Galvanize 3 is live in the zn API
Today we are releasing Galvanize 3, the third generation of our prompt-injection detector. Since 23 October 2026 it checks every call to the zn API, right after the deterministic rules. Nothing changes on your side: same endpoint, same API key, same plan, same response.
At a glance
- Highest AUROC of ten detectors on public prompt-injection benchmarks: 0.965.
- 89.6% of attacks caught at a 0.6% false-positive rate on our 3,309-example multilingual test set.
- 2.9% false alarms on long legitimate documents, fewer than the open Horizon models, PIGuard, ProtectAI and deepset.
- Free to try: 10,000 calls a month on the Free plan, no card.
Why a new detector
Coding agents read untrusted text all day: tool outputs, MCP results, web pages, documents in the repository. A single injected instruction in any of them can redirect the agent. Galvanize 3 is trained for that traffic, the text an agent reads rather than the chat a person types, and for a second goal that matters just as much in practice: not stopping real work with false alarms.
What is inside
Model
Galvanize 3 is an encoder classifier of about 140 million parameters, fine-tuned from Horizon Labs' open small model. It reads 512 tokens at a time and scores longer inputs in overlapping windows. It runs on CPU in the same serving setup as its predecessor, so latency and pricing do not change.
Training
We trained several fine-tunes on public prompt-injection and agent-security corpora, with extra weight on tool outputs and long documents, and combined them into a single model by averaging their weights. The result keeps the strengths of each run without adding inference cost.
Benchmarks
Our multilingual test set
| Metric | Galvanize 3 |
|---|---|
| Attacks caught (recall) | 89.6% |
| False-positive rate | 0.6% |
| Long legitimate documents flagged (658 texts) | 2.9% |
3,309 examples in several languages, scored at the serving threshold with the same code. Galvanize 3 was not trained on this set; it was used during model selection.
Against open detectors
We ran Galvanize 3 next to nine open detectors on the public attack sets of Horizon Labs' prompt-injection eval suite, with the same code for every model: the three open Horizon models (small, base and large), Prompt Guard 2 (22M and 86M), PIGuard, NeuralTrust, ProtectAI and deepset.
Galvanize 3 ranks attacks above safe text better than any of them, with an AUROC of 0.965.
On long legitimate documents, where many detectors trip over ordinary security vocabulary, Galvanize 3 flags fewer texts than the three Horizon models, PIGuard, ProtectAI and deepset.
Methodology. Every detector was run on the first 512 tokens of each text, with the same code. Some public sets overlap with what some models were trained on: the attack sets come from Horizon Labs' own suite, and Galvanize 3 also used the BIPIA and boundary-pairs training splits. The long-document set is ours.
What it means for you
- Already on the API or on zn-gate with the cloud check? You are using Galvanize 3 now. There is nothing to upgrade.
- Quotas and prices stay the same. Every call runs the rules and Galvanize 3 inside one monthly quota.
- Want to know which model answered? Read
ml_versionin the response:zn-galvanize3-fp32-s512. - If the neural model is ever unavailable, the call falls back to the smaller Galvanize-60M, as before, and the response says so.
Open weights
An open-weights version is coming. It will be a separate model, trained only on data whose licences let us publish it. Galvanize 2 and Galvanize-60M remain available on Hugging Face.
Try it
The cloud check is optional: zn-gate protects your agent fully on your machine without it. When you want a second opinion from Galvanize 3 on the prompts and documents your agent reads, the Free plan is enough to start.
Try it for free. 10,000 calls a month, no card. Create your key.