Intrinsec AI
Become a design partner

For teams serving their own models · vLLM · SGLang

Stop paying a second model
to secure your LLM.

Prompt injection, jailbreaks, data leaking into responses, tool calls that should never happen: you can't enumerate every failure mode. Intrinsec AI plugs into your inference engine and baselines how your model normally computes, so anything atypical surfaces. No second model. No extra pass. No added latency.

Become a design partner → Watch the 2-minute demo
0 extra cost or latency Model-agnostic · Qwen, GLM, Llama Plugs into vLLM & SGLang Runs in your infra

See it work

Two minutes, on real traffic.

Anomalous traffic surfacing against a learned baseline, with no guardrail model in the loop.

2-minute demo · prompt injection and drift detection inside the inference engine

The problem

You're paying for compute twice.
And the second pass still misses.

Every guarded request runs through your model once for the answer, and through a second model to check it. That doubles cost and latency, and a judge can only recognize the failure modes someone already enumerated.

Today · The second-model tax

Guardrails and LLM judges

  • Double compute, added latency. Every request is re-run through a judge that sits in the request path.
  • Enumerated coverage. A judge recognizes only the attack patterns it was trained on, and attacks can hide in images, audio, and files. Every new surface needs another filter.
With Intrinsec AI · Reuse what you already compute

Detection inside the engine

  • Zero extra cost or latency. We reuse the compute your engine already produces; nothing new sits in the request path.
  • Whole-class coverage. The computation is where the action ultimately happens, whatever the source or modality. Anything atypical surfaces there, even when the input looks fine.
One baseline catches
Prompt injection Jailbreaks Obfuscated prompts Sensitive-data exposure Rogue tool calls Atypical outputs Traffic drift Out-of-domain use

If it doesn't match how your workload normally computes, it surfaces. That includes failure modes no one has named yet.

How it works

Three steps. No new model.

Step 1

Plug into your engine.

A connector for vLLM and SGLang. Your model and your traffic never leave your infrastructure.

Step 2

Reuse the compute.

Every forward pass already produces rich internal state, including the KV cache. We distill it into a compact behavioral fingerprint per request.

Step 3

Surface what doesn't match.

Fingerprints build a baseline of normal for your workload. Anything atypical stands out, and alerts flow to the tools you already use.

REQUEST STREAM m₁ m₂ m₃ m₄ m₅ … Inference engine vLLM · SGLang · self-hosted LLM KV CACHE RESPONSE tool call · file write · response A SECOND MODEL WOULD RE-RUN ALL OF THIS RECYCLE FINGERPRINT BASELINE Recycled inference compute The engine already computes a fingerprint per request. Reuse it (no second model, no extra pass) and baseline normal behavior for your workload. INJECTION · JAILBREAK DATA LEAK · ROGUE TOOLS DRIFT · OFF-DOMAIN → your alerting stack

Detection rides along with inference. The request path is untouched.

Where this goes

Beyond binary verdicts.

DLP taught security to classify data. We classify computation. A prompt is a control input: what matters is not what was said to the model, but how the model fires in response. We label that firing pattern on every KV page (domain, task, disposition, safety flags), off the request path. And because computation lives in one unified representation space, the labels are not bound to text.

Design partners

Run vLLM or SGLang in production?

We're working with a small number of design partners to evaluate detection against their own traffic. You bring a workload; we bring the integration and sit with your team until it proves itself, or doesn't.

Become a design partner →