A non-invasive, real-time trust layer deployed as a drop-in OpenAI/Ollama reverse proxy. Sits in front of any inference engine that exposes token logprobs — official vLLM, SGLang, TensorRT-LLM, llama.cpp, Ollama, or a cloud OpenAI endpoint — and in front of streaming voice/audio pipelines. No model weights touched. No engine forks. At its core is our proprietary multimodal physical model: nine-axis screening with a calibrated probability in [0,1] per axis on the same forward pass, ingress screening returned in 28–30 ms on a 2048-token prompt on a single GPU (measured 2026-08-07, NVIDIA A6000). Mechanistic causal explainability. Async compliance evidence pipeline that auto-generates regulator-ready PDFs. On-premise. Air-gap capable.
Your application keeps speaking OpenAI. Your model keeps running unchanged. G-1 sits between them as a transparent symbiont — and it pays for itself: out_of_scope rejects before the model is ever called (zero tokens spent, audit row still written), and prompt_complexity routes to a cheaper or larger model at no added latency. Cost-control docs →
No added latency per axis — served thresholds below.
prompt_safety and jailbreak share a joint 2% false-positive budget calibrated on a multilingual benign pool — an English-only calibration measured 13% FP on Italian traffic. profanity is kept separate from prompt_safety by design: vulgar is not the same signal as dangerous. out_of_scope is conditional — silent (off) with no declared scope, and once an operator declares one it separates ≈0.999 off-topic from ≈0.0009 on-topic, with zero retraining. The three newest axes — profanity, out_of_scope, prompt_complexity — aren't covered by either OOD test set yet and run in annotate-only mode until an operator promotes them; they don't have a publishable OOD number yet. Full per-axis thresholds, enforcement defaults, and AUROC: see the nine-axis table on the product page →
From inbound API call to delivered response — every stage adds protection without breaking the OpenAI contract.
Client sends a chat completion request. Tenant identification, RBAC, and rate-limit checks happen at the edge. The payload is normalized to G-1's internal Inference Envelope and assigned an immutable Call ID.
The prompt is read by our multilingual, multimodal encoder, which emits independent OOD scores for prompt safety and jailbreak attempts. The jailbreak head targets attack structure — "ignore the instructions", evasion role-play — not keywords. The prompt-safety head adds dual-concept boolean logic: it fires when two individually-innocent elements co-occur (e.g. suffering ∧ means), or on direct ideation. On the English v4 out-of-distribution test (corpus_ood_test_v4, checkpoint gladg_v3_psjbft_ep0), OOD AUROC 0.9204 on prompt_safety and 0.8623 on jailbreak. On the multilingual v5 test (corpus_ood_test_v5_ml, the only two axes labeled there), prompt_safety reaches 0.9892 and jailbreak 0.8426 (2-axis macro 0.9159). prompt_safety and jailbreak share a joint 2% false-positive budget calibrated on a multilingual benign pool — an English-only calibration measured 13% FP on Italian traffic. False alarms are bounded by split-conformal thresholds with a finite-sample guarantee. For voice, an optional streaming transcription front-end feeds this same path: it re-scores the growing transcript on every committed word (LocalAgreement-2), halting a spoken attack mid-sentence.
Every request is checked against the active constitution: EU Charter of Fundamental Rights, EU AI Act Article 5 prohibitions, GDPR principles, and any customer-defined ethics policy. The constitution is versioned, auditable, and customizable. Outputs of this stage flow into both the audit chain and the oversight queue triggers.
The prompt is forwarded to the customer's chosen inference engine — official vLLM, SGLang, TensorRT-LLM, llama.cpp, Ollama, or a cloud OpenAI endpoint. No engine fork, no patched kernels: G-1 sets the standard logprobs: true flag and reads the per-token surprisal and top-k entropy from the response stream. All six supported engines (Ollama included, on recent versions) expose logprobs natively, so the full nine-axis pipeline runs end-to-end on every one of them. The model's weights are never modified. Streaming and non-streaming modes are both supported.
As the response streams, the companion model scores each window for (a) context hallucination — faithfulness to the supplied passages, RAG-aware; (b) context-injection (rag_jailbreak) — it reads the chunks loaded into RAG and intercepts a hostile instruction hidden inside a file that a prompt-and-answer guard never sees; and (c) closed-book hallucination — confident fabrication detected via the model's own per-token logprobs and entropy. Each emits a calibrated probability in [0,1]. On the English v4 OOD test, OOD AUROC 0.9405 on rag_jailbreak and 0.8671 on halluc_context. Closed-book ships advisory-only — 0.769 OOD, single-pass and logprob-only; it is not part of the blocking axes and is not compared against internal-latent-state methods it isn't built to match. SLEDGE recalibrates closed-book per served model (conformal FPR guarantee, hot-reload).
How these numbers are measured. Every AUROC above is computed on entire datasets held out from training — not rows set aside, but sources the model never saw in any form. The separation is verified, not asserted: cross-referencing this checkpoint's training-era corpus against the two test sets' sources yields 0 shared sources out of 18 for the English test and 0 out of 26 for the multilingual one. Most LLM-safety vendors publish in-distribution numbers that reward memorization; ours are lower, and that's the point.
While the response streams to the client, G-1 fires the async compliance pipeline: chain entry written, watermark applied, retention rule attached, oversight queue consulted (and, if needed, the call is escalated). Reports — FRIA, Annex IV, MiFID II audit bundles — are composed on demand from this evidence. Never blocks the user response.
When the workload is an agent, the same detection axes run over the full MCP lifecycle — tool discovery, tool-calls, results and resources — returning allow / warn / block in real time. It stops tool poisoning & "rug-pull", indirect prompt-injection via results, and data exfiltration (taint → sink → new-domain), with policy set per-application → per-axis → per-tool.
A queryable MCP server exposing analysis / verification primitives to any other MCP host.
Sits between a host and downstream MCP servers, sanitising tool traffic in transit — no app changes.
Validates tools / tool_calls / results in the existing chat path; a byte-identical no-op without tools.
A proprietary, multimodal physical model. Eight of the nine axes share a single forward pass, each reading a dedicated region of the model's vector subspace with its own head; closed-book is a separate linear expert over the generation's logprobs. Detector is ~300M params on an mmBERT-base multilingual backbone, 2048-token window, single GPU on-premise. Measured 2026-08-07 on an NVIDIA A6000 at 2048-token prompts: ingress pass 28–30 ms, final pass ~76 ms — all nine axes in the same pass. That's the pass that can block before the model is even called. Architecturally related to GLAD-Manifold, our physical world model.
Research → GLAD-ManifoldAn LLM vendor can bolt an explanation onto a generation, but it's sampled text — unverifiable, not reproducible. Ours is a measurement on a deterministic function: same input, same build, same answer, bit-for-bit, recomputable by an auditor. A tamper-evident proof, not an explanation. Mechanically: remove a token, re-run the detector, measure the score collapse — one token at a time (Pearl's rung 2, the do-operator; attention only shows where the model looked, not what it decided). Because the object of intervention is the detector itself — deterministic, no sampling, no temperature — the interventional and counterfactual answers coincide: this is Halpern/Pearl's actual cause of that specific verdict. The claim is about the decision, not the generator's cognition; it's the one claim that survives swapping the model behind the gateway. Every verdict is painted onto the text as a heatmap — deeper red = more risk, teal = grounding — with tokens shown in surrounding context (not bare), shading set against an absolute bar rather than the local max, and a responsible-token set sized to the user's own threshold; the panel reports, it never decides. Two methods: DCA (Deterministic Convergent Attribution — exact leave-one-out plus necessity/sufficiency verification, certifying the minimal responsible word set) and MuPAX (Monte Carlo Perturbation Attribution via Exclusion — random coalitions of text units scored by the detector, fit to a single joint linear surrogate whose coefficients are the per-token attribution χ, seeded and reproducible). Export the same causal evidence over MCP (which tokens of a poisoned tool-description caused a block). Backed by peer-reviewed MuPAX and EVIDENCE (EAAI 2025).
Research → XAI methodsEvery Inference Envelope — prompt, response, scores, decisions — is hashed (SHA-256) and chained (HMAC). You cannot delete entry N without breaking the chain. Verifiable in seconds. Court-admissible. Works inside the customer's database.
Auditing Hub →G-1 ships as a single container with a typed Helm chart. It runs on bare metal, on a single GPU node, in your Kubernetes cluster, or in a fully air-gapped enclave. No license server. No outbound calls. No telemetry.
Adapter training — the one-time step that calibrates G-1 to your specific base model and policy — runs on your own GPU. Geodesia.ai never has access to that hardware.
Geodesia.ai does not access, copy, store, transmit, or process client model weights, training data, prompts, or inference responses — by design, not by policy.