Straight answers about PRIOR.

PRIOR is a behavioral control plane for the open-weight LLMs you host yourself. It reads the intent behind each request and enforces your policy from inside the model as it generates, steering the model back on course or refusing outright before an off-policy token reaches your user. It runs as a single OpenAI-compatible container in your own environment.

The AI agents you run can be talked out of their own rules: a prompt injection, an instruction smuggled into retrieved data, a destructive tool call, or a persona that drifts over a long conversation. A system prompt is a request, not an interlock, and a keyword filter matches wording an attacker can simply change. PRIOR moves enforcement inside the model, so those failures are stopped as they form rather than caught after the fact.

Those sit outside the model and judge text on the way in or the way out, so they match wording rather than intent and can be reworded around. PRIOR works at the residual-stream level: it reads what a request is really asking for and holds the model to your policy while it generates. You get the same control whether an instruction is plain, obfuscated, role-played, or buried in a document your agent retrieved.

Eagle Logic, a deep-tech company building tools that make the open-weight models you self-host explainable, predictable, and yours to command. PRIOR is our first product.

PRIOR reads the model's own internal state (the residual stream) as it generates, matches it against your policy, and when a request is off-policy it steers the model's behavior directly or refuses, before a wrong token is emitted. It is not a prompt wrapper and not a second model grading the output; the control happens in latent space.

Because it reads intent in latent space rather than matching keywords, the same override worded a thousand ways, hidden in a user message, encoded in leetspeak, or planted in a retrieved document is still recognized as the same off-policy intent. In our tests PRIOR refused 79 of 79 flagged attacks, recovered 96% of disguised jailbreaks, and generalized to unseen attacks at AUC ~0.93 (independent cais/HarmBench judge).

Because a system prompt lives in the context window, and anything in the context window can be overridden by more context. We measured it: a strong safety system prompt ("refuse harm, answer everything else") against a one-line "ignore previous instructions" injection, on 50 StrongREJECT prompts scored by StrongREJECT's own fine-tuned classifier. Refusal rate, higher is safer.

The system prompt alone refused 64% of them. Under the injection it refused 8%. One line of text took it from working to worthless. PRIOR held 48%, unchanged by the attack, because there is nothing sitting in the context window to strip: the policy is enforced in the residual stream while the model generates.

48% is not 90%, and the gap is detection recall rather than enforcement: once a request routes RED the intervention holds. The claim is the shape, not the absolute. The full table, the method, and the limits →

No. Policy matching is a vector lookup against your pack, not a second model in the serving path, and a grounded fact is carried in the model's latent state at zero prompt tokens. Your context window stays yours.

When no policy fires, PRIOR is a no-op: byte-for-byte the base model on math and knowledge (a Δ 0.0 change on GSM8K and MMLU across the 12-model fleet), with no added latency. You don't trade capability for control. See the full method on Capabilities.

In the optional console container you hand PRIOR a plain-language policy document and it builds a "pack." No code and no training runs. Packs hot-reload with no restart, and the sensitivity thresholds are operator-owned dials. Packs are authored model-independently, so they carry to any supported model unchanged.

Yes. Every request is scored and routed to a zone (green, yellow, or red), and every routing decision is written to a durable audit trail on your box: the zone, the score, the pack that fired, and the action taken. "What did the agent do, and why?" becomes a query instead of a forensic project.

Calibrated GGUF builds out of the box, up to 31B: Llama, dense Qwen3 (including abliterated), the Qwen3-Next hybrid linear-attention class, Phi-4, Mistral-Nemo, Ministral, a DeepSeek-R1 distill, Gemma-3/4, and SmolLM3. Steering itself also runs on mixture-of-experts and hybrid state-space architectures, which the engine detects and handles at load. Each build is graded Certified or Beta, and the roster grows as models are calibrated. The live list is on the model registry (and machine-readable at /model-registry.json).

No, and that's structural, not a roadmap gap. Enforcing behavior from inside the model requires access to the model, so PRIOR works with the self-hosted open-weight models you run yourself (Llama, Qwen, Gemma, Mistral, and more). If your stack is entirely closed-API, PRIOR isn't the right tool.

Anywhere llama.cpp runs: a workstation GPU, a server, or an air-gapped box. Size the GPU for your model as usual. Lightweight steering adds minimal memory; high-fidelity mode budgets roughly a third more GPU memory than the bare model (varies by model). A steered 4B-class model fits an 8 GB card with headroom.

One driver caveat. The default prior:slim image is built on CUDA 12.4 and needs only NVIDIA driver 550 or newer, which is why it is the default. On a Blackwell / RTX 50 series card, pull prior:slim-cuda12.9 instead (driver 575.57.08 or newer on Linux), or prior:slim-cpu if you have no GPU. prior:slim-cuda12.8 is deprecated and now resolves to the same digest as the 12.9 tag.

PRIOR ships as a single headless container that speaks the OpenAI API. Point your existing client at it and keep going, with no re-architecting. A separate, optional console container gives operators a web dashboard for policy, live decisions, keys, licenses, and the audit trail. The core is Rust over llama.cpp, with no Python in the serving path.

No. You hand the console a plain-language policy document and it builds the pack, no code and no training runs. Deployment is a container and an OpenAI-compatible endpoint, so it fits the stack your team already runs.

Your models, prompts, policies, and audit logs stay on your infrastructure; we never receive them. Connected tiers do periodically validate the license with our server to confirm the subscription is active; that exchange carries only your license id and a node identifier, never your data. The air-gapped tier contacts nothing at all. Full details are in the Subscriber Agreement.

An annual, node-locked subscription. Every plan ships the full capability set; tiers differ only by how many nodes you run. Self-serve from $995/yr per node (Single, Team at 5 nodes, Platform at 12), with a free 30-day trial; air-gapped and enterprise on request. See plans & pricing.

You are never locked out of your model. Verification is local, so PRIOR keeps steering through short outages; steering only falls back to plain, unsteered inference if a connected node can't reach the license server for an extended period, or if the subscription lapses. Your traffic keeps flowing either way, with or without policy enforcement.

Yes, on the air-gapped tier, which makes no outbound calls at all, at install or at runtime. It is activated once by hand instead: the engine prints a challenge, we sign it, and you paste the signed response back. Nothing crosses the boundary but that text. Until the response is applied the license loads but does not steer, so budget for the handshake during installation. Priced per site or fleet, issued on request. The self-serve tiers do a periodic license check, so a permanently disconnected deployment should use the air-gapped tier.

We publish the model, hardware, sample size, and independent judge behind every number, and we state limitations alongside results. Headline figures come from matched-pair tests: the same model, seed, and harness, run with steering off and on. For example, harm on Mistral-Nemo-12B fell 86% under an authored StrongREJECT pack (scored by StrongREJECT's own classifier), and faithfulness under a deliberately poisoned source rose from 50% to 77% on Qwen3-8B, the most vulnerable model tested. The full method is on Capabilities.

PRIOR is shipping today for local open-weight models, with safety independently judged across the full 1B to 14B fleet, and results and provenance published. The open items we name where they apply: across-turn composition above 8B, still in validation, and grounding, measured on 3B to 8B. Beta-graded builds run and gate today, with steering certification ongoing.