Mathematical Bold / Fullwidth Unicode Obfuscation in User Input - ATR-2026-00444 (e7d471db-745c-5251-8eae-056432c62b85)
Detects user inputs that lift attack payloads into Mathematical Bold, Mathematical Italic, Sans-Serif Bold, Script, Fullwidth, or similar decorative Unicode blocks that visually render as Latin letters but bypass naive substring filters on plain ASCII keywords. Common HackAPrompt evasion technique: write the canonical payload using stylised Unicode variants ("I have been 𝙿𝚆𝙽𝙴𝙳", "Ｉ ｈａｖｅ ｂｅｅｎ ＰＷＮＥＤ"). Detection fires when 3+ characters from these blocks appear in user input, indicating intentional stylisation. ATR-2026-00001 Layer 12 covers Cyrillic / Greek homoglyphs; this rule extends to the dedicated Mathematical / Fullwidth Latin variants.