Phalanx · deterministic instruction control
Control what may instruct your LLM application before it controls the outcome.
Phalanx governs direct written-text jailbreaks and contains typed indirect prompt injection. It makes a deterministic pass, clarification hold, or block decision before protected output or action is released.
Runs entirely inside your infrastructure. The Phalanx runtime sends no customer prompts, documents, outputs, or evidence to Invarra.
Phalanx runtime
Deterministic decision path
01
Written turn
02
Evidence
03
Action gate
04
Receipt
Decision
Pass, hold, or block
870 / 870
Direct attacks governed or held
0
Observed direct pass-throughs
2,948 / 2,948
Typed injection controls contained
0
Unauthorized protected effects
Declared product boundary
Direct requests, typed untrusted content, and protected effects are different authority domains.
The trusted host creates the request envelope and assigns provenance. Text cannot make itself trusted by claiming to be a system message, administrator, policy, or developer instruction.
01
Direct jailbreak control
Twenty-five specialist evidence heads and deterministic stateful arbitration govern the user prompt and authenticated multi-turn trajectory.
02
Typed indirect containment
Extracted UTF-8 text from documents, retrieval, webpages, email, support text, memory, or tool output is supplied through an explicit untrusted channel and cannot acquire instruction authority.
03
Protected output and action
Request-bound, one-use permits are enforced at wrapped output, memory, and tool sinks. The Phalanx Wall performs final release enforcement.
Inside the control path
Specialist neural evidence, composed and enforced by deterministic control.
The learned payload is 25 task-specific evidence heads plus one shared pinned encoder. Deterministic stateful arbitration, authenticated state, and protected release controls compose that evidence into one enforceable action.
- 01Typed requestValidate limits, canonical views, provenance, and authenticated session state.
- 02Shared evidenceScore bounded specialist evidence through the pinned runtime.
- 03Coherent arbitrationCompose compatible same-view evidence into pass, clarification hold, or block while preserving trajectory state.
- 04Untrusted-content containmentKeep untrusted content usable as data without allowing it to become controlling instruction.
- 05Release authorizationBind any allowed response, memory write, or protected action to the current request and consume it once.
- 06Final enforcementRelease only under the signed policy; unavailable or invalid security-critical dependencies fail closed.
What deterministic means
Replayable control action, not identical generated prose.
The same signed package and configuration, typed input and provenance, authenticated session and trajectory state, permit state, and supported runtime/device profile produce the same final Phalanx action on replay.
The claim includes
- Same final Phalanx action under the stated replay conditions
- Stable internal scores within the supported numerical tolerance
- Versioned configuration, signed identity, health checks, and rollback
The claim does not include
- Bit-identical floating-point scores across every device
- Identical prose from an external generative model
- Recognition of every harmful idea or correctness of every model answer
Current release evidence
Each number keeps its own contract.
All results are Invarra-run. They are evidence on declared populations, not independent certification or proof that bypass is impossible.
JCB direct control
870/870 governed or held; 0 observed pass-throughs
Invarra-created regression suite. Excluded from neural-head training under the documented process, used as a runtime/release gate.
AgentDojo typed population
949/949 attacks contained; 97/97 benign preserved at the containment boundary
External benchmark-derived typed evaluation. 84/97 benign tasks passed stricter end-to-end continuation.
Rogue / Qualifire typed population
1,999/1,999 attack controls contained; 3,001/3,001 benign data available
External benchmark-derived typed evaluation. Measures authority containment, not universal semantic detection or task completion.
Customer deployment
Self-hosted control at a boundary the customer owns.
Phalanx performs neural inference, deterministic arbitration, and governance locally. No Invarra-hosted runtime API or internet connection is required. Integrate it directly in-process or through a private endpoint your organization controls. Every model route, prompt template, tool schema, sink, provider failure mode, and selected topology must still be qualified in the customer integration.
Current pilot can support
- Customer-contained execution with no required Invarra runtime connection
- In-process Python or private HTTP delivery
- One-process customer-hosted topology with explicit restart semantics
- Direct chat, typed document/RAG text, memory, tool results, and wrapped tool authorization
- Signed releases, readiness, redacted audit export, and verified rollback
Not offered as a current claim
- Inputs outside the documented written-text integration contract
- Content without host-assigned provenance and authority
- Actions outside customer-controlled enforcement boundaries
- General moderation, factuality, toxicity, or universal harmful-content detection
- A generally available hosted API, standalone executable, formal SLA, or claims beyond published qualification
The surrounding application, private endpoint, host, and infrastructure remain under the customer's security control.
Auditable action
A decision can be inspected without exposing the private mechanism.
Customer audit records can bind action, state, release identity, typed provenance summary, permit outcome, and redacted reason categories. Individual head scores, thresholds, private reason codes, corpus material, and signing secrets remain confidential.
- action
- request_clarification
- state
- lookalike_hold
- release
- withheld
- identity
- signed release digest
Choose the next action
Attack the public runtime or qualify one deployment boundary.
Phalanx vs the World is the separate public evidence arena. A founding deployment is the supported path for integrating the customer product.