latin a, Greek ο for o, a full-width…

MoorAI terms

Product-specific vocabulary used across this site. The agent is open source (AGPL-3.0), so each of these is verifiable in the code rather than taken on trust.

Normalization pre-pass is term 5 of 5 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0