How zn works inside: measurements you can reproduce, methodology, and the failures we fixed along the way.
Galvanize 2 is our new prompt-injection detector, fine-tuned from Horizon Labs' open small model. On our held-out test set it catches 83.4% of attacks with a 0.81% false positive rate, and it stops flagging long legitimate documents. Here are the numbers, the weak spots and how we measured.
1.4.0 sent tool output to our API without redaction when an API key was set. 1.4.1 removes that path, makes the cloud opt-in and redacted, and we deleted the text our API had stored. Here is exactly what happened and what to do.
We are open-sourcing Galvanize-60M on Hugging Face: a small prompt injection classifier that runs on CPU, built for the tool loop of AI agents. Read the October 2026 update note before relying on the numbers in this post.
We merged /analyze and /v30/analyze into one endpoint that routes every request across a <50 µs deterministic tier, a ~15 ms int8 neural gate, and a mmBERT Deep Analyze tier. The engineering, the new plan limits, and the numbers we measured.
The engineering journey behind zn v30 as of September 2026: why 64 tokens plateaued, how we built 1,176 hard negative twins, training an MLP head on an NVIDIA H100 in 7.5 minutes, and cutting developer false positives from 4.49% to 0.64% on our own test set.
Attackers split keywords with comments, zero-width characters and look-alike letters. This post explains the normalization steps zn-gate runs before matching, how fast the rules engine is, and what it does not cover.
A 12 prompt pilot across six frontier models, direct and behind our gateway. What the models refused, what the gateway caught, and every number needed to reproduce it.
Our fused gate beat a Meta model on our benchmark, and then we found real benign text scoring above attacks inside our own classifier. A post-mortem of the v13d failure and the full rebuild behind v15: family blueprints, deterministic paraphrases, group-aware splits, and the gaps we left open on purpose.
Our injection detector scored 0.498-0.509 on everything we gave it. The root cause was a training objective that never saw a label, and the fix was embarrassingly ordinary: supervised end-to-end training. The full debugging story, the recipe, the numbers, and what the new gate still cannot do.