CASAN

73 Commits 1 Branch 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
thanhnvandClaude Opus 4.8	82c6317b4b	feat(h4): multilingual VI/JA injection detection (Plan-07 B1 / V2) English blocklists missed injections in Vietnamese/Japanese. Added 5 VI/JA block-patterns to prompt-filter.yaml (data-driven — loaded into the blocklist, matched on raw UTF-8 via match_either), anchored on the injection OBJECT (chỉ dẫn/quy tắc/hệ thống/prompt · 指示/命令/ルール/システムプロンプト) so benign VI/JA text is not caught. No code change to security-check.sh. - phase-h4-multilingual-tests.sh: 7 checks — VI×3 + JA×2 injections BLOCK; 63 benign VI/JA corpus samples → 0 false positives; the trap line "bỏ qua các bước" (skip steps) correctly allowed. - redteam-vectors.jsonl: +4 VI/JA vectors (feeds benign-fp-report block-rate). Baselines: run-casan4 35/35, adversarial 44/44. Lifts H4 gap "multilingual VI/JA". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-05 20:48:51 +09:00
thanhnvandClaude Opus 4.8	cf2c42b9fa	feat(a6-tests): Plan-07 Track A — A6 benign/FP budget + Phase 1 adversarial suite A6: benign-corpus (EN 32 / VI 32 / JA 31 = 95 legit inputs) + redteam-vectors.jsonl (12 vectors, 4 critical). benign-fp-report.sh runs the REAL security-check over both and enforces the budget: false_positive_rate <= 3%, adversarial block >= 95%, CRITICAL block = 100%. Measured on the deterministic layer (semantic OFF) so it is reproducible in CI. Current: FP=0.00%, block=100%, critical=100%. phase1-track-a-tests.sh: 25 adversarial checks covering A1–A6 (homoglyph, zero-width, fullwidth, base64/hex, strict fail-closed, tool-output scan, telemetry tamper, cost slow-boil/spray/cold-start, FP budget). Kept separate so baseline suites (35/35, 44/44) stay untouched. New Phase 1 total: 35 + 44 + 25 = 104 checks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-03 22:46:33 +09:00

Author

SHA1

Message

Date

thanhnvandClaude Opus 4.8

82c6317b4b

feat(h4): multilingual VI/JA injection detection (Plan-07 B1 / V2)

English blocklists missed injections in Vietnamese/Japanese. Added 5 VI/JA
block-patterns to prompt-filter.yaml (data-driven — loaded into the blocklist,
matched on raw UTF-8 via match_either), anchored on the injection OBJECT
(chỉ dẫn/quy tắc/hệ thống/prompt · 指示/命令/ルール/システムプロンプト) so benign
VI/JA text is not caught. No code change to security-check.sh.
- phase-h4-multilingual-tests.sh: 7 checks — VI×3 + JA×2 injections BLOCK; 63
  benign VI/JA corpus samples → 0 false positives; the trap line "bỏ qua các
  bước" (skip steps) correctly allowed.
- redteam-vectors.jsonl: +4 VI/JA vectors (feeds benign-fp-report block-rate).
Baselines: run-casan4 35/35, adversarial 44/44. Lifts H4 gap "multilingual VI/JA".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-05 20:48:51 +09:00

thanhnvandClaude Opus 4.8

cf2c42b9fa

feat(a6-tests): Plan-07 Track A — A6 benign/FP budget + Phase 1 adversarial suite

A6: benign-corpus (EN 32 / VI 32 / JA 31 = 95 legit inputs) + redteam-vectors.jsonl
  (12 vectors, 4 critical). benign-fp-report.sh runs the REAL security-check over
  both and enforces the budget: false_positive_rate <= 3%, adversarial block >= 95%,
  CRITICAL block = 100%. Measured on the deterministic layer (semantic OFF) so it
  is reproducible in CI. Current: FP=0.00%, block=100%, critical=100%.
phase1-track-a-tests.sh: 25 adversarial checks covering A1–A6 (homoglyph, zero-width,
  fullwidth, base64/hex, strict fail-closed, tool-output scan, telemetry tamper,
  cost slow-boil/spray/cold-start, FP budget). Kept separate so baseline suites
  (35/35, 44/44) stay untouched. New Phase 1 total: 35 + 44 + 25 = 104 checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-03 22:46:33 +09:00