Watch PRIOR hold the line as the model generates.
Three things every self-hosted model gets wrong on its own: it trusts a poisoned source, it falls back to stale defaults instead of your verified facts, and it can be talked out of its own rules. Toggle PRIOR on and off below and watch each failure close. Then see the mechanism and the measured numbers behind it.
The demos are faithful reconstructions of measured runs. The routing, the grounded values, and the refusals mirror behavior we recorded on the named models. They run in your browser; no model is called.
Hand it a false source; it won't take the bait.
Drop one confident, wrong document next to the truth (the everyday reality of production RAG) and a strong model will often reason its way into the lie. PRIOR pins the verified value in the residual stream, so the model states the fact and flags the conflict instead of regressing to it.
Reconstructs the poisoned-source result: unprotected, the most deference-prone model we tested (Mistral-Nemo-12B) asserted the planted false value 45% of the time. With the verified value pinned, the model answers with it instead. Which models fall for it is driven by how eagerly they defer to a confident source, not by size. See the chart ↓
The right fact, carried in latent state, not the prompt.
Ground an environment fact once and PRIOR carries it in the model's latent state, not the context window. It overrides the model's stale default at zero prompt tokens, so your agent answers from your environment's values, not the generic ones it learned in training.
Reconstructs the grounding result: a verified fact, carried in latent state at zero prompt tokens, overrides the model's stale default across the models we tested, with no leak of the old value.
Reword the attack all you like; it still lands in red.
Wrap a disallowed request in a persona, a role-play, an encoding, or leetspeak and a base model can often be tricked into complying. PRIOR reads the intent behind the wrapper, so the routing lands on the same zone every time, and the refusal comes back in the model's own voice, not generic boilerplate.
Reconstructs the wrapper-agnostic result: across six jailbreak wrappers the routing stayed red and refusals stayed coherent (24/24). Harmful requests are described here, never shown; PRIOR blocks before any token is emitted.
Two moves: decide, then steer.
In plain terms: PRIOR reads what a request is really asking for, then nudges the model's own internal activity at a single layer so the safe outcome holds. More precisely, it decides which zone a request belongs in (reading its intent by meaning) and steers the residual stream (the model's internal working state as it generates) at one calibrated layer, inside the model. No second LLM, no fine-tuning, no static prompt injection.
Decide: the tri-state gate
Precision-first by default: tuned to never block a legitimate request, with the YELLOW band absorbing ambiguity. You own the thresholds.
Steer: the golden layer
The golden layer is the single spot inside the model, found once per model during calibration, where a small nudge most reliably changes the outcome. PRIOR adds a steering direction there and nowhere else; the model's weights are never modified.
The direction is calibrated per model (once), then either distilled to a static vector (lowest memory) or computed live per request (most context-adaptive). Your policies carry across models unchanged. Full mechanism on the PRIOR page →
The console your operators actually use.
Not a mockup. This is the shipping control plane, running the three default policy packs against live traffic.
The non-event is the product.
Same console, same session, two database questions. One asks what DROP does; the other asks to run it on production. Only the X-Ray panel differs. Most guardrails can only show you the block; the harder thing to show is the request that sailed through untouched, because "nothing happened" has no screenshot. Here it does.
What your reviewers will ask for
Every demo, backed by a number.
Matched-pair tests: same model, seed, and harness, steering off then on, run on named models and hardware and independently judged where noted. Every figure ships with its provenance.
Who falls for a poisoned source
Share of answers that asserted a planted false value over the verified one, unprotected. Longer is worse. Note what doesn't predict it: size.
100-item current-weighted knowledge-conflict corpus, web-verified per item · n=15 to 51 per model · one leading, authoritatively-framed false source · local Q4_K_M, 1B to 12B; larger builds could not be served locally, so this is not a full-fleet sweep.
Enforcement, once the detector fires
When a request is flagged, the outcome holds, checked by an independent HarmBench classifier across 11 models.
Zero capability tax
When no policy fires, PRIOR is a no-op. Not "a small delta," but byte-for-byte the base model across math and knowledge.
| Benchmark | Measures | PRIOR off | PRIOR on | Delta |
|---|---|---|---|---|
| GSM8K | Grade-school math (12 models, to 14B) | base | byte-identical | Δ 0.0 |
| MMLU | General knowledge (Llama-3.1-8B) | 67.25% | 67.25% | Δ 0.0 |
| XSTest | Over-refusal on safe-but-touchy prompts | base | 0 new false refusals | Δ 0.0 |
| Latency | Added time (idle / when steering engages) | n/a | None / negligible | ≈ free |
Provenance. Judged model: Llama-3.1-8B-Instruct · Fleet (1B to 14B): Llama-3.2, Qwen3 (incl. abliterated), Gemma-3, Gemma-4, Mistral-Nemo, SmolLM3 · Hardware: commodity NVIDIA GPUs to 12 GB (RTX 3060, RTX 5050 Laptop), CUDA 12.4 / 12.8 · Safety judge: independent cais/HarmBench classifier · Cross-check: independent LLM judge, 93.6% agreement (n=800), scored as conservative floors. Across-turn composition above 8B is in progress. Full capabilities & limitations →