- Decoy profile
- A signed bundle containing the model, prompts, and detection rules that define a single decoy identity. Also referred to simply as a profile.
- Profile bundle
- The signed, reproducible artifact format used to ship a decoy profile to production.
- Detection layer
- The in-line stage that inspects every prompt for abuse signals before the model responds.
- Rule-based detection
- Deterministic pattern detection: fast, explainable, and auditable. Sits before ML detection in the pipeline.
- ML detection
- A neural prompt-injection classifier that catches novel phrasings the rule-based layer doesn't. Internally a fine-tuned DeBERTa-class model exported to ONNX for CPU inference. Ships inside the profile bundle alongside the rule-based layer.
- Tracked credential
- A unique, traceable fake credential issued to a suspected attacker. If anyone tries to use it later, we know exactly which session leaked it. Sometimes called a canary token.
- Adapter fallback marker
- A recognizable but un-tracked decoy credential the model is trained to emit if detection misses an attack, so a missed detection still doesn't return a real secret.
- Persona model
- The fine-tuned language model that gives each decoy its personality and produces convincing-but-fake responses. Internally a LoRA-adapted small open-weight model.
- Adversarial test suite
- Our internal evaluation harness that runs a multi-turn adversarial campaign against every release: jailbreak, role-play injection, encoding evasion, system-prompt extraction, tool-call abuse, and multi-step chains, spanning seven attacker profiles. Used as the release gate for shipping a new profile bundle.
- Per-tenant tuning
- Customers can add their own detection rules on top of the shipped ruleset without weakening it. Also called an operator overlay. Overlays are additive only: they can raise a threat score, never lower it.
- Cryptographic signing
- Every profile bundle is signed; the runtime refuses to load anything that hasn't been signed by an authorized key. Internally uses Ed25519.
- Reproducibility check
- A tool that rebuilds a shipped profile given its trained model adapter and proves it is bit-identical to the deployed artifact. Everything downstream of the adapter is fully deterministic; both the staged-input and full rebuild modes complete in roughly fifteen minutes on our reference-size pack.
- Defense in depth
- Detection (rule-based plus ML) is backed up by two more layers: the persona model is independently trained to never emit real-looking credentials even on a detection miss, and cryptographic signing means only a verified bundle can run.
- Threat capture rate
- The fraction of attack turns that the platform correctly routes into the decoy. v1.0.4 measured 66 of 67 attack turns (98.5%) on our internal adversarial campaign.