Self-hosted LLM guardrails that steer, not filter.

Our product, PRIOR, keeps the open-weight models you run yourself on your policy. It reads the intent behind a request and enforces your rules from inside the model as it generates, rather than inspecting text on the way in or out. It runs on your hardware. Your prompts and model data never leave your environment.

eagle-logic.com · Docs · Capabilities and limitations · Model support · Free 30 day trial

Most guardrail tooling is a detector: it reads a prompt or a response, classifies it, and returns a verdict. That is a real job and the field does it well. But a verdict is not an outcome, and a tool that inspects the finished response has exactly two moves left: allow it, or destroy it and return a canned string.

PRIOR is built for the other half of the problem. When a request is refused, the refusal is opened by a steered onset and then continued by the model in its own voice, not substituted with a fixed message. If the model starts to relent partway through, emitting the artifacts of compliance where a refusal should be, that is caught during generation and reverted.

An output filter cannot do this, because by the time it sees the response the model has already finished. That is the difference worth evaluating us on.

The container images are public. No account, no auth, no waitlist:

# 1. Pull a certified open-weight model (Llama-3.2-3B is the quickstart default, ~2 GB)
hf download bartowski/Llama-3.2-3B-Instruct-GGUF \
  Llama-3.2-3B-Instruct-Q4_K_M.gguf --local-dir ./models

# 2. Run the engine (drop --gpus all for CPU-only, and use prior:slim-cpu)
docker run -d --gpus all -p 127.0.0.1:8089:8089 \
  -e PRIOR_NATIVE_MODEL=/models/Llama-3.2-3B-Instruct-Q4_K_M.gguf \
  -v "$(pwd)/models:/models:ro" \
  -v "$(pwd)/license.bin:/app/license.bin:ro" \
  -v prior_state:/app/state \
  ghcr.io/eagle-logic/prior:slim

# 3. Send a request. -i shows the x-prior-* headers.
curl -s http://localhost:8089/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{"model":"prior","messages":[{"role":"user","content":"Write a haiku about the ocean."}]}' -i

x-prior-steering: enabled confirms policy is being enforced. x-prior-zone: GREEN on a benign request means it passed through byte for byte. PRIOR speaks the OpenAI API, so your client does not change.

Image tags: prior:slim is the broad-reach CUDA 12.4 build (driver 550+). Use prior:slim-cuda12.9 for Blackwell / RTX 50 series (driver 575.57.08+), or prior:slim-cpu for no GPU. A licence file is required; the 30 day trial is free, ships the full capability set, and verifies offline with no activation call.

Every figure here names the model it was measured on and who judged it. Figures without those two things are not worth comparing, ours included. Full methodology is on the capabilities page.

Injection survival. The most common objection we get is "why not just write a good safety system prompt?", so we measured one against a one-line "ignore previous instructions" override. Refusal rate, higher is safer:

_{Judge: StrongREJECT's own fine-tuned classifier. Set: 50 StrongREJECT prompts, with and without a one-line injection.}

A system prompt can be stripped by the next sentence; weights cannot. On the abliterated model the system prompt is worth nothing even unattacked, because abliteration removes the model's willingness to honour it. Honest framing: 48% is not 90%. The claim is relative, not absolute, and the shortfall is detector recall, not the actuator. Once a request routes RED, the intervention holds.

Enforcement. When the detector flags a request, the refusal holds essentially every time, scored by an independent HarmBench classifier from CAIS rather than by us. Primary judged model: Llama-3.1-8B-Instruct. Steered attack success lands at 2 to 3% on HarmBench (159 standard behaviors, cais/HarmBench classifier, 1.1.0 harm_veto path). Benchmark fleet: 12 models, 1B to 14B, six families, on commodity NVIDIA GPUs up to 12 GB. A second independent judge agreed 93.6% of the time across 800 samples; we report the more conservative number.

• Detector recall is the open work. The enforcer is the strong half. Helping the detector recognise more of the ways the same bad request can be worded is what we are actively improving, and we publish it rather than hide it.
• Some attacks are out of scope by design. The capabilities page says which, and why.
• PRIOR needs open weights. It works from inside models you run. If your workload is on a hosted API you do not control, PRIOR cannot reach into it, and a request-and-response filter is the right architecture for you.

PRIOR ships calibration for open-weight builds across Llama, Qwen, Gemma, Phi, Mistral, DeepSeek and more, dense and hybrid-attention alike, each graded for steering. Certified builds are cleared for full steering; Beta builds gate today with steering certification in progress.

The registry is generated, so it is the source of truth rather than anything written here: human-readable · JSON

Sales and enterprise: sales@eagle-logic.com · Security: security@eagle-logic.com · Privacy: privacy@eagle-logic.com