Where Orpheus secures how AI is built, Perseus secures how it's served. It sits in your request path and verifies every prompt, retrieval, tool call and model response at runtime — powered by the same verification engine that protects Orpheus.
Your model shouldn't be the first thing to read untrusted input. Perseus takes it instead — the prompt, the retrieved context, the tool call, the response — and inspects it somewhere it can do no harm. Only what survives reaches your app.
Instructions hidden in a retrieved document, a support ticket or a tool response hijack the model — the user never typed a thing.
A markdown image the model writes can exfiltrate your context on render. EchoLeak did exactly that to M365 Copilot — zero clicks.
Once the model can call MCP servers and internal APIs, a hijacked turn stops being a bad answer and starts being an action.
Your model calls stay exactly as they are. Perseus checks what goes in and what comes out — the prompt, the retrieved documents, the response — from the Python or Ruby SDK, or three plain HTTP calls from any language. Works with any model, self-hosted included.
# a RAG turn, verified end to end verdict = perseus.pre_verify(user_message) if verdict.blocked: return verdict.user_message docs = retriever.search(user_message) verdict = perseus.verify_retrieval(docs) # catches poisoned documents if verdict.blocked: return verdict.user_message answer = model.generate(user_message, docs) verdict = perseus.post_verify(answer) ✓ prompt, retrieval & output verified
A refusal returns blocked: true with a user_message ready to show — your existing response handling already covers it. The whole wire contract is public: read the integration guide.
The same engine that verifies your developers' agents verifies your production traffic. Fast deterministic detectors run on the hot path; heavier LLM-powered policies run where the latency budget allows. A verifier either blocks or it doesn't — turn blocking off to watch it first, flip it on when you trust it.
Upload a policy document and Perseus compiles it into a live verifier — scoped to one app, or to every product in the company at once.
Every verification lands in a searchable stream, grouped by app, environment, session and end user — so "which customer hit this, how often, and what did we do about it" is a filter, not an investigation.
Events: every input, retrieval, tool call and completion across your apps — verified the moment it happens, in production.
A conversation is the unit of attack. Perseus tracks the session and the end user behind it, so a slow jailbreak across ten turns reads as one story instead of ten unrelated allows.
Every violation carries an audit-trailed review, and content you've accepted for an app is one click from never alerting again — the same tuning loop Orpheus teams already run.
Verification that costs a page-load is verification teams switch off. Perseus carries an explicit latency budget and skips any verifier that would breach it, rather than holding your response hostage to its own thoroughness.
If Perseus can't be reached, your app keeps serving and the gap is recorded. A security layer that can take your product down isn't one you'd leave switched on.
Each verifier declares what it's allowed to cost. Go over and Perseus drops it from that call and tells you — one slow check never becomes your slow endpoint.
Pattern and classifier checks run inline on every call. The expensive LLM-powered policies run where the budget allows, not in front of your user by default.
Being straight about what isn't built yet is part of being a security vendor worth trusting. These are in build now, not shipping today.
A taint graph over the conversation, so untrusted content is blocked by where it came from — not just how it reads. Spotlighting research put indirect-injection success below 2%.
Per-app and per-end-user token budgets, plus jailbreak scoring across sessions, to stop runaway spend and sustained probing.
Chunk-level verification for streamed responses, and OCR and speech-to-text checks for image and audio inputs.
A codebase scanner that maps your AI attack surface to the OWASP LLM Top 10 and traces untrusted input to dangerous sinks — and knows which verifier fixes each finding, because it runs the same ones.
Start on the free Community tier — 5,000 verified checks a month, no credit card — or book a 30-minute walkthrough and watch your own production traffic get verified.
