PromptIntent-v2: evidence-based AI-security decisions
Most "AI firewalls" answer a yes/no question with a black box. PromptIntent-v2 answers a 7-way intent question with a deterministic detector and a calibrated ML model — then treats its own output as a claim to be measured, not a verdict to be trusted. Every endpoint starts in Shadow mode, and the capability climbs a governed enforcement ladder only when an operator explicitly stages it — and only while it stays healthy.
Two engines, one decision
Deterministic rules for what we can prove; a calibrated model for what we can only infer.
A prompt is not a file. You cannot hash it and match a signature — the same malicious intent can be phrased ten thousand ways. So PromptIntent-v2 is a hybrid: a fast, explainable deterministic detector runs first, and a 7-class ONNX intent classifier runs alongside it as an independent signal. Neither overrides the other blindly — the two are fused into a single decision with a recorded reason.
PromptGuard
Pattern- and rule-based. High precision on known attack shapes, fully explainable, zero model dependency. It anchors the decision — the model can add signal, but can never fabricate a threat the rules didn't see grounds for.
Intent classifier
An INT8-quantized ONNX transformer with a native WordPiece tokenizer, calibrated with temperature scaling into honest probabilities across seven intent classes. It catches novel phrasings the rules miss — and reports how confident it is.
Seven intents, not one alarm
The model classifies what a prompt is trying to do — including "benign" and "ambiguous".
Four classes are attacks (PromptInjection, Jailbreak, SecretExtraction, ToolCoercion); two are safe (Benign, AboutSecurity — a security question is not an attack); one is an explicit Ambiguous class, because a model that is never allowed to say "I'm not sure" will manufacture false confidence. Honest uncertainty is a first-class output.
Shadow-first, by design
The model does not act. It earns the right to — one governed rung at a time.
An unproven model that can block is a liability, not a feature. PromptIntent-v2 runs behind a governed enforcement ladder. Every endpoint starts at the observe rung and moves only when an operator explicitly stages it — per tenant, or per single machine for canary rollouts:
Evidence, not adjectives
"AI-powered" is not a claim; it's a mood. Corxor treats every PromptIntent decision as a measurable event. On the backend, decisions are scored against labels into precision, recall, F1 and false-positive rate, and promotion up the ladder is a deliberate, audited operator act backed by that evidence — Shadow first, then a visible-warnings canary on a single machine, then enforcement. The gate, the current stage, and the health of the capability are visible to operators, not buried in a datasheet. We are walking our own fleet up this ladder the same way — starting with one machine.
This is one concrete instance of a larger thesis: in the AI era the unit of risk is a decision, and decisions must be defended, measured, and explained. We wrote about why that demands a new architecture — an operating system for AI — in our engineering series.
See it in the product. PromptIntent-v2 ships inside QuickSecure and runs on-device — the model itself is proprietary, but every decision it makes is measured, explained, and governed. That's the difference between a claim and evidence.