It sounds like jujutsu is not honoring the filter option, see man gitattributes, it even lists encryption as a possible use.