Phalanx · deterministic instruction control
Keep untrusted text from taking control of your LLM application.
Phalanx makes a deterministic, auditable pass, clarification hold, or block decision before protected output or action is released. It covers direct written jailbreaks and typed indirect prompt injection without using a generative judge as the runtime decision-maker.
Phalanx runtime
Deterministic decision path
01
Written turn
02
Evidence
03
Action gate
04
Receipt
Decision
Pass, hold, or block
870 / 870
Direct attack rows governed or held
Invarra-created, Invarra-run JCB regression suite.
0
Observed direct pass-throughs
On the declared 870-row attack population.
2,948 / 2,948
Typed injection controls contained
AgentDojo and Rogue/Qualifire attack-control populations.
English text
Production-qualified boundary
Localized pages do not imply multilingual qualification.
The instruction boundary
A model can follow the wrong instruction perfectly.
LLM applications combine trusted tasks with user prompts, retrieved text, documents, memory, and tool results. Phalanx keeps those authority domains separate and governs what may control the application.
Direct chat
Governs English written-text jailbreak pressure before an unrestricted answer is released.
Typed untrusted content
Contains instructions arriving through extracted document text, retrieval, memory, email, support text, or tool output.
Protected actions
Uses request-bound, one-use permits at wrapped tools, memory, output sinks, and the Phalanx Wall.
One supported product
Neural evidence. Deterministic control. Enforced release.
Twenty-five specialist neural evidence heads share one pinned encoder. Stateful arbitration composes compatible evidence, while typed provenance, authenticated sessions, one-use permits, protected sinks, and the Wall enforce the final decision.
01 · DETECT
Track control geometry
Specialists track semantic and relational evidence rather than relying on a keyword list or a generative moderation verdict.
02 · COMPOSE
Make one replayable action
The same signed package, configuration, typed input, state, permit state, and supported runtime profile produce the same final action.
03 · ENFORCE
Protect the sink
A pass is not enough by itself. Wrapped output, memory, and tool boundaries enforce one-use authorization before a consequential effect is allowed.
Public proof
Attack the shipping runtime instead of trusting a claim.
Phalanx vs the World is a separate public black-box arena. It compares naked and Phalanx-protected lanes and publishes accepted, inconclusive, and reviewed outcomes under the arena protocol. Arena judges, quotas, availability, and ledger controls are evidence-system controls, not customer-runtime guarantees.
- Same downstream model configuration for comparable direct-chat lanes.
- Typed provenance for indirect and mixed attack surfaces.
- Public receipts disclose bounded evidence without publishing harmful payloads.
- The benchmark and arena are Invarra-run, not independently certified.
Founding deployments
Bring one English written-text LLM boundary. We will determine whether Phalanx fits.
Current delivery is a tightly scoped, founder-supported integration pilot. No public hosted API, SLA, universal security, or multimodal claim is offered.