Regional-Indicator Flag-Emoji Alphabet Letter-Spelling Smuggling - ATR-2026-02004 (2a43bc19-7e96-583c-b63b-48bd34d54585)
Detects prompt-injection payloads that smuggle instructions or refusal-suppression phrases by spelling them out one letter at a time using Unicode regional-indicator symbols (U+1F1E6-U+1F1FF, the codepoints that render as flag emoji when paired, e.g. 🇮 🇠🇦 🇻 🇪). Attackers interleave the letter-emoji with filler emoji (plant/water/ loop icons) to defeat keyword and language-model-based filters while the underlying letters still spell coherent adversarial text (e.g. "I HAVE BEEN NEED WORD" / "AI DO NOT SPEAK"-style constructions). Detection is purely structural: it looks for a long run of regional-indicator codepoints regardless of which letters they spell or what topic the decoded payload targets, so it survives filler-emoji insertion and arbitrary payload content. Recovered from the HackAPrompt false-negative corpus, where this alphabet-spelling technique produced confirmed jailbreak submissions that evaded the prior detection surface.