Keep your AI agents from doing things they shouldn't.
PRIOR stops the AI agents you run from leaking data, running destructive commands, or getting jailbroken into breaking their own rules. It enforces your policy from inside the model as it answers, so a clever prompt or a booby-trapped document can't push it off course. It runs on your own hardware, and your prompts and model data never leave your environment.
Mistral-Nemo-12B
Mistral-Nemo-12B
12-model fleet
Real output from the PRIOR console. Steering off (left), the model
walks through a destructive DROP DATABASE command;
PRIOR active (right), the same model refuses at inference and offers
a safe alternative.
A system prompt is a suggestion, and attackers know it.
"Ignore your instructions..."
The same override, worded a thousand ways and hidden in a user message. Keyword filters match the wording; the attacker just changes the wording. A system prompt is a request, not an interlock.
Instructions smuggled in retrieved data
Any agent that reads outside input (files, tool output, RAG documents, an email) can be hijacked by instructions buried in that content. The model can't tell your intent from a payload planted in the page it just fetched.
rm -rf, dropped tables, eroded personas
A coding agent one bad step from a destructive command, a migration that drops the wrong table, a persona that decays over a long conversation. The failure lands on your desk later, as an incident.
PRIOR solves this by moving enforcement inside the model. Instead of guessing at the wording on the way in or the way out, it reads what each request is really asking for and holds the model to your policy as it generates. The same control holds whether an instruction is plain, obfuscated, role-played, or buried in a document your agent retrieved.
PRIOR enforces your policy from inside the model.
PRIOR is an inline control plane for the model as it generates. It reads the intent behind each request, decides whether that's within your policy, and when it isn't, holds the model to your rules from inside, steering it back in line or refusing outright before a single wrong word reaches your user. It needs no second LLM, adds nothing to your prompts, and none of your prompts or model data ever leave your environment.
Watch
Before the model answers, PRIOR reads the intent behind the request: what it's really asking for, by meaning rather than keywords.
Decide
Each request is sorted green (let it through), yellow (hold for confirmation), or red (block) against the policy packs you configure.
Steer
On a flagged request, PRIOR nudges the model back on course, holding the line or grounding a verified fact in place, and logs exactly what happened.
Author a policy. Watch it hold.
A policy pack is a small, human-readable file: the domain it governs, a set of example phrasings of what it forbids, and the refusal to give. Drop it in and PRIOR calibrates it into a gate that routes matching intent to RED and refuses in the model's own voice. No retraining, no brittle regexes.
Excerpt of a real pack, packs/codeops_minilm.arbiter.json (3 of 108 exemplars shown). It calibrates to t_low 0.4341 / t_high 0.6953, held-out AUC 0.78, 0% benign false-block. The steering direction isn't in the file; that's the runtime gradient.
The runtime
llama.cpp interface. It steers GGUF models
at runtime.
/v1/chat/completions. Drops in
behind your client.
Under the hood, for engineers
PRIOR routes every prompt by max-cosine similarity of its embedding to a policy pack's exemplars, against calibrated t_low / t_high thresholds (the tri-state GREEN/YELLOW/RED gate). When a pack fires, it steers the golden-layer residual at runtime, with no static vectors, no fine-tuning, and no second LLM. See the PRIOR page for the full mechanism and benchmarks.
Most guardrail tools hand you a coding project. PRIOR reads your policy.
The hard part of every other guardrail is the last mile: turning a written policy into something a machine will actually enforce. That is the part PRIOR is built to remove.
Bring a document, not an ML engineer
The usual path is writing policy as code: a custom DSL, YAML, Python validators, regex. PRIOR takes your actual policy document and builds the pack. No prompt-engineering degree required, and it is still a plain .arbiter.json you can open and edit by hand.
Proven on your model before you commit
A calibration step checks that steering actually takes on the specific model you run, and the supported-models list tells you what to expect before you download. No "works with everything" hand-waving.
A policy your compliance team can own
Because the rules come from a document, the person who owns the policy can own the pack, without filing a ticket for engineering to translate it into code.
Every number here comes with its receipts.
PRIOR is shipping today, and every figure traces to its provenance: the model, the hardware, the sample size, and the independent judge. Safety is independently judged across the full 1B to 14B fleet; grounding is measured on local 3B to 8B models, and we say so where it applies.
A safety system prompt is one line of text away from useless. PRIOR doesn't move.
A strong safety system prompt, then a one-line "ignore previous instructions" override on top of it. Refusal rate, higher is safer.
StrongREJECT, n=50, judged by StrongREJECT's own fine-tuned classifier, on Qwen3-4B (1.1.0 release candidate). On Qwen3-4B-heretic, an abliterated model, the system prompt scores 0% even unattacked while PRIOR holds 44%. 48% is not 90%: the shortfall is detector recall, not steering, and once a request routes RED the intervention holds. A 4B-class pass, reported separately from the fleet numbers below. The full table →
Forbidden-prompt harm on StrongREJECT, scored by the benchmark's own classifier, on Mistral-Nemo-12B (0.60 → 0.084). That is less than half the harm a strong safety system prompt leaves behind. See the breakdown →
Fleet pass: 1B to 14B, independent cais/HarmBench judge (159 standard behaviors) for safety, GSM8K and MMLU for capability retention. Measured on a separate fleet from the 4B-class injection result above; the two are not combined.
A confident fake source beats the real one. Model size doesn't predict who falls for it.
Drop one authoritative false source next to a true one, which is the everyday reality of production retrieval, and models diverge sharply. We expected scale to explain it. It doesn't. The worst offender we measured is a 12B, but a 4B regresses more than twice as often as an 8B, a 1B lands mid-table, and the entire Llama line holds at 5 to 8% regardless of size. The axis is how eagerly a model defers to a confident source, not how big it is.
| Model (poisoned context) | n | Asserted the false value |
|---|---|---|
| Qwen3-4B-2507 / heretic | 40 | 0% |
| Llama-3.2-3B | 43 | 5% |
| Ministral-3-3B | 29 | 7% |
| Llama-3.1-8B | 50 | 8% |
| Qwen3-8B | 38 | 13% |
| SmolLM3-3B | 28 | 14% |
| Qwen3-4B-base | 26 | 23% |
| Llama-3.2-1B | 15 | 27% |
| gemma-3-4b | 37 | 32% |
| Mistral-Nemo-12B | 51 | 45% |
What PRIOR does here is narrower than "makes the model more accurate," and we'd rather say so than imply otherwise. You supply the value you want held. PRIOR pins it in the residual stream at zero prompt tokens, and the model answers with it instead of the poisoned source. That is a compliance guarantee on a value you already know, not a way to make the model work out the truth on its own.
100-item current-weighted knowledge-conflict corpus (79 of 100 drawn from 2025 to 2026, every item web-verified against a source URL) · one leading, authoritatively-framed false source · "asserted the false value" is stricter than merely unfaithful · local Q4_K_M on an RTX 3060 12 GB · supersedes an earlier, thinner corpus whose numbers we no longer cite. Models above 12B and the hybrid Gated-DeltaNet 9B builds could not be served locally, so this is a 1B to 12B picture, not a full-fleet one. See the full benchmarks →
Run it locally for free; license it when it goes to production.
The engine ships as a single-tenant container serving an OpenAI-compatible API. It installs alongside your existing inference stack. Point your client at it and keep going. No architectural changes, and none of your data leaves your box.
Everything runs inside your VPC or on-prem hardware under a node-locked license. A separate, optional console container lets operators drop in policy documents, watch the gate, and manage keys. Thresholds and packs hot-reload with no restart.
It works with the self-hosted open-weights models you already run (Llama, Qwen, Gemma, Mistral, and more). It does not work with closed API providers, because enforcing behavior from the inside needs access to the model.
See plans & pricingRun PRIOR on your own model in minutes.
- 30-day trial with full capabilities, no card
- Drop a license file in; it binds on first use
- Self-serve plans from $995/yr per node
- Enterprise and air-gapped on request
Free for 30 days, then licensed per node.
Every plan ships the full capability set and runs in your environment, self-hosted, with your data never leaving your box. Licensed per node, a year at a time. Self-serve from $995/yr per node; enterprise and air-gapped on request.
The hard research, pointed beyond the language model.
Eagle Logic is a deep-tech architecture company. PRIOR is what ships today, but the work underneath it is aimed at a harder target: systems whose behavior you can actually explain, actually reproduce, and actually trust in production.
Explainability, determinism, and a path beyond today's statistical language models, not patches bolted onto them, is the through-line for everything we build. If that's the direction your team needs to move too, tell us what you're building →
Benchmarks, when they clear.
New results, frontier-scale confirmations, and release notes, sent when they're ready. No noise.
Double opt-in: we email you a confirmation link first. No sharing, one-click unsubscribe. See our Privacy Policy.