SERAPH Docs

1 · What it is

SERAPH is a guardrail that sits between the user and any model. Every prompt is inspected before it reaches the LLM; attacks are blocked, and only clean prompts are forwarded. Because it lives at the boundary rather than inside the weights, it works with any model — open-weights or API, large or small — with no retraining.

2 · The pipeline

3 · The seven signals

Each detector returns a score in [0,1]. The aggregate is a soft-OR: any single strong signal is enough to block, and multiple signals compound. This is why the guardrail generalizes — an attack rarely avoids all seven tells at once.

4 · Using it

The guardrail is one dependency-free file (shared/guardrail.js) that runs in Node and the browser. Wrap any model call:

Or hit the HTTP endpoint: POST /api/guard { prompt } → { verdict, risk, signals[] }.

5 · The benchmark

The benchmark board runs SERAPH over an open corpus of jailbreak techniques drawn from the standard families — Harmbench-style harmful-intent wrappers, JailbreakBench GCG and PAIR attacks, DAN, injection and encoding. Every attack wraps a harmless canary payload, so the benchmark measures the guardrail's grip on the technique and never stores real harmful content. Clone it and reproduce the numbers.

6 · Honest limits

• A boundary guardrail is a strong first line, not a proof. Determined novel attacks can always be authored; that's why it's open — so the community patches faster than attackers adapt.
• The harmful-intent signal flags domains, not intent perfectly; pair it with your model's own alignment for defense in depth.
• Benchmarks measure the published corpus. Real-world ASR depends on the attacks you actually face — bring your own to the playground.

7 · $SERAPH

$SERAPH is the community token around the project. The guardrail is open source and free to use; the token funds bounties for new attacks and patches. Nothing here is financial advice.