A keyword-based filter is a detection rule that flags text when it contains specific words or phrases linked to abuse, such as phishing terms, malware names, or fraud language. It is simple, fast, and useful for first-pass screening in email gateways, chat moderation, and security monitoring.
Its weakness is that it only works when the target text is matched exactly. Attackers can evade it by inserting invisible Unicode characters, changing word boundaries, adding punctuation, or using lookalike characters, so the suspicious word no longer appears as one clean token. In real attacks, this can let malicious lures pass through while still looking normal to a human reader. Defenders reduce that risk by normalizing text, inspecting raw code points, combining keyword rules with tokenization and pattern matching, and testing filters against adversarial samples.