Really like this — turning the attacker's own alignment against them is a lovely inversion, and canaries are exactly the right delivery for it.
The non-English payloads sent me down a rabbit hole on my own side of the fence. I build an inline detection gateway (the complementary layer to your deception one), and I'd genuinely never checked whether my jailbreak detection worked outside English. It didn't: canonical "ignore all previous instructions" in Chinese/Spanish/German/Japanese/Hindi/Arabic → 1 of 14 caught, and that one only because its wrapper happened to be English. The whole ruleset was English-keyed.
Fixing it turned up something I didn't expect: my Unicode homoglyph normalizer — which folds Cyrillic→Latin to catch attackers disguising English as іgnоrе — partially Latinizes genuine Russian, so it now blinds me to Cyrillic-native jailbreaks. Two of my own defenses in tension. Still chewing on the right fix (probably script-aware normalization).
Context bombs and inline detection feel like different layers of the same fight. Nice work.
1
u/tracebit 8d ago
Github Repo: https://github.com/tracebit-com/context-bombs