Evidence-first writing on prompt-injection defense, agent security benchmarks, and gateway engineering. Numbers over narratives; methodology with every claim.
We are open-sourcing Galvanize-60M on Hugging Face: a 60M-parameter distilled model delivering sub-15ms CPU latency, 1.00% tool false positives, and 91.6% deep injection recall across 8k context.
We merged /analyze and /v30/analyze into one endpoint that routes every request across a <50 µs deterministic tier, a ~15 ms int8 neural gate, and a mmBERT Deep Analyze tier. The engineering, the new plan limits, and the numbers we measured.
A reproducible, cryptographically hashed benchmark comparing zn-gate (OSS & v30 Cloud Gate) against Meta Prompt Guard 2 (22M). Testing 1,054 indirect tool-use attacks from UIUC InjecAgent, deepset prompt injections, and 400 real-world API responses with zero false positives.
We benchmarked zn-gate against Meta Llama-Guard-3 (8B), NeMo Guardrails, and Lakera Guard across 1,200+ adversarial mutations on our distributed evaluation cluster. The findings: LLM guardrails add 400-850ms of latency, cost dollars per query, and fall prey to C-comment and homoglyph evasions that fail to trigger tokenizers. Why deterministic pre-gating is mathematically necessary for agent security.
The engineering journey behind zn v30: why 64 tokens plateaued, how Amazon Nova Micro generated 1,176 hard negative twins in 39s, training an MLP head on an NVIDIA H100 in 7.5 minutes, and cutting developer false positives from 4.49% to 0.64%.
A 12 prompt pilot across six frontier models, direct and behind our gateway. What the models refused, what the gateway caught, and every number needed to reproduce it.
Our v3 gate passed every pre-registered threshold except one Russian false-negative. We ran ten more configs to find out why. The fix turned out to be a single integer: sequence length 96. Here is the full campaign, every number, and what generalises.
Our injection detector scored 0.498-0.509 on everything we gave it. The root cause was a training objective that never saw a label, and the fix was embarrassingly ordinary: supervised end-to-end training. The full debugging story, the recipe, the numbers, and what the new gate still cannot do.
Our fused gate beat a Meta model on our benchmark, and then we found real benign text scoring above attacks inside our own classifier. A post-mortem of the v13d failure and the full rebuild behind v15: family blueprints, deterministic paraphrases, group-aware splits, and the gaps we left open on purpose.
Head-to-head numbers from our 217-vector prompt-injection suite: fused detection at 1.27% FPR and 9.42% FNR, and a careful look at why PromptGuard-2's claimed recall did not transfer to our distribution.