Security
Defense in depth, by construction.
Layered defense across detection, the decoy model, and cryptographic signing. Every profile bundle is signed, and given the trained adapter, a security team can rebuild it and verify it's bit-identical to what's deployed.
In one paragraph
Squirrelops AI Deception layers rule-based detection, an ML classifier, a decoy model, and cryptographic signing. Layer 1 is deterministic rule-based detection; Layer 2 is an ML classifier that ships inside the profile bundle; Layer 3 is the decoy persona model itself (trained to emit only recognizably-fake credentials even when detection misses); Layer 4 is cryptographic signing of every profile bundle. The decoy model and signing hold even if detection is bypassed. Given the trained adapter, a security team can rebuild any bundle and verify it is bit-identical to the deployed artifact: same bytes, same signature, same hash.
Defense in depth
Four independent layers.
The point is not redundancy for its own sake. It's that the worst case (a novel attack that evades both detection stages) is still safe, because the persona model itself is constructed to never emit a real secret, and every bundle is signed so what's deployed can be verified.
Rule-based detection
Deterministic patterns inspect every incoming prompt. Fast, explainable, auditable. 14 production rules ship by default and operators can add their own per-tenant rules on top.
ML detection
A neural prompt-injection classifier catches novel phrasings the rule-based layer doesn't. Runs on commodity CPU; no GPU dependency for inference.
Decoy model
The persona model itself is trained to emit recognizably-fake credentials. Even if rule-based and ML detection both miss an attack, the model independently guarantees nothing real escapes.
Cryptographic signing
Every profile bundle is signed at build time. The runtime refuses to load any bundle whose signature doesn't match an authorized key, so an unsigned or tampered artifact can't be deployed.
Reproducible profile bundles
Prove that what's running in production is what you tested.
Every profile bundle is a signed, sealed artifact. Given the trained model adapter, our reproducibility check rebuilds the bundle and proves it is bit-identical to the one deployed: same bytes, same signature, same hash. Everything downstream of the adapter, packaging, quantization, signing, is fully deterministic. No supply-chain ambiguity about what shipped. No “did someone swap the model on the way to production?”
The check runs in two modes:
- Staged-input rebuild: verifies the deterministic pipeline against staged inputs.
- Full rebuild: rebuilds from the trained adapter forward, matching the full pipeline used to produce the shipped bundle. Suitable for incident-response forensics or independent verification by a customer's security team.
On our reference-size pack, both modes complete in roughly fifteen minutes. Anything that breaks reproducibility breaks the release gate.
Recent hardening · v1.0.5 · 2026-05-24
Defense-in-depth hardening release.
v1.0.4 shipped the capability. v1.0.5 hardens the perimeter around it, closing issues from an internal audit of the runtime and build pipeline, including the items below.
- SSRF protection on the hosted-model adapter (rejects userinfo, IDN homoglyphs, private/loopback IPs).
- Decompression-bomb defense on profile loading: large members stream to disk with inline hashing instead of into RAM.
- Tar-smuggle defense: explicit member-type allow-list rejects sparse, hardlink, and LONGNAME entries.
- CSV-injection defense on exported reports.
- Input-size caps on the local model backend (8 KiB / 16 messages).
- Numerical safety guards on the ML classifier (no more NaN cascades routing benign traffic to high-severity buckets).
- Tighter regex bounds across the detection pipeline (preventing pathological-input compute blowup).
- Six additional quality fixes around training reproducibility and report sanitization.
815 tests pass on the release branch. See the full changelog →
Independent verification, on request.
Pilot customers will receive the reproducibility tooling and the source manifest needed to verify any signed bundle they get. Your security team rebuilds. Your security team confirms.