Galvanize 3
A multilingual classifier that flags prompt injection in text an agent reads: tool output, web pages, MCP tool descriptions. Its weights are open on Hugging Face. Since 23 October 2026 it is the model behind the optional zn Cloud check. zn-gate sends the cloud check prompts only, and only when you turn the cloud on; on your machine, zn-gate uses deterministic rules.
Model card
| Task | Binary classification: prompt injection or not. It does not generate text. |
|---|---|
| Base model | Fine-tuned from Horizon-Labs/prompt-injection-guard-small (Apache-2.0) |
| Size | About 140M parameters |
| Input | Reads 512 tokens at a time; the API scores longer inputs in overlapping windows. If you run the model yourself, split longer inputs into chunks |
| Languages | Multilingual. Results per language, and the languages not tested yet, are on the Hugging Face model card |
| Threshold | You choose it when you run the model yourself; the model card shows how to turn the score into a verdict |
How we evaluate it
We keep a private test set that is never used for training. A detection rate only goes on this site when it is measured on that set, with the date, the dataset and the script that produced it. Galvanize 3 was not trained on this set, but we used it to choose the model, so read the figures as development results.
Results on our private test set (3,309 examples in several languages) and on our set of 658 long benign documents:
| Metric | Galvanize 3 | Galvanize 2 | Galvanize-60M (previous) |
|---|---|---|---|
| Detection rate (recall) | 89.6% | 83.4% | 66.9% |
| False positive rate | 0.6% | 0.81% | 6.4% |
| Long benign documents flagged | 2.9% | 4.1% | ~66% |
Galvanize 3 at its serving threshold; Galvanize 2 at its threshold of 0.662; Galvanize-60M at its own threshold of 0.95. The Galvanize 2 public benchmark in the benchmark/ folder on Hugging Face can be rerun with its script. Method in the launch post · Galvanize 2 public benchmark ↗
Weak spots and what it does not detect
- It is one layer, not a guarantee. It still misses some attacks, so keep least privilege on your agent's tools.
- Indirect and structured injections, such as instructions hidden in documents or data, are a known weak spot.
- If you run the model yourself, only the first 512 tokens of an input are scored per pass: split longer inputs into chunks (the API scores them in windows).
- It scores each text in isolation: it cannot tell whether an instruction is legitimate for a given user or task, and attacks split across several tool calls or hidden in images, audio or binary files are out of scope.
- Results vary by language, and most public benchmarks are in English.
- It is not a content filter (no toxicity, hate speech or topic moderation), and it does not protect your secrets: that is the job of secret redaction in zn-gate.
- A lower threshold catches more and blocks more legitimate text; a higher one does the reverse.
Previous models: Galvanize 2 and Galvanize-60M
Galvanize 2 was the model behind zn Cloud from 12 to 23 October 2026, and Galvanize-60M before it. Galvanize-60M is now the automatic fallback when Galvanize 3 is unavailable, at its own threshold of 0.95. The weights of both stay on Hugging Face under Apache-2.0. The figures in the September 2026 Galvanize-60M release post came from a first-party benchmark, not from our held-out test set; the held-out comparison above replaces them.
Use Galvanize 3
Download the Galvanize 3 weights and run them yourself, or use the optional zn Cloud check, which runs the same model.