1. What we detect
- • Direct prompt injection
- • Indirect injection via RAG
- • Tool result injection
- • MCP tool poisoning
- • Memory poisoning (MINJA-style)
- • Multilingual attacks (DE/FR/ES/NL/IT/RU/HR + translation path)
- • Novel never-seen variants
- • Multi-turn poisoning and codeword triggers
- • Worm propagation
- • Obfuscated/encoded attacks
- • System prompt extraction
- • PII and secrets leakage
- • Denial-of-wallet (token burn)
2. What we deliberately do NOT block
We do not block content policy attacks: persona hijack for propaganda, "act as a storyteller," creative writing, code generation, roleplay. Blocking these would mean blocking benign utility — real users need roleplay and task assignment.
3. What we CANNOT detect (architectural)
| Limitation | Reason |
|---|---|
| Backdoors in model weights | We sit in front of the model at runtime. We cannot inspect internal weights from external API providers. We detect behavioral symptoms at runtime, not the baked-in backdoor itself. (Pre-training datasets can be audited using our Training Data Audit product). |
| Chat template backdoors | They execute before the request reaches our API. A separate Template Auditor scans GGUF files before deployment. |
| Hidden chain-of-thought | Sleeper agents use covert reasoning to detect evaluation. We see only the final output. We detect symptoms, not intent. |
| Cross-modal injection | Audio, image, video steganography are research-stage. Requires GPU/NPU and multimodal models. |
| Agentic misalignment intent | We detect anomalous tool calls and log behavior. We cannot distinguish legitimate from illegitimate actions if both look identical at the API level. |
4. Operational limitations
Single-node deployment: current deployment is single-node. HA topology is documented but not yet deployed. Estimated cost: ~€47/month.
Semantic tier: the LLM guard runs on external providers with graceful degradation. Degradation is verified: 13/15 hardest attacks still block even with the LLM guard fully unavailable.
Crash window: state persistence flushes every 5 seconds. Worst-case state drift is 5 seconds.
Adaptive attackers: in our own tests, an automated search-based attacker bypassed our content filters in 17–18 of 20 attempts across two honest-oracle runs (85–90% ASR band, measured 2026-10-02 and 2026-10-06). This is a measurement of our system by us, not of human attackers, and it is not a prediction of real-world results. We reduce the damage by limiting what an agent can do (Tool Guard; provenance gating is planned) and we are working on this.
False positives (full benchmark): on our internal false-positive test corpus (147,073 items; TEST split), 3,462 items were blocked, an overall block rate of 2.354% (CP95 upper bound 2.433%), measured on production defaults at that date (2026-10-07/10). The rate rises with input length: under 1 KB 0.759%, 1–6 KB 10.442%, 6–64 KB 17.066%. If your traffic is long-form, expect a higher block rate and tune per channel; nothing found is not proof of absence. The smaller 700+ benign-control figure quoted on product pages is a separate, self-written corpus.
5. What's coming
- • Cross-Modal Defense (audio, image, video steganography — research-stage, requires GPU/NPU)
- • EU-based semantic inference migration (in progress)
- • Independent security audit program (planned)