The unified diff field in the details of an abuse filter hit are not unified.
It shows all the previous page text with a "-" in front of it, followed by all the new wikitext (including any and all unchanged lines) with a "+" in front of it.

This causes false positives in filters looking for patterns in the "added_lines" field.

As example:
http://commons.wikimedia.org/wiki/Special:AbuseLog/121696

For those not able to view that hit (due to rights):
It triggered filter 74 which has the following one-liner as "Condition"

("{{http://" in lcase(added_lines))

The diff generated by MediaWIki itself in the edit made is as following:

|Author=[[User:流雨创意工作室|流雨创意工作室]]    |Author=[[User:流雨创意工作室|流雨创意工作室]]
|Date=2010-11-12    |Date=2010-11-12

• |Permission={{OTRS pending}}

+ |Permission={{subst:OP}}

|other_versions=   |other_versions=
}}  }}

So the only thing changed is a template in the Permissions-field.
AbuseFilter's "edit_diff

@@ -1,14 +1,14 @@
-== Summary ==
-{{Information
-|Description={{zh|1=....！}}
-|Source={{http://foo.bar.com}}
-|Author=[[User:JohnDoe]]
-|Date=2010-11-12
-|Permission={{OTRS pending}}
-|other_versions=
-}}

-== Licensing ==
+== Summary ==
+{{Information
+|Description={{zh|1=....！}}
+|Source={{http://foo.bar.com}}
+|Author=[[User:JohnDoe]]
+|Date=2010-11-12
+|Permission={{subst:OP}}
+|other_versions=
+}}
+
+== Licensing ==
(values of the Information-template replaced with samples)

Lines added in edit (AbuseFilter: added_lines)

Summary

{{Information

}}

Licensing

Krinkle

Version: unspecified
Severity: normal
URL: http://commons.wikimedia.org/wiki/Special:AbuseLog/121696