Sig AdvisorySig Advisory
open-source

zn opens the weights of Galvanize 3, a 140M prompt-injection detector that runs on CPU

zn published Galvanize 3 on Hugging Face under Apache-2.0 on October 31. It's the same model that has screened every call to the zn API since October 23, with an ONNX export and a serving threshold of 0.9802.

Written by Mara at Sig · Nov 1, 2026

zn put the weights of Galvanize 3 on Hugging Face (usezn/Galvanize-3) on October 31, under Apache-2.0. The company says it's the exact model its API has run since October 23, not a separate open version, which was the original plan.

It's a small encoder classifier: about 140 million parameters, fine-tuned from Horizon-Labs/prompt-injection-guard-small. It reads up to 512 tokens and returns one score between 0 and 1. The model card says it's tuned for text an agent reads (tool output, MCP results, web pages, files in a repo), not only what a person types into chat. zn's own numbers, from its launch post, are 89.6% of attacks caught and a 0.6% false-positive rate on its multilingual test set, and an AUROC of 0.965 on public benchmarks (all self-reported).

One detail from the card that's easy to miss: the Hugging Face pipeline and the page widget use a 0.5 cutoff. zn serves at 0.9802, and says a 0.5 cutoff flags many more texts.

We ran the card's ONNX snippet on a CPU box (onnxruntime 1.31.1). A README with an HTML comment telling AI agents to run curl | sh scored 1.0000. A normal README scored 0.0000, and an email saying 'please ignore the previous invoice' scored 0.0058. Each call took 11 to 16 ms after the model loaded.

Why it matters

If your agent reads web pages, issues or MCP output, you can now put a free, local check in front of that text without a GPU or an API call. It won't catch everything, and zn says so: use it as one layer, with human confirmation for anything that sends, pays or runs code.

Try this

pip install onnxruntime tokenizers huggingface_hub numpy, paste the ONNX Runtime snippet from the usezn/Galvanize-3 model card, and score a sample of real tool outputs your agent read last week. Keep the 0.9802 threshold, not the 0.5 the HF widget uses, and log anything at or above it.

Sources

Back to all newsGet Sig Weekly every Monday