Technical Details

Network-Level Interception

SAGITTERA operates as a transparent network-layer gateway, intercepting AI-bound outbound traffic before it leaves your network. Running in a WireGuard-based, network-namespace-isolated client, it captures HTTP/HTTPS requests at the network boundary prior to egress.

Flow: capture → screen → substitute → egress. Each request is screened by a cascade of specialist models executing locally on your hardware (no GPU required, no cloud dependency). Sensitive data is substituted in-flight before transmission; plaintext sensitive data never traverses the network.

Shadow-AI detection

Network-layer identification of AI endpoints by domain. Flags unsanctioned AI use and reports usage patterns to administrators.

• Network-level identification, a deterministic service-list lookup (no model required) against a curated list of AI endpoints, including subdomain and registrable-domain matching.
• Flags unsanctioned AI use, catches shadow-AI before PII or secrets egress to an unapproved provider.
• Reports usage, who, when, which endpoint, and what data was flagged, recorded in the audit log.

This is distinct from the model-based cascade, it is a deterministic network-layer control that runs on every connection, not just AI-bound payloads.

Full cascade results

We report our screening results in two separate subsets, because they measure different things. Attack screening detects hostile prompts (prompt injection, jailbreak, agentic tool-call attacks). PII screening detects personal data leaving the network. Each row runs the full production cascade for that subset, exactly as it operates in the product. Held-out test sets, never seen during training.

Attack screening

PII screening

Citations: The prompt-injection benchmark follows the independent evaluation protocol of N. Dzhaliuk et al., Comparative evaluation of machine learning methods for protecting LLMs from prompt injection attacks, Int. J. Inf. Secur. 25(4) (Springer, 2026), DOI 10.1007/s10207-026-01264-8, evaluated on the jayavibhav/prompt-injection test split. The jailbreak set is jackhhao/jailbreak-classification (Hugging Face), evaluated on its held-out test split. The agentic/tool-call set is cited in the dataset card: E. Deniz, Agentic Prompt-Injection 5K (Hugging Face, 2026), link. The PII set is ai4privacy/pii-masking-200k (Hugging Face, 2023), used under CC-BY-NC-4.0. The benign FP-control set combines leolee99/NotInject with other held-out benign text.

How the PII models work: SAGITTERA runs two PII specialists in parallel. The sensitive-PII model flags GDPR Art 9 special categories (health, biometrics, genetics, race, religion, politics, union, sexual orientation) plus sensitive identifiers (emails, phones, national IDs, SSNs, keys, financial), this is the "needs action" set. The non-sensitive (soft) model flags names, dates, places, and job titles. A query is flagged as containing PII if either model fires. The 0% FP on the sensitive model is on its clean set; the figures are not a universal guarantee of zero false-positives on all traffic.

Our model design

Rather than one general-purpose model trying to detect every threat, SAGITTERA runs a set of small expert models that are trained to work together in parallel and complement each other. All five are custom-trained int8 models (~106MB each) that run on a local CPU.

The general attack model and the general PII model run in parallel on every AI-bound request and flag independently, with no gating decision on top. Because each specialist is trained for one narrow job and FP-penalized, the combined cascade keeps false-positives near zero while covering both the attack surface and data leakage. Because the specialists flag independently and identify which expert fired, the cascade can name the type of attack or breach (a prompt injection, a jailbreak, a tool-call attack, high-risk Art 9 data, or soft PII) and act appropriately, for example block the highest-risk cases and flag the rest for review.

How our models compare

We benchmark our general attack model on the industry-standard public datasets that published leaders also report on, so the comparison is apples-to-apples. Our attack model is a set of three expert specialists OR'd together with no gating decision on top; the numbers below are the whole attack model (all three experts working together), measured on the same held-out test set each published competitor was scored on. Every SAGITTERA row is a held-out set the model never saw in training. All competitor figures are the cited papers' reported results, not ours.

The point is not that a single specialist beats every model on every axis, it is that the combination of small experts matches or beats the published leaders on each benchmark. SAGITTERA's solution is the cascade: five 106MB int8 models (~526 MB) that run on a local CPU, EU-sovereign, no cloud, no GPU. Where our recall is lower (jailbreak), our false-positive is 0.0%, which is the metric that matters to real users, a model that blocks 10% of legitimate prompts is unusable. Sources: jailbreak F1 from Ivry & Nahum, Sentinel (2025), arXiv 2506.05446, Table 2; prompt-injection from Dzhaliuk et al., Int. J. Inf. Secur. (Springer, 2026), DOI 10.1007/s10207-026-01264-8. We did not select these results; they are the papers' reported numbers, shown because each is the same held-out benchmark we scored our attack model on. A blank cell means the paper did not report that metric.

Server performance

When SAGITTERA runs as a central gateway serving many clients, the metric that matters is throughput under concurrency, not per-request latency. The chart below measures aggregate screening throughput (tokens/sec) as the number of concurrent requests rises, for both a GPU path and a CPU-only path on the same server-class hardware. Each point is the production 5-specialist cascade on sustained parallel load.

Measured on a server with H100 NVL + AMD EPYC 9654, 96-core and DDR5:

Supported clients assumes each interactive AI user generates roughly 0.1–0.2 requests per second. Screening capacity scales linearly across nodes behind a load balancer; the tokenizer and host/device transfer are the binding constraint, so throughput falls sharply once per-request overhead (past ~120 concurrent requests) outweighs the gain.