Questions.
The guardrail, the benchmarks, and the token — answered.
Q1What exactly does SERAPH do?+
It's a guardrail that sits between the user and any language model. Every incoming prompt is inspected first — jailbreaks, prompt injections, adversarial suffixes and encoded payloads are caught and blocked, while ordinary prompts pass straight through to your model. It's the single checkpoint that turns "any LLM" into "a hardened LLM."
Q2How does it work on every model?+
Because it operates at the boundary, not inside the weights. SERAPH reads the prompt before it reaches the model and makes an allow/block decision on its own — so it wraps GPT, Claude, Gemini, Grok, Llama, Mistral, or any open-weights endpoint identically, with no retraining and no access to the model internals.
Q3What kinds of attacks does it stop?+
Seven independent detectors cover the full jailbreak landscape: instruction override (prompt injection), persona jailbreaks (DAN and friends), refusal suppression (PAIR-style rewrites), system-prompt extraction, obfuscation (base64, hex, leetspeak, zero-width smuggling), adversarial suffixes (GCG), and harmful-intent topics. An attack rarely dodges all seven tells at once, which is why the coverage generalizes.
Q4What is ASR, and why is 0% the number that matters?+
ASR is attack success rate — the fraction of attacks that get past the guardrail and reach the model. Lower is better; 0% means every attack in the benchmark was caught. SERAPH pairs that with a
0% false-positive rate, so it stops attacks without blocking legitimate prompts. Both numbers are on the
benchmark board.
Q5Can I reproduce the benchmarks?+
Yes — the attack corpus and the guardrail are both open source. Clone the repo, run the benchmark, and you'll get the same numbers. Every attack in the corpus wraps a
harmless canary payload, so the suite measures the technique's grip, not any real content. You can also add your own attacks in the
playground.
Q6How do I put it in front of my own model?+
One dependency-free file, or one HTTP call. Wrap your model function so the prompt passes through
Seraph.analyze() first — if the verdict is BLOCK you refuse, otherwise you forward to your provider. Full snippet in the
docs.
Q7Someone found a new bypass — then what?+
That's the whole model: open, and patched fast. Every attack that gets through the playground becomes a test case, the signal set is updated, and the benchmark grows. The community moves faster than any single attacker — which is exactly why the guardrail is open in the first place.
Q8What is $SERAPH?+
The community token behind the project. The guardrail is open source and free to use; $SERAPH funds bounties for new attacks and patches, aligning incentives so the defense keeps improving. Nothing here is financial advice.