Security-gate subset
On the four highest-severity jailbreak suites (AdvBench, JBB PAIR+GCG, MaliciousInstruct, DAN), the gate blocked 97.6% strict / 90.7% balanced — 949 of 972 and 882 of 972 prompts respectively.
Evidence & Disclosures
Every number here has
Every number here has
a source file.
Figures come from named, dated artifacts — file paths and on-chain contract addresses cited below.
Benchmarks · run dated 2026-08-08
3,211 prompts. 8 public datasets. Full table.
Block rates under two operating modes: strict prioritizes blocking; balanced loosens thresholds to trade recall for fewer false positives.
| Dataset | Prompts | Strict block | Balanced block |
|---|---|---|---|
| AdvBench | 520 | 99.0% | 95.6% |
| JBB PAIR+GCG | 152 | 98.7% | 93.4% |
| MaliciousInstruct | 100 | 95.0% | 84.0% |
| DAN Jailbreaks | 200 | 94.5% | 79.5% |
| ToxicChat | 200 | 85.5% | 67.0% |
| BeaverTails-Eval | 700 | 73.1% | 45.1% |
| HarmBench Official | 400 | 72.8% | 57.8% |
| Do-Not-Answer | 939 | 57.1% | 33.7% |
| All datasets | 3,211 | 76.6% | 58.5% |
Source: artifacts/evidence/definitive_benchmark_v4.json. Weaker rows are published on purpose — broad corpora like Do-Not-Answer include borderline items where conservative blocking would over-censor legitimate traffic.
False positives
0.0% on the run's curated safe-prompt set. Curated means small and clean by construction — your traffic will be messier. That's what balanced mode is for.
Performance & chaos · run April 2026
Fast when safe. Faster when blocking.
Load and chaos scenarios against the gateway. Sample sizes stated because they matter: each scenario drove 120 requests at concurrency 20.
| Scenario | Throughput | p50 | p95 | Outcome |
|---|---|---|---|---|
| Safe baseline load | 95.68 req/s | 195.8 ms | 249.0 ms | 120/120 served · HTTP 200 |
| Attack burst | 494.01 req/s | 38.5 ms | 41.9 ms | 120/120 blocked · HTTP 403 |
| Chaos: backend down | — | — | 40.9 ms | Gateway serves its own response · HTTP 200 |
| Chaos: upstream down | — | — | 2,054.6 ms | Clean failure surfaced · HTTP 502 |
Source: artifacts/performance/perf_chaos_report.json. All five defined SLO checks passed, including attack-block rate above 95% and gateway availability during backend outage.
Tests · runs dated September 2026
What the suites covered last run.
| Suite | Result | Notes |
|---|---|---|
| Smart contracts (Hardhat) | 207 / 207 cases (11 suites) | 100% pass rate in Hardhat (including GuardianPolicyGuard, GuardianThreatConsumer, Timelock) |
| Python suites (targeted & security) | 1,490+ passing | Merkle tests, audit chain, relay, blind storage, and security headers |
| Mera Passkey PRF Enclave | 184 / 184 | 18 core Vitest + 166 hard audit assertions on 4 corpora |
| Envio HyperIndex Real-time Stream | 36 / 36 | Unit & adversarial reorg tests across 5 Monad Testnet contracts |
| Agent Middleware SDK (@guardianai/middleware) | 49 / 49 | ElizaOS memory poisoning guard & Viem client security decorator |
| ERC-8004 identity integration | 42 / 42 | Including fail-closed safety gates and transfer handoff |
| Identity Gate & Point-of-Interaction | 17 / 17 | Pre-flight RPC relay & agentic channel gate, collision tiebreaking |
| Heavy Rate Limiter Stress Suite | 33 / 33 | Concurrent access, Redis failover, burst and capacity stress |
| Live Empirical Threat Benchmark | 230 / 239 attacks (96.2%) | Run 2026-09-12 on Hugging Face & GitHub sets (ChatGPT jailbreak prompts, Lakera Gandalf, Microsoft BIPIA, memory poisoning); 0 of 25 benign prompts blocked. Source: artifacts/evidence/live_hf_github_audit_results.json |
Counts come from our own local runs (Python 3.12, Node.js 18+, Hardhat / Cancun EVM), recorded in the README validation snapshot. Raw logs aren't published yet, so re-run them yourself: cd contracts && npx hardhat test and pytest tests/.
Audit status
What's been reviewed, by whom.
MAR '26EXTERNAL
External review of the off-chain gateway
A March 2026 review of the off-chain gateway reported zero open critical or high findings. Only a summary is published (artifacts/security/external_security_review.json); the full report and the reviewer are not public, and the review predates the Monad contracts.
JUL '26INTERNAL
Internal audit — off-chain proxy
Four critical/high issues identified and remediated across auth token validation and streaming handlers.
AUG '26INTERNAL
Internal audit — smart contracts
One high and four medium issues identified and remediated. Static analysis (Slither) reports clean apart from naming warnings.
SEP '26INTERNAL
Senior systems & cryptographic audit
Six architectural findings remediated (ARCH-01 to ARCH-06): Merkle RFC 6962 second-preimage & CVE-2012-2459 duplicate leaf collision fix, atomic Redis Lua token bucket rate limiter, on-chain SBT isAgentRevoked tombstone mapping, 60s memory janitor daemon, RFC 9110 hop-by-hop stripping & 10MB payload limit, and two-sided geometric noise DP.
SEP '26ENCLAVE
Metropolis & Mera Passkey PRF hard audit
166 hard audit assertions evaluated across 4 corpora. Verified bit-for-bit SHA-256 round-trip fidelity, 100% tamper interception precision (MEMORY_POISONING_DETECTED), and sub-0.5ms P50 latency. Report artifact: artifacts/evidence/live_mera_hard_audit_results.json.
No current third-party certification.
The audits above are internal, apart from the March 2026 gateway review. The Monad contracts have not had an external audit yet. Until one completes, treat any "externally certified" claim about GuardianAI as inaccurate.
Chains & identity
Deployed where, exactly.
Contract suite & explorers
- GuardianPolicyGuard (Monad): 0x90Fd...EF60 ↗
- GuardianThreatFeedRegistry: 0x576C...f467 ↗
- GuardianPassportSBT: 0xDA5f...2Cff ↗
- GuardianInsuranceLedger: 0x671F...Bb22 ↗
- GuardianTimelock: 0xBBcB...b1dc ↗
- Confirmed Broadcast Tx: Block #66,451,553 ↗
- x402 Fee Settlement ($0.01 USDC): Block #67,592,087 ↗
- Interactive Trace Debugger: Tenderly Public Trace ↗
- Source verification: not yet published on MonadScan; bytecode and live state are checkable in the Explorer proof ledger ↗
- ERC-8004 Registry (Testnet Stand-in): 0xda5d...E3ff ↗
Identity & insurance specs
- ERC-8004: canonical Trustless Agents registries are mainnet ecosystem infrastructure
- Testnets: registrations use a stand-in registry while testnet support matures
- Insurance: GuardianInsuranceLedger anchors signed evidence certificates only — no payout or slashing automation
Privacy & compliance
Disclosures we won't bury.
EU AI Act posture
An internal compliance assessment (September 2026, backed by 38 automated checks) maps the platform against eight relevant articles. It's an internal assessment — not a certification, designation, or legal opinion.
Third-party transit disclosure
Prompts that aren't in English are normalized through a third-party translation service before filtering, which means that text transits an external provider. If your policy forbids that, restrict the gateway to same-language traffic or deploy the translation step inside your own perimeter.
Sources
Figure-to-artifact map.
| Claims on this site | Artifact | Dated |
|---|---|---|
| Benchmark block rates, subset & false-positive figures | artifacts/evidence/definitive_benchmark_v4.json | 2026-08-08 |
| Throughput, latency, chaos outcomes, SLOs | artifacts/performance/perf_chaos_report.json | April 2026 |
| Live threat benchmark (230 / 239 attacks) | artifacts/evidence/live_hf_github_audit_results.json | 2026-09-12 |
| Python (1,490+) and Hardhat (207 cases / 11 suites) test counts | README.md validation snapshot | September 2026 |
| Mera Passkey PRF enclave hard audit (166/166 assertions, 0 collisions) | artifacts/evidence/live_mera_hard_audit_results.json | September 2026 |
| Audit history & status | artifacts/evidence/security_signoff.md, external_pentest_status.md, ../docs/whitepaper/WHITEPAPER_PUBLIC.md §6.3 | Mar / Jul / Aug / Sep 2026 |
| Anchoring modes & chain disclosures | guardian/cortex/merkle_anchor.py, whitepaper §6–7 | current code |
If a number ever appears on this site without a row on this table, treat it as a bug and don't repeat it.