Geodesia

Prompt injection detection

Catch prompt injection and jailbreaks on every LLM call

Geodesia G-1 checks every LLM call for jailbreaks, prompt injection and system prompt leaks, in the same verdict that checks answers for made-up facts. In blocking mode, a jailbreak or harmful request stops before your model runs, so it costs no generation tokens. Commands hidden in documents and tool results are flagged, so your code decides what to keep.

Updated By

Request early accessSee how it works

A 30-minute demo on prompts like yours, then a test on your production traffic in passthrough mode.

How it works

G-1 checks every way in

Prompts, documents, tool results and answers. One verdict reports them all.

  1. 01 · The promptWhat the user sendsJailbreak attemptHarmful requestCamouflaged attackBlocking mode: it stops here. Your model is not called.
  2. 02 · The contextDocuments and tool resultsInjected instructionRetrieved passages, web pages, emails and tool output your app adds to the call.Flagged in the verdict. Your code drops it, re-asks or escalates.
  3. 03 · Your modelYour model answersSkipped when G-1 blocks the prompt.A blocked prompt costs no generation tokens.
  4. 04 · The answerWhat goes backSystem prompt leakUnsafe answerMade-up factsBlocking mode: the answer is withheld.
One call through G-1. Orange outlines mark the attack checks on this page. Made-up facts are reported in the same verdict.
harness.py · SKETCH
resp = client.chat.completions.create(
    model=MODEL, messages=msgs,
    extra_body={"context": passages})      # checked for hidden commands
g1 = resp.model_extra["geodesia"]

if g1["decision"] == "blocked":            # finish_reason: content_filter
    return safe_fallback(g1["reason"])     # stage "input": model not called
if g1["axes"]["rag_jailbreak"]["flagged"]: # a command hidden in passages
    return ask_without(passages, msgs)     # your rule: re-ask, escalate, stop
return resp
THE VERDICT IT READS · SCHEMA 1.1 · EXAMPLE VALUES
"geodesia": {
  "schema_version": "1.1",
  "decision": "blocked",
  "mode": "blocking",
  "reason": { "stage": "input",
              "axis": "jailbreak" },
  "axes": {
    "jailbreak":     { "score": 0.998,
                       "threshold": 0.99,
                       "flagged": true },
    "rag_jailbreak": { "score": 0.03,
                       "threshold": 0.25,
                       "flagged": false }
  }
}

In passthrough mode the same call returns "decision": "flagged" and the model answers. Example values: your thresholds depend on your model and your settings.

What it catches

Six attacks G-1 catches

Each one reports in the verdict, with the mode it works in.

jailbreak

Jailbreak attempt

Role-play overrides, "ignore your instructions", encoding tricks, false authority and escalation over several turns, in many languages.

Blocks in blocking mode. Flags in passthrough.

prompt_safety

Harmful request

Weapons, malware, harassment, abuse material and other requests no app should serve.

Blocks in blocking mode. Flags in passthrough.

rag_jailbreak

Injected instruction

Commands hidden in documents, retrieved passages, tool results or pasted text, aimed at your model.

Flagged in the verdict, so your code decides what to keep.

guard · system prompt

System prompt leak

Requests for your system prompt, even misspelled or disguised. And copies of your prompt or tool descriptions in an answer.

Blocking mode: the request stops, or the answer is withheld.

guard · camouflage

Camouflaged attack

Attacks buried in long text, or hidden with base64, hex, rot13, leetspeak and similar tricks, are recovered and checked.

On by default in G-1 Proxy.

guard · voice

Spoken jailbreak

Speech is checked for jailbreaks and harmful requests while the person is still talking.

On by default. In blocking mode the utterance never reaches your model.

Measured: the system prompt guard

Requests for the system prompt, disguised with typos and swapped characters, in nine languages.

INTERNAL TESTS, G-1 0.4.0
JAILBREAK CHECK

488 of 488misspelled or disguised requests for the system prompt caught, in nine languages

0 of 6,000harmless chat turns flagged by this guard

How we measured

488 requests for the system prompt, each corrupted at random with typos, swapped characters or missing spaces, in nine languages. 6,000 harmless chat turns as the benign set. G-1 0.4.0, with the guard in its default enforce mode. An internal test of this guard by the Geodesia team.

Set it up

Change one URL, then pass your documents

G-1 runs in your cloud as an OpenAI-compatible proxy.

  1. Deploy the G-1 container in your cloud or on your servers.
  2. Point your OpenAI-compatible client at G-1.
  3. Send retrieved passages in the context field. Tool results go in as tool messages.
  4. Run in passthrough mode on production traffic. G-1 flags, nothing is blocked.
  5. Decide in your code what each flag does. Then switch on blocking.
STEPS 2 AND 3 · PYTHON
client = OpenAI(
    base_url="https://g1.yourco.internal/v1",
    api_key=G1_KEY,
)

resp = client.chat.completions.create(
    model="your-model",
    messages=[{"role": "system", "content": SYSTEM},
              {"role": "user", "content": question}],
    extra_body={"context": "\n\n".join(passages)},
)

None of the attack checks needs log-probabilities, so all of them work with every model G-1 supports.

Watch, then block

Watch on your traffic first, then switch on blocking

Passthrough mode flags and blocks nothing. Blocking mode enforces.

CheckPassthrough modeBlocking mode
Jailbreak attemptFlagged. The model answers.Stopped before the model runs
Harmful requestFlagged. The model answers.Stopped before the model runs
Request for the system promptFlagged. The model answers.Stopped before the model runs
Injected instruction in chatFlaggedFlagged for your code to act on
System prompt copied in the answerFlaggedAnswer withheld
Unsafe answerFlaggedAnswer withheld

In blocking mode with streaming, G-1 stops the answer at its next checkpoint. To show users only checked answers, call without streaming.

Why G-1

One verdict you can act on and defend

Four things G-1 gives the code around your model.

Attacks and made-up facts, one verdictThe same verdict reports attacks on the prompt and made-up facts in the answer. One verdict per call, one place for your code to branch.
In your cloud, with your modelsG-1 runs as containers next to your models, in front of vLLM, SGLang, Ollama, OpenAI, Azure OpenAI, Bedrock or Vertex. It sends no prompts, answers or logs to Geodesia.
Refused prompts use no tokensIn blocking mode, a blocked prompt never reaches your model, so it uses no generation tokens.
Verdicts you can defendSame prompt, same verdict. When a fixed rule fires, the verdict names it. A check that could not run says why, so "not checked" never reads as "clean".
Bring us a prompt that got throughA founder reviews each request within one business day.

Questions

Prompt injection questions

What is the difference between a jailbreak and prompt injection?

A jailbreak tries to talk the model out of its safety rules. Prompt injection tries to replace your instructions with someone else's, either in the user's message or hidden in content the model reads, such as a web page or a tool result. G-1 checks for both.

Can G-1 detect indirect prompt injection in RAG?

Yes. Send the retrieved passages in the context field and G-1 checks them for hidden commands. The verdict flags them, so your code can drop the passages, re-ask or escalate.

How does G-1 stop system prompt leaks?

Two ways. It catches requests for the prompt, even misspelled or disguised ones. In blocking mode they stop before the model runs. It also checks each answer for copies of your prompt or tool descriptions and withholds that answer in blocking mode.

Does G-1 block, or only flag?

You choose the mode. In blocking mode, jailbreaks and harmful requests stop before your model runs. Answers that leak your prompt are withheld. Passthrough mode flags everything and blocks nothing, so you can watch G-1 on live traffic first.

Does it work in languages other than English?

Yes. The attack checks read many languages, and our system prompt guard test covered nine.

Will it slow my app down?

G-1 runs in real time and is designed for voice agents. In blocking mode, a refused prompt skips the model call. Ask us for the figures on your hardware.

Can I try it on my own traffic?

Yes. A 30-minute demo on prompts like yours, then a test on your production traffic in passthrough mode.

Does my data leave my cloud?

No. Your G-1 deployment sends no prompts, answers or logs to Geodesia. The license is checked locally.

Request early access

Bring us a prompt that got through

We'll run it through G-1 with you. A redacted example is enough.

Email first. Then share an example, or skip it. A founder reviews each request within one business day.