L1
Pattern Matching
128 patterns across 22 attack categories. Catches known injection formats, encoding tricks, and role-override attempts before anything else runs.
128 patterns · 22 categories
Behavioral
Behavioral Analysis
7 sub-checks analyze structural signals, conversation topology, authority escalation, instruction-data boundary violations. Catches attacks that look benign to static patterns.
7 sub-checks
Indirect
Indirect Injection
Detects instructions hidden inside documents, tool outputs, and retrieved content. The threat that enters through what your agent reads, not what the user types.
Session
Session Context
Maintains a 20-message sliding window to catch multi-turn attacks that unfold gradually, slow escalation, context poisoning, progressive boundary shifting.
20-message window
PII / Cred
Credential & PII Detection
Scans for 10 credential and PII types, API keys, tokens, SSNs, credit cards, before they reach the model. Blocks exfiltration at the proxy layer.
10 credential types
ML
DeBERTa-v2-small Classifier
44M-parameter transformer fine-tuned on adversarial prompt data. Runs locally on-device. Catches novel attacks that evade pattern and behavioral layers.
DeBERTa-v2-small · 44M params
The Arbiter combines signals from every layer into a single verdict, then decides what to block. The credential and data-exfiltration floors always block inline, and a single high-confidence detection is promoted to an inline block, so on the proxy path blocking tracks detection with a low false-positive rate.
