Border detector set

29 detectors, and what each one costs

What each one looks for, which side it runs on, what a deployment has to provide for it, and what it costs. The few that are catalogued but not runnable raise at policy load rather than letting text through as if it had been checked.

28 of 29run after an install today

26need nothing beyond a CPU

28 msp95 for an encoder pass, 87 tokens on one thread; rules cost under 1 ms

The set

29 of 29

Detector	Tier	What it does	Needs	Backed by	Mean F1	Cost	Status
disclosureoutputruns today	T0	Reports whether an AI disclosure is present in the output, in 26 languages, and records the affirmative as well as the absence.	CPU	rule	not a classifier	0.038 msmeasured	Runs today
invisible_textinput, outputruns today	T0	Characters that are in the text but not on the screen: bidirectional controls, tag characters used to smuggle instructions, zero-width characters used to evade filters.	CPU	rule	not a classifier	0.038 msmeasured	Runs today
secretsinputruns today	T0	Credentials in text on its way to the model: named key formats, plus a deliberately conservative entropy rule.	CPU	rule	not a classifier	0.048 msmeasured	Runs today
banned_termsinput, outputruns today	T1	Terms the deploying organisation has decided must not appear, matched correctly in 26 languages. The list is policy; none ships.	CPU	rule	not a classifier	0.168 msmeasured	Runs today
code_presentinput, outputruns today	T1	Source code in text that should be prose, reported as one finding per shape found: a fence, a shebang, a definition, an import, a script tag, a shell invocation. Each carries its own confidence so a policy can act on a fenced block without acting on a line that merely ends in a brace.	CPU	rule	not a classifier	0.009 msmeasured	Runs today
gibberishinputruns today	T1	Input that is not meaningful text.	CPU	classifier	0.966	27.528 msmeasured	Runs today
internal_domainsoutputruns today	T1	Internal hostnames appearing in an answer meant for someone outside, in both their Unicode and punycode spellings.	CPU	rule	not a classifier	0.234 msmeasured	Runs today
json_schemaoutputruns today · needs dependency	T1	Output that does not satisfy a JSON Schema the policy carries. Point it at the OpenAPI meta-schema and it validates an OpenAPI document.	dependency	rule	not a classifier	0.001 msmeasured	Runs today
language_idinput, outputruns today	T1	Which of the 26 supported languages the text is in, whether that is one the policy permits, and whether an answer is in the same language as the prompt. Reports uncertain rather than guessing on short or mixed text.	CPU	rule	not a classifier	0.362 msmeasured	Runs today
markup_injectioninput, outputruns today	T1	Markup in the text that a browser would execute rather than display, found through case folding, entity decoding and compatibility folding.	CPU	rule	not a classifier	0.239 msmeasured	Runs today
output_formatoutputruns today	T1	Shape assertions a policy states: JSON, HTML, URL presence, length in graphemes, word count, case, choices, ranges, a regex, reading time.	CPU	rule	not a classifier	0.001 msmeasured	Runs today
output_leakageoutputruns today	T1	Personal data in the output that the user did not supply, which is the narrower and more useful question than whether any is present.	CPU	ner	per entity	27.991 msmeasured	Runs today
piiinput, outputruns today	T1	Personal data in input or output, as named entity spans with checksum validation where the identifier has one.	CPU	ner	per entity	27.636 msmeasured	Runs today
postal_codeoutputruns today	T1	Postal codes that cannot exist in the countries the product serves: the wrong shape, or outside a published province or department range.	CPU	rule	not a classifier	0.002 msmeasured	Runs today
repetitionoutputruns today	T1	Sentences the answer says twice, compared over folded text so a change of case or diacritic spelling does not hide a repeat.	CPU	rule	not a classifier	0.497 msmeasured	Runs today
sql_injectionoutputruns today · needs dependency	T1	Generated SQL that does more than the product asked for: a second statement, a forbidden statement kind, a tautology, an unexpected UNION.	dependency	rule	not a classifier	0.238 msmeasured	Runs today
summary_supportoutputruns today	T1	Whether each sentence of a summary appears in the source it summarises, by string overlap rather than by judgement. Useful for an extractive summary, and not a groundedness check: it says so in its own docstring.	CPU	rule	not a classifier	0.921 msmeasured	Runs today
system_prompt_leakageoutputruns today	T1	Whether the answer gave away the instructions the model was operating under, by containment against the system prompt and by phrase match in 26 languages.	CPU	rule	not a classifier	5 msbudget	Runs today
token_limitinput, outputruns today	T1	Text longer than the token budget of the model it is going to, counted with a tokenizer the policy names and pins: a local file, whose hash is reported as the revision, or an id already carrying a commit. A bare repo id is refused, because an unpinned count cannot be reproduced.	CPU	rule	not a classifier	5 msbudget	Runs today
biasoutputruns today	T2	Output carrying bias related to a protected characteristic.	CPU	classifier	0.977	21.327 msmeasured	Runs today
injectioninputruns today	T2	Attempts to talk the model out of its instructions.	CPU	classifier	0.970	27.622 msmeasured	Runs today
moderationinput, outputtrained	T2	Thirteen hazard categories in one pass, from violent crime to election misinformation. Replaces the capability Llama Guard and ShieldGemma provide, with weights this project can ship.	CPU	classifier	no corpus yet	150 msbudget	trained
nsfwinput, outputruns today	T2	Sexual or otherwise not-safe-for-work content.	CPU	classifier	0.934	27.544 msmeasured	Runs today
politenessoutputruns today	T2	Whether the tone of an answer is acceptable.	CPU	classifier	0.962	30.319 msmeasured	Runs today
regulated_adviceoutputruns today	T2	Output that reads as regulated financial, legal or medical advice.	CPU	classifier	0.995	30.43 msmeasured	Runs today
toxicityinput, outputruns today	T2	Abusive or hateful language, in input or output.	CPU	classifier	0.992	27.224 msmeasured	Runs today
groundednessoutputruns today	T3	Whether the claims in an answer are supported by the sources it was given.	CPU	classifier	no corpus yet	300 msbudget	Runs today
topic_scopeinputruns today	T3	Whether a request is inside the subject matter the product covers.	CPU	classifier	no corpus yet	46.298 msmeasured	Runs today
url_reachabilityoutputruns today · needs network	T3	Whether links in the answer resolve to something that answers, with a deadline and a refusal to request private addresses.	network	rule	not a classifier	3000 msbudget	Runs today

What a detector asks of your deployment

Three of 29 ask for something. Each declares it in the catalogue, so a policy that switches one on returns a note saying so: a caller finds out when they enable it, not when it fails.

json_schemadependency

Output that does not satisfy a JSON Schema the policy carries. Point it at the OpenAPI meta-schema and it validates an OpenAPI document.

sql_injectiondependency

Generated SQL that does more than the product asked for: a second statement, a forbidden statement kind, a tautology, an unexpected UNION.

url_reachabilitynetwork

Whether links in the answer resolve to something that answers, with a deadline and a refusal to request private addresses.

Off unless a policy turns it on. It reaches another machine, so their outage becomes yours.

Why tiers, and what they are not

A tier says when a detector runs, not that it is cheap. Every model-backed detector shares one encoder base, so at the same input length they cost the same: about 1.663 ms per token on one thread. Keeping that off the common path is the whole job.

T03

Always runs. Cannot be disabled.

T116

Runs on the standard path.

T27

Runs on the standard path. Can be disabled by policy.

T33

Runs only when a lower tier flags, or when the policy asks for it.

Per-language accuracy for the 7 that have it, with the corpus provenance and the languages that fail.