Border detector set
33 detectors, and what each one costs
What each one looks for, which side it runs on, what a deployment has to provide for it, and what it costs. The few that are catalogued but not runnable raise at policy load rather than letting text through as if it had been checked.
33 of 33run after an install today
30need nothing beyond a CPU
13–146 msp95 for a model-backed detector, 87 tokens on one thread; rules cost under 1 ms
The set
33 of 33
| Select | Detector | Tier | What it does | Needs | Backed by | Mean F1 | Cost | Status |
|---|---|---|---|---|---|---|---|---|
| disclosureoutputruns today | T0 | Reports whether an AI disclosure is present in the output, in 26 languages, and records the affirmative as well as the absence. | CPU | rule | not a classifier | 0.029 msmeasured | Runs today | |
| invisible_textinput, outputruns today | T0 | Characters that are in the text but not on the screen: bidirectional controls, tag characters used to smuggle instructions, zero-width characters used to evade filters. | CPU | rule | not a classifier | 0.024 msmeasured | Runs today | |
| secretsinput, outputruns today | T0 | Credentials in text on its way to the model: named key formats, plus a deliberately conservative entropy rule. | CPU | rule | not a classifier | 0.028 msmeasured | Runs today | |
| banned_termsinput, outputruns today | T1 | Terms the deploying organisation has decided must not appear, matched correctly in 26 languages. The list is policy; none ships. | CPU | rule | not a classifier | 0.167 msmeasured | Runs today | |
| code_presentinput, outputruns today | T1 | Source code in text that should be prose, reported as one finding per shape found: a fence, a shebang, a definition, an import, a script tag, a shell invocation. Each carries its own confidence so a policy can act on a fenced block without acting on a line that merely ends in a brace. | CPU | rule | not a classifier | 0.008 msmeasured | Runs today | |
| confusablesinput, outputruns today | T1 | Words that look like a listed term or hostname and are spelled with other letters, by the Unicode UTS #39 skeleton, and single words written in two scripts where one letter passes for the other. | CPU | rule | not a classifier | 0.124 msmeasured | Runs today | |
| encoded_payloadinput, outputruns today | T1 | Instructions or credentials hidden behind base64, hex, percent-encoding or rot13, found by decoding the run and applying the rules to what comes out. Decoding alone is never a finding: a JWT, a git hash and base64 of ordinary prose all decode and none is reported. | CPU | rule | not a classifier | 0.194 msmeasured | Runs today | |
| gibberishinputruns today | T1 | Input that is not meaningful text. | CPU | classifier | 0.992 | 27.287 msmeasured | Runs today | |
| infra_leakageoutputruns today | T1 | Infrastructure detail in an answer with no list to configure: private, loopback and link-local addresses, cloud metadata endpoints, home and system paths, and hosts under reserved suffixes such as .internal and .local. Documentation addresses and version numbers are not reported. | CPU | rule | not a classifier | 0.047 msmeasured | Runs today | |
| internal_domainsoutputruns today | T1 | Internal hostnames appearing in an answer meant for someone outside, in both their Unicode and punycode spellings. | CPU | rule | not a classifier | 0.16 msmeasured | Runs today | |
| json_schemaoutputruns today · needs dependency | T1 | Output that does not satisfy a JSON Schema the policy carries. Point it at the OpenAPI meta-schema and it validates an OpenAPI document. | dependency | rule | not a classifier | 0.001 msmeasured | Runs today | |
| language_idinput, outputruns today | T1 | Which of the 26 supported languages the text is in, whether that is one the policy permits, and whether an answer is in the same language as the prompt. Reports uncertain rather than guessing on short or mixed text. | CPU | rule | not a classifier | 0.223 msmeasured | Runs today | |
| link_integrityoutputruns today | T1 | Links whose visible text names a different site from the target, or whose target hides its host behind userinfo, a confusable spelling or an IP address. Single-script internationalised hosts are not findings. | CPU | rule | not a classifier | 0.167 msmeasured | Runs today | |
| markup_injectioninput, outputruns today | T1 | Markup in the text that a browser would execute rather than display, found through case folding, entity decoding and compatibility folding. | CPU | rule | not a classifier | 0.17 msmeasured | Runs today | |
| output_formatoutputruns today | T1 | Shape assertions a policy states: JSON, HTML, URL presence, length in graphemes, word count, case, choices, ranges, a regex, reading time. | CPU | rule | not a classifier | 0.001 msmeasured | Runs today | |
| output_leakageoutputruns today | T1 | Personal data in the output that the user did not supply, which is the narrower and more useful question than whether any is present. | CPU | ner | per entity | 24.939 msmeasured | Runs today | |
| piiinput, outputruns today | T1 | Personal data in input or output, as named entity spans with checksum validation where the identifier has one. | CPU | ner | per entity | 24.354 msmeasured | Runs today | |
| postal_codeoutputruns today | T1 | Postal codes that cannot exist in the countries the product serves: the wrong shape, or outside a published province or department range. | CPU | rule | not a classifier | 0.001 msmeasured | Runs today | |
| repetitionoutputruns today | T1 | Sentences the answer says twice, compared over folded text so a change of case or diacritic spelling does not hide a repeat. | CPU | rule | not a classifier | 0.292 msmeasured | Runs today | |
| sql_injectionoutputruns today · needs dependency | T1 | Generated SQL that does more than the product asked for: a second statement, a forbidden statement kind, a tautology, an unexpected UNION. | dependency | rule | not a classifier | 0.148 msmeasured | Runs today | |
| summary_supportoutputruns today | T1 | Whether each sentence of a summary appears in the source it summarises, by string overlap rather than by judgement. Useful for an extractive summary, and not a groundedness check: it says so in its own docstring. | CPU | rule | not a classifier | 0.553 msmeasured | Runs today | |
| system_prompt_leakageoutputruns today | T1 | Whether the answer gave away the instructions the model was operating under, by containment against the system prompt and by phrase match in 26 languages. | CPU | rule | not a classifier | 5 msbudget | Runs today | |
| token_limitinput, outputruns today | T1 | Text longer than the token budget of the model it is going to, counted with a tokenizer the policy names and pins: a local file, whose hash is reported as the revision, or an id already carrying a commit. A bare repo id is refused, because an unpinned count cannot be reproduced. | CPU | rule | not a classifier | 5 msbudget | Runs today | |
| biasoutputruns today | T2 | Output carrying bias related to a protected characteristic. | CPU | classifier | 0.983 | 19.097 msmeasured | Runs today | |
| injectioninputruns today | T2 | Attempts to talk the model out of its instructions. | CPU | classifier | 0.989 | 40.669 msmeasured | Runs today | |
| moderationinput, outputruns today | T2 | Thirteen hazard categories in one pass, from violent crime to election misinformation. Replaces the capability Llama Guard and ShieldGemma provide, with weights this project can ship. | CPU | classifier | 0.980 | 41.637 msmeasured | Runs today | |
| nsfwinput, outputruns today | T2 | Sexual or otherwise not-safe-for-work content. | CPU | classifier | 0.974 | 42.529 msmeasured | Runs today | |
| politenessoutputruns today | T2 | Whether the tone of an answer is acceptable. | CPU | classifier | 0.978 | 18.987 msmeasured | Runs today | |
| regulated_adviceoutputruns today | T2 | Output that reads as regulated financial, legal or medical advice. | CPU | classifier | 0.986 | 40.609 msmeasured | Runs today | |
| toxicityinput, outputruns today | T2 | Abusive or hateful language, in input or output. | CPU | classifier | 0.992 | 19.062 msmeasured | Runs today | |
| groundednessoutputruns today | T3 | Whether the claims in an answer are supported by the sources it was given. | CPU | classifier | no corpus yet | 12.851 msmeasured | Runs today | |
| topic_scopeinputruns today | T3 | Whether a request is inside the subject matter the product covers. | CPU | classifier | no corpus yet | 146.453 msmeasured | Runs today | |
| url_reachabilityoutputruns today · needs network | T3 | Whether links in the answer resolve to something that answers, with a deadline and a refusal to request private addresses. | network | rule | not a classifier | 3000 msbudget | Runs today |
What a detector asks of your deployment
Three of 33 ask for something. Each declares it in the catalogue, so a policy that switches one on returns a note saying so: a caller finds out when they enable it, not when it fails.
json_schemadependencyOutput that does not satisfy a JSON Schema the policy carries. Point it at the OpenAPI meta-schema and it validates an OpenAPI document.
sql_injectiondependencyGenerated SQL that does more than the product asked for: a second statement, a forbidden statement kind, a tautology, an unexpected UNION.
url_reachabilitynetworkWhether links in the answer resolve to something that answers, with a deadline and a refusal to request private addresses.
Off unless a policy turns it on. It reaches another machine, so their outage becomes yours.
Why tiers, and what they are not
A tier says when a detector runs, not that it is cheap. Every model-backed detector shares one encoder base, so at the same input length they cost the same: about 0.241 ms per token on one thread. Keeping that off the common path is the whole job.
T03
Always runs. Cannot be disabled.
T120
Runs on the standard path.
T27
Runs on the standard path. Can be disabled by policy.
T33
Runs only when a lower tier flags, or when the policy asks for it.
Per-language accuracy for the 8 that have it, with the corpus provenance and the languages that fail.