Intrinsec AI · Anomaly detection for self-hosted LLMs
Plato.
Security signal from compute you already paid for.
Plato plugs into vLLM and SGLang and turns each request's inference compute into a compact behavioral fingerprint. Fingerprints build a baseline of normal for your workload, and anything atypical surfaces against it. No second model. No extra pass. No added latency.
How it fits
Detection rides along with inference.
A judge model re-runs your traffic to render a verdict. Plato taps the compute your engine already produces, so the request path is untouched and nothing new eats your latency budget.
Your model and your traffic never leave your infrastructure.
What it catches
One baseline. Every failure mode.
Attacks no longer arrive only as text. They hide in images, audio, video, retrieved files. Putting a guardrail on every surface and enumerating everything it should block is a losing game. The computation is where the action ultimately happens, whatever the source or modality, and anything that deviates from normal surfaces there, including failure modes no one has named yet.
Injected instructions.
Instructions smuggled in through user input, retrieved documents, or tool results compute differently from your workload's normal, including variants no guardrail was trained on.
Attacks in disguise.
Encodings, role-play framings, multi-turn coaxing. The text can be dressed up to read innocently; the computation underneath still doesn't match normal.
Information leaving.
Secrets, credentials, and sensitive information surfacing in responses where they never normally appear: the kind of leak a keyword filter can't enumerate.
Actions it shouldn't take.
Requests steering the model toward tools it doesn't normally call (deletion, escalation, outbound access), flagged before the pattern becomes an incident.
Work it shouldn't do.
A support model giving legal advice. A coding assistant doing bulk extraction. Output behavior outside the job you deployed the model for stands out against the baseline.
Traffic it wasn't built for.
When traffic shifts away from what you deployed for (abuse, misrouting, a compromised upstream), the change stands out against the baseline.
Built for the serving stack you already run.
Plato is a plugin for your inference engine, not another service in the request path.
- Zero extra model calls. Reuses the compute each forward pass already produces, including the KV cache the engine would otherwise discard.
- Zero added latency. Fingerprinting happens alongside inference, not in front of it.
- Adaptive baseline. Normal is learned from your own workload, not from a generic attack list.
- Model-agnostic. Swap or upgrade the model you serve (Qwen, GLM, Llama); the security layer carries over.
- Fits your alerting. Anomalies flow to the monitoring and security tools you already use.
Beyond binary verdicts.
DLP taught security to classify data. Plato classifies computation. A prompt is a control input: what matters is not what was said to the model, but how the model fires in response. Plato labels that firing pattern on every KV page (domain, task, disposition, safety flags), off the request path. And because computation lives in a shared, platonic representation space, the labels are not bound to text or to any one model. Hence the name.
Also from Intrinsec AI
The same idea, on the message stream.
Plato baselines the model's computation. The same approach applies one level up: baselining what agents are asked to do, message by message, for one agent or an entire fleet.
Identity Plane.
Describe what an agent should do in plain language. An adaptive behavioral profile, built from compressed activity across sessions, surfaces everything that drifts away from that role (injection, exfiltration, displacement) before the pattern completes.
Ask about Identity Plane →Fleet Memory.
Each request looks normal alone; together they're a coordinated campaign. Millions of prompts compress into one bounded view, so fleet-wide patterns surface even when every individual request passes. No SIEM, no data lake.
Ask about Fleet Memory →Design partners
Run vLLM or SGLang in production?
We're working with a small number of design partners to evaluate detection against their own traffic. You bring a workload; we bring the integration and sit with your team until it proves itself, or doesn't.
Become a design partner →