Adarve Engine
Not one model. Layers that check each other.
A single public classifier is easy to fool and noisy on normal traffic. Adarve Engine combines deterministic de-obfuscation, multilingual signatures, a classifier ensemble, an attack memory and your own policy into one score — on our servers in the EU, never through a third-party AI provider.
How it decides
Six layers, one explainable verdict.
Normalise and de-obfuscate
Invisible characters, homoglyphs and up to three nested layers of Base64, hex or URL encoding are undone before anything is scored.
Multilingual signatures
Spanish and English in depth, plus French, German, Portuguese and Italian, matched with and without accents.
Classifier ensemble
Transformer classifiers vote on every text. Long documents are read in overlapping windows, so an injection buried in a RAG chunk is not truncated away.
Attack memory
Thousands of labelled attacks and look-alike benign prompts in 7 languages. A new paraphrase lands next to the attacks it resembles — even in another language — and benign look-alikes pull false alarms down.
Your policy
Your phrases, regexes, topics and canary tokens, versioned per project and applied on every request.
Deterministic guards
Exfiltration links, personal data and secrets, MCP definition changes: checks that hold even when a classifier is fooled.
Measured, not claimed
Adarve Engine vs. the best public open model.
Same texts, same thresholds. The baseline is protectai/deberta-v3-base-prompt-injection-v2, the most-used open prompt-injection classifier, used on its own. Green marks the better value of each pair — including where the public model wins.
| Dataset | Adarve Engine | Public model alone | ||
|---|---|---|---|---|
| attacks caught | false alarms | attacks caught | false alarms | |
| Adarve ES/EN | 100% | 5% | 100% | 20% |
| deepset | 58.3% | 0% | 36.7% | 0% |
| Gandalf | 99.1% | — | 100% | — |
| jackhhao jailbreaks | 91.4% | 1.6% | 85.5% | 1.6% |
| SPML chatbot | 80% | 1% | 99.6% | 10.6% |
| Dataset | Adarve Engine | Public model alone | ||
|---|---|---|---|---|
| attacks caught | false alarms | attacks caught | false alarms | |
| Adarve ES/EN | 90% | 2.5% | 100% | 20% |
| deepset | 25% | 0% | 35% | 0% |
| Gandalf | 98.2% | — | 100% | — |
| jackhhao jailbreaks | 86.3% | 0.8% | 85.5% | 1.6% |
| SPML chatbot | 36% | 0% | 99.6% | 10.1% |
Recall = share of attacks caught; false alarms = share of benign prompts flagged. Recommended threshold: 0.5 for review, and 0.5–0.8 to block depending on how much friction you accept. Generated 12 October 2026 · adarve-l1@2026.10.2+l2-onnx[deberta-pi-v2+horizon-pi+e5-small-cmknn4496].
Private by design
Your prompts stay with us, in the EU — and only as a hash.
- Inference on Adarve’s own servers in the EU
- No third-party AI API in the inspection path
- Prompts never stored in clear text — only a SHA-256 hash
- Pinned model versions; every response names the engine version
See what the engine says about your prompts.
Paste a prompt in the playground, or get a free key with 10,000 inspections a month.