S
Open-source · model-agnostic · defensive AI safety

The guardian layer
for every LLM.

SERAPH inspects every prompt before it reaches your model, catches the jailbreak, and forwards only what's safe. GCG suffixes, PAIR rewrites, DAN personas, prompt injection, encoded payloads — driven toward ~0% attack success rate. Works with any model. Runs anywhere.
Attack success rate
False-positive rate
Attacks tested
ALL
LLMs supported
Inspect. Block. Forward.
A single guardrail between the user and any model. It reads the technique, not just the words.
01 · INPUT

Every prompt is read

The user's message hits SERAPH first — before a single token reaches the model.

02 · CAUGHT

Attacks are stopped

Injection, DAN, PAIR, GCG suffixes and encoded payloads are scored across independent signals and blocked.

03 · FORWARD

Only what's safe passes

Clean prompts flow straight through. Your model does its job; the attacks never arrive.

Built like a guardian, not a filter.
Seven independent detectors, decoded obfuscation, and a benchmark you can run yourself.
◆ MODEL-AGNOSTIC

Works on every LLM

SERAPH sits at the boundary, not inside the weights. Point any model behind it — open or closed, big or small.

◆ TECHNIQUE-AWARE

Catches the method

It scores the jailbreak family — override, persona, refusal-suppression, exfiltration, obfuscation, adversarial suffix — so it generalizes beyond any single prompt.

◆ OPEN & VERIFIABLE

Run the benchmark

The attack corpus and the guardrail are open. Measure the ASR yourself — no black box, no trust required.

Point any model behind it.
SERAPH lives at the boundary, so it doesn't care what's downstream. Open weights or closed API — the guardrail is the same.
GPT · OpenAIClaude · AnthropicGemini · Google Grok · xAILlama · MetaMistralDeepSeekQwen+ any endpoint
Questions.
The guardrail, the benchmarks, and the token — answered.
Q1What exactly does SERAPH do?+
It's a guardrail that sits between the user and any language model. Every incoming prompt is inspected first — jailbreaks, prompt injections, adversarial suffixes and encoded payloads are caught and blocked, while ordinary prompts pass straight through to your model. It's the single checkpoint that turns "any LLM" into "a hardened LLM."
Q2How does it work on every model?+
Because it operates at the boundary, not inside the weights. SERAPH reads the prompt before it reaches the model and makes an allow/block decision on its own — so it wraps GPT, Claude, Gemini, Grok, Llama, Mistral, or any open-weights endpoint identically, with no retraining and no access to the model internals.
Q3What kinds of attacks does it stop?+
Seven independent detectors cover the full jailbreak landscape: instruction override (prompt injection), persona jailbreaks (DAN and friends), refusal suppression (PAIR-style rewrites), system-prompt extraction, obfuscation (base64, hex, leetspeak, zero-width smuggling), adversarial suffixes (GCG), and harmful-intent topics. An attack rarely dodges all seven tells at once, which is why the coverage generalizes.
Q4What is ASR, and why is 0% the number that matters?+
ASR is attack success rate — the fraction of attacks that get past the guardrail and reach the model. Lower is better; 0% means every attack in the benchmark was caught. SERAPH pairs that with a 0% false-positive rate, so it stops attacks without blocking legitimate prompts. Both numbers are on the benchmark board.
Q5Can I reproduce the benchmarks?+
Yes — the attack corpus and the guardrail are both open source. Clone the repo, run the benchmark, and you'll get the same numbers. Every attack in the corpus wraps a harmless canary payload, so the suite measures the technique's grip, not any real content. You can also add your own attacks in the playground.
Q6How do I put it in front of my own model?+
One dependency-free file, or one HTTP call. Wrap your model function so the prompt passes through Seraph.analyze() first — if the verdict is BLOCK you refuse, otherwise you forward to your provider. Full snippet in the docs.
Q7Someone found a new bypass — then what?+
That's the whole model: open, and patched fast. Every attack that gets through the playground becomes a test case, the signal set is updated, and the benchmark grows. The community moves faster than any single attacker — which is exactly why the guardrail is open in the first place.
Q8What is $SERAPH?+
The community token behind the project. The guardrail is open source and free to use; $SERAPH funds bounties for new attacks and patches, aligning incentives so the defense keeps improving. Nothing here is financial advice.