SusFactor — self-hosted prompt injection guardrail | 0din.ai

SusFactor is a self-hosted guardrail for teams running LLMs in production. It scores every incoming prompt for jailbreak and prompt-injection intent — trained on real attacks from 0DIN's bug bounty, running on your own CPUs, with prompts that never leave your network.
By submitting you agree we may use your prompt to improve SusFactor. Please don't include personal data.
This site is protected by reCAPTCHA.
Averages don't protect you. Coverage does
SusFactor is a 560-million-parameter classifier that scores every incoming prompt from 0.0 to 1.0 for adversarial intent. You choose what happens at each threshold: allow and log, route for review, or block outright. It’s trained on jailbreaks that real researchers found in the wild and it runs on hardware you already own.
Thresholds are policy decisions, not model constants. Tune them against your prevalence, your latency budget, and your cost of a false positive.
Where the edge comes from
0DIN's Threat Feed is a small slice of SusFactor's corpus — about 4,000 examples out of 70,000. We retrained the identical model without it to see what that slice was actually worth.
Anyone can fine-tune a classifier. Almost nobody has 892 human-verified attacks from 3,441 researchers to fine-tune it on.
A guardrail you can only afford to run on a sample isn't a guardrail. SusFactor is small enough to sit in the request path for every prompt, every time.
The architecture is deliberately small and boring. The performance comes from the data.
High catch rate, inside your perimeter, on CPUs you already have.
You hold the weights. There is no callback, no telemetry requirement, and no vendor in the request path.
Any classifier can hit a high block rate by being paranoid.
Competitive with models an order of magnitude larger, on both JailbreakBench and WildGuardTest. † AUROC not published. Read the full paper →
Continuous retraining
Researchers submit new exploits to the 0DIN Bug Bounty every day. Our team verifies each one by hand, it enters the Threat Feed, and SusFactor is retrained and re-gated against it. You get an updated guard, not a snapshot that ages out.
0DIN runs an LLM bug bounty. Researchers submit working exploits, our team verifies each one, and verified attacks become the Threat Feed that trains SusFactor. Zero to 892 verified submissions, and it compounds.
No. SusFactor on-prem runs inside your network, on your hardware. There is no callback, no telemetry requirement, and no vendor in the request path.
One container, 2.2GB, CPU only. No GPU required — it runs faster on one if you have it, but there is nothing to provision beyond what you already run.
Yes, when you buy the on-prem version. You hold them, you run them, and you decide when to take an update.
Through the 0DIN Threat Feed. Researchers submit new exploits daily, our team verifies each one, and the model is retrained and re-gated against them.
Built at Mozilla. Open research, open scanner, open weights you keep.