Research · Highflame
Highflame Research
Original work on agent identity, authorization, and runtime security, adversarial findings, threat breakdowns, and the research that powers every safeguard we ship.
Peer-reviewed work behind the models
The transformer architectures powering Highflame's in-house guardrail models, published in full, with how each benchmarks against the field.
JavelinGuard: Low-Cost Transformer Architectures for LLM Security
Compact, stateless guardrail models (~110M to 450M params) for single-request analysis. Over 95% F1 on prompt injection at sub-100ms latency.
How Pulse compares: state-of-the-art accuracy at a fraction of the latency and footprint.
| Model | Avg latency (CPU) | Size (params) | Injection F1 | Edge |
|---|---|---|---|---|
| Pulse | ~47ms | ~450M | ~95.3% | Excellent |
| DeBERTa-v3-base (tuned) | ~80-150ms | ~184M | ~93-95% | Excellent |
| LlamaGuard (7B) | ~500-1000ms+ | ~7B | High (context-dependent) | Poor |
| Large commercial LLM API (e.g. GPT-4) | ~1000-3000ms+ | Billions+ | High (slow, costly) | Not applicable |
DeepContext: Stateful Real-Time Detection of Multi-Turn Adversarial Intent Drift in LLMs
Stateful, multi-turn guardrails that track conversational intent drift in real time, catching attacks that single-request filters miss.
How DeepContext compares: recurrent intent-tracking beats repetitive large-model inference on multi-turn attacks.
| Model | Multi-turn F1 | Avg latency (T4 GPU / API) | Defense strategy |
|---|---|---|---|
| DeepContext | 0.84 | ~19ms | Stateful (RNN / GRU) |
| Granite-Guardian-3.3 (8B) | 0.67 | ~125ms | Stateless (LLM) |
| GPT-5 Nano | 0.63 | ~317ms (API) | Stateless API |
| LlamaGuard 4 (12B) | 0.51 | ~43ms | Stateless (LLM) |
| AWS Prompt Attack Guardrails | 0.38 | ~235ms (API) | Stateless API |
| Azure Prompt Shield | 0.19 | ~77ms (API) | Stateless API |
Whitepapers
Long-form technical papers on the architecture behind the fabric.
- ACF-001
The Agent Control Fabric
The identity, policy, and enforcement substrate for production agents, and why retrofitting human IAM and API gateways into the job they were never built for does not compose. 20 pages.
- ID-001
Agent Identity: A Technical White Paper
The Highflame Identity layer in depth: delegated authority, scope attenuation, DPoP sender-constrained tokens, CIBA human approval, and cascade revocation. Companion paper to ACF-001.
From the research blog
Adversarial findings, threat breakdowns, and field notes from the team.
Mission Drift: Why AI Agents Fail at Step 100
Description: AI agents do not always fail with a crash. They drift. Learn why Step 1 testing and passive observability cannot stop Mission Drift, and how Highflame Compass provides runtime enforcement to keep autonomous agents aligned through Step 100.
Read the paper →When AI Monitors Betray You: The Failure of LLM-as-Judge Architectures
A new Berkeley study shows AI models will lie, cheat, and sabotage tasks to protect other models. This breaks LLM-as-judge architectures and exposes a critical flaw in AI safety. Here’s why deterministic guardrails are now essential.
Read the paper →Why Meta’s AI Alignment Director Couldn't Stop Her Own Agent, and How to Fix It
A technical breakdown of Summer Yue’s 2026 OpenClaw incident. Learn why "in-band" prompt engineering fails and how ZeroID provides out-of-band deterministic control for agents.
Read the paper →Securing Intent: The Next Frontier in AI Agent Protection
As agents gain autonomy and multi-step reasoning becomes the norm, security systems must evolve from snapshot classifiers to trajectory-aware monitors. Because in agent systems, risk isn’t a single moment. It’s a direction. And direction can only be detected if your security layer remembers where you’ve been.
Read the paper →Agent Context Graphs and Safe Autonomy
Why logs fail for agentic AI and how context graphs and semantic intelligence create a system of record for governing autonomous systems.
Read the paper →Why Enterprise AI Agent Security Can’t Rely on Platform Providers Alone
73% of enterprises face AI security incidents. Platform-native tools miss runtime threats and compliance. Learn why specialized AI agent security is essential.
Read the paper →Why GPT-5’s Capabilities Are a Double-Edged Sword for Enterprise Security
With GPT-5, enterprises gain new automation and reasoning potential, but attackers move just as fast. See how Highflame secures agents and MCP-connected tools.
Read the paper →5 Blackhat 2025 Takeaways on AI & Automation Security
Secure AI models, agents, and pipelines with governance, identity-aware access, runtime protections, AI-vs-AI detection + model hardening, and human-in-the-loop controls.
Read the paper →Top 5 Takeaways for CISOs from RSAC 2025:
From RSAC 2025: AI security demands a full-lifecycle strategy, identity is now the new perimeter, and open-source collaboration is reshaping threat defense. Explore five key insights every CISO needs to navigate the evolving landscape of enterprise and AI security.
Read the paper →
The findings ship as controls.
Every result here turns into detection and policy in the fabric, then we re-scan to prove the fix.