Trust at the speed of light. No compromise.
Geodesia G-1 is a non-invasive, real-time trust layer that drops in front of any model — your self-hosted vLLM, SGLang, TensorRT-LLM, llama.cpp, Ollama, a cloud OpenAI-compatible endpoint, or a streaming audio / voice pipeline. At its core is our proprietary multimodal physical model. Change one base URL and every prompt, document and answer is screened on nine independent axes in the same forward pass, scored with a calibrated probability in [0,1] per axis, and compliance-logged — the ingress pass that blocks before the model is called returns in 28–30 ms for a 2048-token prompt on a single GPU. The same layer now guards agentic MCP tool-calls and live web search — not just chat — improves with use under human supervision, and offers an optional 8B-class deep-scan for maximum depth. A platform that auto-generates auditable PDFs for the EU AI Act, California SB 942, and 11 other AI frameworks. Days, not quarters, to production.
Three risks block every regulated AI rollout — and none of them are solved by training another model.
Mid-sized open models confidently fabricate citations, statistics, and clinical advice. In agentic pipelines a single hallucination cascades into irreversible action — and you have no idea which token caused it.
An open 8B model is not a frontier closed model. The frontier safety stack — refusals, jailbreak resilience, prompt-injection containment — is not in the weights. It has to be added at the runtime layer.
Article 27 FRIA. Article 12 audit logging. Article 50 disclosure. Article 14 human oversight. Fines up to 3% of global turnover. Generic LLM observability tools do not produce the documents a regulator asks for.
G-1 is a drop-in OpenAI/Ollama proxy. Your application keeps speaking the OpenAI API; G-1 speaks it back. Your inference engine — vLLM (official, unmodified), SGLang, TensorRT-LLM, llama.cpp, Ollama, or a cloud OpenAI endpoint — keeps running unchanged. Every prompt is screened before generation, on nine axes in the same forward pass — the ingress pass returns in 28–30 ms for a 2048-token prompt on a single GPU, before the model is ever called. Every response is scored as it streams, with a full prompt+answer pass at ~76 ms. Every inference is signed, logged, and made auditable.
Every turn is screened on nine independent axes — prompt safety, jailbreak, RAG context-injection (RAG-firewall), hallucination-on-context, closed-book hallucination, answer safety, profanity, out-of-scope, and prompt-complexity (a routing signal, not a risk signal). All nine share a single forward pass of our proprietary multimodal model — each axis reads a dedicated region of the model's vector subspace — so adding axes adds no latency: the ingress pass (the axes that can block before the model is called) returns in 28–30 ms for a 2048-token prompt on a single GPU; the full prompt+answer pass is ~76 ms. Each axis returns a calibrated probability in [0,1] (ECE 0.012–0.047). Auditable. Monotone. Deterministic.
G-1 no longer guards only the chat turn. The same real-time engine now protects agentic tool-calls, live web search, and per-model truthfulness — screens three new axes, pays for itself in avoided tokens, and gives operators a simulator to move the safety line — and it gets harder to fool the more it is used.
G-1 now inspects the full lifecycle of Model Context Protocol (MCP) agents — tool discovery, tool-calls, results and resources — and returns allow / warn / block verdicts in real time. It stops tool poisoning & "rug-pull" (silent mutation of a tool's description), indirect prompt-injection via tool results, and data exfiltration (taint → sink → new-domain). Policy is configurable per-application → per-axis → per-tool.
An optional 8B-class safety judge (open Apache-2.0 base, GLAD geometry on top) that reads internal states and emits calibrated scores across the safety axes, with selectable scope (prompt / answer / both). For when you want maximum depth at a little more latency.
Closed-book truthfulness recalibrated for every LLM you serve. Two modes from the console — Fast (quick conformal-threshold recalibration) and Deep (full) — restore a conformal false-positive-rate guarantee when you swap models, with hot-reload and no restart.
Three levers, three time horizons, all inside your perimeter. Immediate: a Policy Lens threshold change is hot-reloaded and applies to the very next request. Fast: an approved reviewer correction goes into episodic memory and is recalled at scoring time — no retraining. Structural: an approved corpus of corrections feeds a deliberate, gated retraining. Incidents are memorised, not trained on, until a human decides they belong in the weights — the detector's out-of-distribution geometry stays undisturbed by ad-hoc fixes. Full breakdown →
Live web search where every fetched page is screened by the GLAD firewall before it can ground an answer: injection / DAN pages are blocked 🔴, safe pages are read 🟢 — visible in real time. Async RAG PDF upload with progress.
A dedicated detector for crisis and self-harm ideation — including euphemistic phrasings and very short queries — a high-ethical-value safety axis, generalising to novel / curated cases.
Profanity — vulgar/abusive language, deliberately separate from prompt-safety: an angry customer swearing is offensive and harmless; a politely-worded request for synthesis instructions is dangerous and clean. Out-of-scope — off-topic requests, conditional by construction: silent without a declared scope, and with even a 20-character scope reads ≈0.999 on off-topic vs ≈0.0009 on-topic, customizable per customer, zero retraining. Prompt-complexity — a routing signal, never a risk signal. All three run in the same forward pass, in annotate-only mode, blocking nothing until an operator promotes them.
When out_of_scope blocks a request, the gateway rejects it before the upstream call: zero input/output tokens spent, audit row still written, exact saving shown as prompt_blocked in the console. When prompt_complexity is below threshold, the router sends the request to a cheaper model instead of a capable one — at no added latency, since the score is already computed alongside the safety axes. In the agentic era a guardrail is called 10–100× per task; one that costs at that volume is a problem, one that saves is a line item with the opposite sign.
Safety is relative — what should be blocked depends on the deploying company, not the model. Policy Lens is a counterfactual simulator over your app's real logged requests: drag a threshold and every logged request is re-decided before you apply it — how many flip blocked→allowed, how many flip allowed→blocked, how many your own reviewers already confirmed correct. The simulation is exact (recomputed on already-logged scores, no model re-run) and ground truth is always your reviewers' corrections, never a vendor label. "Lower jailbreak to 0.85" is indefensible; "lower jailbreak to 0.85 — unblocks 14 real customer questions, 9 already flagged by our reviewers as wrongly blocked, caused by the word 'override' which appears in our own product docs" is a decision you can defend.
Speech is now guarded like text. A streaming transcription layer sits in front of the detector: it transcribes the microphone incrementally and re-scores the growing transcript on prompt-safety and jailbreak — the same input-validation path as typed chat. A spoken attack is caught while it is still being said, blocked before the utterance finishes, not after.
This is the category almost no one occupies: the incumbents' audio defence is "coming soon", and no hallucination detector touches voice. Voice agents in banking, health and customer care are exactly EU AI Act Annex III — and mid-stream halting is the only mechanism that stops a hallucination as it is pronounced.
A tiny ASR model (~75 MB) is baked into the proxy image — real-time on CPU, air-gapped, no runtime download; switch to a larger model in the UI for lower word-error rate. Off by default, so typed chat stays byte-identical. This is the semantic branch — it catches spoken content threats, not acoustic deepfakes / voice spoofing.
In a standard LLM deployment, a hallucinated response reaches one user. In an agentic AI system — where models orchestrate tools, databases, and other models — that same error becomes the next agent's trusted input.
By the time the error reaches a real-world action — a clinical recommendation, a financial execution, a legal document — it has been re-confirmed multiple times and is irreversible.
Geodesia G-1 is not benchmarked against generator models — a guardrail and a chatbot answer different questions. These are per-axis AUROC numbers on entire datasets held out from training, computed under two evaluation runs: test v4 (English) and test v5 (multilingual, two labeled axes). See the methodology below for what "held out" means here.
| Axis | OOD AUROC · test v4 (EN) | OOD AUROC · test v5 (multilingual) | Threshold · enforcement |
|---|---|---|---|
| Context-injection · RAG-firewall | 0.9405 | — | 0.2501 · block |
| Prompt safety | 0.9204 | 0.9892 | 0.9215 · block |
| Answer safety | 0.9174 | — | 0.7295 · annotate |
| Hallucination-on-context | 0.8671 | — | 0.6475 · annotate |
| Jailbreak | 0.8623 | 0.8426 | 0.9997 · block |
| Closed-book hallucination (advisory) | 0.769 | — | 0.58 (advisory) · annotate |
| Profanity | not yet publishable | not yet publishable | 0.90 · annotate |
| Out-of-scope | not yet publishable | not yet publishable | 0.90 · annotate |
| Prompt-complexity (routing, not risk) | not yet publishable | not yet publishable | 0.50 · off |
| MACRO | 0.8795 (6 axes) | 0.9159 (2 axes) | — |
Checkpoint gladg_v3_psjbft_ep0. All nine axes run in the same forward pass — no extra latency per axis. The pre-specialization-finetune head scores MACRO 0.8589 on the same test-v4 yardstick, for reference.
How these numbers are measured. Every AUROC in this table is computed on entire datasets held out from training: not rows set aside, but sources the model never saw in any form. The separation isn't asserted, it's verified: on this checkpoint's training-era corpus, cross-referencing against the two test sets' sources yields 0 shared sources out of 18 for the English test and 0 out of 26 for the multilingual one. This is the opposite of what most LLM-safety vendors publish, where in-distribution numbers systematically reward memorization — and the difference shows: our numbers are lower, and that's exactly the point.
What these numbers don't cover. The English test labels six axes, the multilingual test labels two. The three newest axes — profanity, out-of-scope, prompt-complexity — are covered by neither and don't yet have a publishable OOD number. They run in production in annotate-only mode and block nothing until an operator promotes them.
Joint FP budget. prompt_safety and jailbreak share a joint 2% false-positive budget, measured on a multilingual benign pool. A threshold calibrated on an English-only pool produced 13% false positives on Italian traffic.
Profanity ≠ danger. profanity is deliberately separate from prompt_safety: an angry customer swearing is offensive and harmless; a politely-worded request for synthesis instructions is dangerous and clean.
Scope is conditional. out_of_scope stays silent without a declared scope; with a declared scope of even 20 characters it reads ≈0.999 on off-topic and ≈0.0009 on on-topic — customizable per customer, zero retraining.
Every AUROC reported by Geodesia G-1 is computed under a leave-one-dataset-out protocol — the gold standard of validation. For each detection axis, an entire dataset is held out of the training corpus — not a held-out subset of the same distribution, but the whole dataset, never seen during training — and used only as the test set. The reported number is the area under the ROC on that unseen dataset. We do this because in-distribution held-out numbers, which most LLM-safety vendors publish, systematically reward memorisation of the training distribution. Out-of-distribution numbers are harder to game and more credible in production. All nine axes come out of a single forward pass of the ~300M mmBERT-base multilingual detector — no separate tiers, no added latency per axis. Full per-axis table above; on closed-book truthfulness we are explicit that the OOD number (0.769) is lower than in-distribution — that's the honest number, not the flattering one.
Closed-book has no context to check against, so a text-only baseline is a coin-flip (~0.5): the signal lives not in the text but in the confidence with which the base model generated the tokens. Our closed-book expert is therefore a separate one — a single linear head over 8 logprob features (mean surprise, varentropy, decision margin…), one forward pass, no resampling. Shipped as advisory (threshold 0.58): it raises a flag for human review on confidently-incorrect answers, not a hard block. Other published closed-book methods require either access to the model's internal latent states or 5–10 resampled generations per answer to reach their numbers — ours needs neither, which is the tradeoff that matters at production volume, even though the resulting AUROC (0.769 OOD) is lower.
Two passes, both inside the same ~300M-parameter, single-GPU, on-premise detector. The ingress pass — the axes that can block before the model is ever called — returns in 28–30 ms, faster than what we used to claim for the whole pipeline. The final pass, full prompt+answer analysis across all nine axes, runs in ~76 ms. Measured on 2048-token prompts.
| Pass | Latency (2048-tok prompt) | What it covers |
|---|---|---|
| Ingress | 28–30 ms | Blocks before the model is called — prompt_safety, jailbreak, rag_jailbreak, out_of_scope, profanity, prompt_complexity. |
| Final | ~76 ms | Full prompt+answer pass — adds answer_safety, halluc_context, halluc_closedbook. |
A single detector, ~300M parameters, mmBERT-base multilingual backbone, 2048-token window, single GPU, on-premise — all nine axes in the same pass.
From most solid to most fragile. Context-injection (0.9405) and prompt-safety multilingual (0.9892) show the cleanest separation OOD. Answer-safety (0.9174) and hallucination-on-context (0.8671) are solid on real traffic, with false positives bounded by split-conformal thresholds: a finite-sample bound on the false-alarm rate. Jailbreak (0.8623 EN, 0.8426 multilingual) is the hardest of the six labeled axes to hold OOD. On closed-book we are explicit: blatant fabrications we block before the user; on confident half-truths we raise an advisory, not a blind block.
References for the evaluation sets. Internal held-out corpora corpus_ood_test_v4 (English, six labeled axes) and corpus_ood_test_v5_ml (multilingual, two labeled axes), checkpoint gladg_v3_psjbft_ep0.
Reading guide. AUROC ranges 0.5 (random) to 1.0 (perfect). Closed-book hallucination is shipped as advisory: it raises a high-confidence flag for human review on confidently-incorrect answers, not a hard block — the signal is in the base model's token confidence, not the text, and we are honest about that. Latency is real-time: the ingress pass returns in 28–30 ms on an RTX A6000 for a 2048-token prompt (see the latency table above); the Compliance Runtime is fully async and never blocks the response.
To cover safety and hallucination and injection, everyone else stacks multiple large guards in series. Agents multiply LLM calls 10–100× per task and voice generates continuous streams — so the guardrail's cost and latency, per step, become the buying criterion. G-1's ingress pass — the axes that block before the model is called — returns in 28–30 ms for a 2048-token prompt on a single GPU, cheap and fast enough to run on every agent step and every voice chunk; the full prompt+answer pass runs in ~76 ms.
"In the agentic and voice era, the guardrail is called 100× more often than yesterday's model. We have the economics to be there on every call — and a verdict that is deterministic and recomputable by anyone, including an auditor who doesn't trust us."
| Capability | Geodesia G-1 | Cloud AI API | Raw Open LLM | In-House Build |
|---|---|---|---|---|
| Frontier-grade safety on open models | ✓ | ✓ | ✗ | ~ |
| Data stays on-premise | ✓ | ✗ | ✓ | ✓ |
| Real-time hallucination scoring | ✓ | ✗ | ✗ | ~ |
| Real-time voice / audio safety (multimodal) | ✓ | ✗ | ✗ | ~ |
| European Constitutional AI | ✓ | ✗ | ✗ | ✗ |
| Auto-generated EU AI Act reports | ✓ | ✗ | ✗ | ~ |
| Air-gap capable | ✓ | ✗ | ✓ | ✓ |
| Cryptographic audit chain | ✓ | ✗ | ✗ | ~ |
| Agentic pipeline forensics | ✓ | ~ | ✗ | ~ |
| Agent / MCP tool-call security | ✓ | ✗ | ✗ | ✗ |
| Time to production | Days | Immediate | Weeks | 12–24 months |
tools / tool_calls / results in your existing chat path (a byte-identical no-op when there are no tools). It covers tool poisoning & "rug-pull", indirect prompt-injection via results, and data exfiltration (taint → sink → new-domain), with policy set per-application → per-axis → per-tool."constitutional_ai": false (or simply include your own system message) and G-1 uses your prompt instead of the Constitutional-AI prompt — and that same prompt also grounds the hallucination check, so faithfulness is measured against your instructions.