Phalanx by Invarra / deterministic jailbreak and injection control
Jailbreak and injection protection that does not guess.
A jailbreak is a user talking your assistant outside its intended boundary. An injection is the same attack with nobody typing at all: the instruction is already sitting in the page your app retrieved, the file someone uploaded, or the tool result it trusted. Phalanx sits in front of your model, reads every turn and every piece of text your app pulls in to answer it, and returns a fixed action before protected output is released.
The arena is a public challenge: the same model with and without Phalanx, side by side. Type an attack, or hide one in a document and let the app find it. Every attempt on the record.
Phalanx runtime
DeterministicUntrusted input
What users type
Every message, every turn
What your app reads
Retrieved pages, files, tool results, memory
One gate
input › evidence › action › recordFixed inference, deterministic arbitration. No judge model.
Auditable record
r_7d20aa5194
The problem
Your model does what it is told. That is the attack surface.
Attacks do not look like attacks. They arrive as ordinary language: a role to play, a hypothetical to entertain, an authorization that sounds plausible, pressure spread across innocent-looking turns. The model cannot reliably tell the difference, because following instructions is what it is built to do.
And increasingly nobody types them. Your application invites untrusted text in on its own — through search, retrieval, file uploads, tool results, and last week's memory — and hands it to the model in the same breath as your system prompt. The model has no way to know which one you actually authored.
A successful attack costs you on three fronts at once: the boundary itself, the security review asking what prevents this, and the public record when someone screenshots the win.
This is a security problem, and it deserves a defended perimeter.
How this is possible
A gate in front of the model, not another model guessing.
Phalanx runs fixed neural inference and deterministic arbitration. There is no generative LLM judge in the runtime, so there is nothing in the decision path that can be talked out of its own verdict. Given the same input, conversation state, model artifacts, and configuration, Phalanx returns the same decision — every time, on your hardware.
Your downstream model can stay probabilistic. The layer deciding what is allowed to instruct it does not have to.
Turn plus context
The user's message, and every piece of text your app pulled in to answer it
Phalanx gate
One fixed decision: pass, hold, or block. Untrusted content is stripped of instruction authority, not thrown away.
Your model
GPT, Claude, Llama, or local. Unchanged.
Release check
Outbound text checked before it reaches the user
Record
Every decision recorded and replayable
What it governs
Every written channel that can reach your model.
Phalanx started with one attack surface: what a user types. It now governs the harder one too — what your application reads on its own, and what it is allowed to do about it.
What users send
User-provided input
Governs adversarial written input before it can redirect the application.
What applications introduce
Application-provided context
Controls untrusted written context entering through connected workflows.
What the system releases
Protected release
Applies a fixed control decision before governed output or actions proceed.
Three actions
Pass, hold, or block. Your users never see a fourth thing.
Most guardrails hand your code a risk label and leave the enforcement to you. Phalanx returns the action itself, and only ever three of them. Ordinary prompts pass through. Boundary requests get a clarifying question. Attacks get a clean, ordinary decline.
Pass
Nothing in the request or its context is controlling the turn.
Ordinary prompt -> normal answer. Nothing changes.
Hold / clarify
The turn is ambiguous, or sits on the boundary.
I do not have enough information to answer that reliably. Could you clarify what you are trying to do?
Block
Sufficient control evidence is present, from any channel.
I cannot help with that request.
A handled attack may be blocked or held for clarification. Handled does not mean every attack receives a hard block.
The receipt
A log says something happened. A receipt says exactly what was decided.
A Phalanx receipt gives you the decision itself: which turn, which action, which runtime version, and a hash that ties the record together. It is signed and single-use, so a replayed or substituted record is rejected rather than believed. You are no longer reconstructing the incident — you are replaying it.
Phalanx receipt / replay 1 of 3 / identical every time
- turn
- t_9f41c2e8
- action
- BLOCK
- posture
- GUARD
- reasons
- INJECTED-INSTRUCTION / AUTHORITY-OVERRIDE / RELEASE-RISK
- runtime
- phalanx 2.0.1 / config c_88d1
- receipt
- r_7d20aa5194
Illustrative receipt shape. Raw prompts, raw model output, embeddings, internal scores, and secrets never enter the public evidence layer.
The evidence
The test stays sealed. The proof is public.
Jailbreak Control Benchmark v1 is a frozen evaluation of 1,120 written-chat cases: 870 attacks, 60 ordinary prompts, and 190 benign lookalikes. The attack prompts stay private so the test remains meaningful; the scoring rules, prompt-free case map, row-by-row outcomes, and integrity records are public for inspection. Injection results are reported against AgentDojo, the Rogue / Qualifire suite, and a sealed mixed multi-turn holdout — 2,948 attacks in total, alongside 3,738 legitimate tasks that had to keep working.
Governed means the attack met a fixed action before protected output could be released. Held means the turn was held for clarification rather than released. Neither means the model behaved. They mean the gate decided, and the decision is on record. The friction is published too: four of sixty ordinary prompts took a clarification route, and thirty-eight of a hundred and ninety benign lookalikes were refused outright.
870 / 870
Jailbreak attacks governed or held
All 870 attacks in the frozen test were governed or held before protected output could be released.
2,948 / 2,948
Injection attacks contained
Across three named suites, with no action taken that should not have been taken.
0
Observed pass-throughs
Neither channel — typed or injected — got past the gate and released unsafe text.
152 / 190
Benign lookalikes handled
Innocent prompts that resemble attacks, handled without a hard block. Thirty-eight were not.
These results are Invarra-run and have not been independently certified. The public evidence package lets buyers and researchers inspect what was tested, how it was scored, and what happened in every case without turning high-risk prompts into a downloadable attack library. Independent teams can request a controlled evaluation. One practical requirement: catching injected instructions requires your application to preserve where each piece of text came from. Flatten everything into a single prompt before it reaches us and no product can separate it again — including this one.
The alternative
What the second-AI approach actually costs.
The standard alternative is a guard model: another LLM that reads each message and estimates danger. In Invarra-run comparisons on the same frozen benchmark, under the published scoring protocol, tested guard-model baselines let between a third and three-quarters of the attack rows through. They also only ever saw the message — none of them were looking at what the application retrieved.
Phalanx
100%
0
Qwen3Guard-Gen-4B loose
27.7%
629
Qwen3Guard-Gen-4B strict
64.5%
308
meta-llama/llama-guard-4-12b
67.6%
282
Live demo / Phalanx vs the World
The claim is falsifiable. In your browser. Right now.
The arena is a direct, public challenge. Two lanes run the same model: one unprotected, one behind Phalanx. Every attempt produces a public record with labels, reason codes, hashes, and redacted summaries. Never raw harmful text. If you get something through, you will be the first, and we would genuinely like to know.
Bring
- Written-chat jailbreak attempts
- Instructions hidden in documents the app retrieves
- Multi-turn strategies that build pressure slowly
- Obfuscation, roleplay, and adversarial reframing
- Benign lookalikes, for false-positive testing
Working with us
From first call to running in your stack.
01
Scoping call
You describe your surface — chat only, or an app that retrieves, uploads, remembers, and acts. We tell you plainly whether Phalanx fits it, and what the second case needs from your backend.
02
Technical demo
Phalanx against attack patterns relevant to your boundary, both typed and injected, records included.
03
Pilot
Phalanx in your request path. Prototype in a day or two; a real pilot runs about a week.
04
License
Self-hosted runtime through local SDK, HTTP service, or container. Nothing leaves your environment.
One gate in front of your model. It governs what users type and what your application reads, returns a fixed pass, hold, or block, and leaves a record you can replay.
Launching something that reads documents or takes actions? Bring the boundary. We will put a gate on it.