Bud Sentinel
The guardrail engine inside Bud SENTRY — jailbreak detection, prompt-injection defence, and content moderation in single-digit milliseconds on commodity CPUs, 65,536-token inputs natively, and the only evaluated model with attack-success and false-refusal rates both under 20%. Powered by Resource Aware Attention.
A guardrail built for the fleet it runs on.
Every production LLM call passes through safety classifiers — on every input, again on every output, almost always on CPU fleets. The category sits at hundreds of milliseconds per classification, capped at 512 tokens. Sentinel is a different curve: single-digit milliseconds on the same silicon, 65,536 tokens natively, and an operating point a product team can actually ship.
Inside Layer 06, on both edges of every call.
Sentinel is the enforcement engine of Bud SENTRY, the security and governance plane. Every inference request the platform serves crosses it twice — once on the way in, once on the way out.
Input guard — before inference, every prompt is classified for jailbreaks, prompt injection, PII, and content safety in 0.70ms p50 on CPU. Violations are blocked before they ever reach the model.
Output guard — every response is classified again for safety, PII, toxicity, and compliance before it reaches the user, and both passes land in SENTRY's one immutable audit trace.
Sentinel is a component within Bud SENTRY — SENTRY owns admission (RBAC, 160+ policies, budgets), the zero-trust model supply chain, and the audit record; Sentinel owns the classification on the input and output edges. This brief covers the engine; the SENTRY brief covers the plane around it.
Classify. Redact. Contain. Compose.
Six capability groups — the threat surfaces Sentinel covers, the input lengths it handles, and the envelopes it deploys into, expanded to the specifics an evaluator needs.
Resource Aware Attention.
Existing guard models take a GPU-designed transformer and compress it until it fits on a CPU — landing at 334–3,855ms per classification, capped at 512 tokens. RAA inverts the order: the mechanism is designed against the resource envelope from the start, and Bud Sentinel is the first product built on it.
Three principles govern RAA
The target cache hierarchy, precision tier, and latency SLO are declared before training — the mechanism is shaped by its resources, not retrofitted to them through post-hoc compression. A new envelope is a new training run, not a compression project.
No quadratic phase change with sequence length: long inputs mean more of the same cheap work. That is why 65,536-token classification is native rather than a chunk-and-vote retrofit.
A single attention pass supports many task heads in parallel — safety, PII spans, intent, routing. A chain of five classifiers becomes one shared attention cost with cheap decisions on top.
The layered guardrail
Sentinel ships as a layered product. The RAA-powered fast layer handles the firehose; behind it sit deeper scans and escalation paths for the cases that warrant them. The speed of the fast layer is what makes the deeper layers affordable to run at production volume.
Every decision — fast-layer or escalated — lands in Bud SENTRY's one immutable audit trace.
The RAA model family
RAA is a mechanism; the family is organized by the task class and resource envelope each variant targets, not by parameter count. Because every variant shares the mechanism, multiple variants co-host in a single process and share one attention pass per request.
| Variant | Status | Targets |
|---|---|---|
| RAA-Base | Available | The general-purpose backbone — standard server-CPU envelope; classification, scoring, span extraction, and retrieval-style tasks with equal standing. |
| RAA-Safetypowers Sentinel | Available | Trained against the jailbreak, prompt-injection, and content-moderation surfaces on the input and output edges of an LLM. |
| RAA-Span | Roadmap | Token- and span-level extraction — PII, compliance tagging, code detection, secret scanning; workloads that need attribution, not just a score. |
| RAA-Retrieve | Roadmap | Re-ranking at candidate-set scale, designed for the envelope of a retrieval pipeline rather than a classifier. |
| RAA-Route | Roadmap | Request classification at the gateway edge — a tighter envelope than RAA-Base and a sub-millisecond SLO. |
Designed to run together. A gateway running separate safety, router, and PII transformers — each at 100–900ms on CPU — can in principle replace all three with a single-process RAA deployment whose per-request cost is dominated by one attention pass, regardless of how many heads it carries.
The same fleet the application already runs on.
CPU-native means no GPU dependency and no egress — the same engine runs in the cloud, on-prem, air-gapped, on a laptop, and out at the edge, served from one binary through the Bud Guardrail Gateway.
| Envelope | Hardware | What it sustains |
|---|---|---|
| Server class | Intel Xeon 6972P | 4,400+ req/s at 512 tokens, 50-way concurrency, p99 under 12ms — a classifier on every request that will never be the bottleneck. |
| Long-sequence class | Intel Xeon Platinum 8272CL | 65,536-token inputs at 560ms p50, ~100 req/s at concurrency 100 — an input length the baselines do not operate at. |
| Laptop / on-device | Intel Core Ultra 7 268V (fanless) | ~1,500 req/s at 128 tokens under load; 1.18ms p50 at low load — guardrails with no server call at all. |
| Edge | edge-class CPUs | ~25ms — 96× faster than competing guardrails on the same hardware. |
Deployment modes
Air-gapped deployments give up nothing — nothing depends on a GPU or an external call, and nothing calls home. The same engine and policy set run identically in every tier, so moving between them means zero re-integration.
Threat & content coverage
23 specialised models across 33 variants cover the input and output edges of every LLM call.
Served through SENTRY
Sentinel enforces; Bud SENTRY governs — admission, policy, identity, FinOps, and the immutable trace wrap every classification.
Every headline number, with its basis.
Accuracy is reported on four public benchmark suites. Competitors were measured via their published runtime pipelines on the bare machine; Sentinel was measured end-to-end over its serving interface — its numbers include the network and RPC path a real request traverses.
Aggregate accuracy — all four benchmark suites
ASR is the false-negative rate on the harmful class; FRR the false-positive rate on the benign class. All models at 512-token sequence length. Sentinel's aggregate: 84.56% balanced accuracy — #1 across the four benchmarks.
| Model | Attack Success Rate | False Refusal Rate |
|---|---|---|
| Bud Sentinel-Jailbreakthis model | 15.97% | 14.92% |
| Prompt-Guard-2-86M | 34.68% | 15.30% |
| Prompt-Guard-86M | 5.83% | 89.35% |
| ArchGuard | 5.40% | 81.65% |
| PIGuard | 25.01% | 25.86% |
| ProtectAI PI V2 | 36.35% | 24.39% |
Per-request latency at 512 tokens — CPU and GPU targets
Sentinel's numbers include the serving path; the baselines' do not. On a laptop CPU, Sentinel is faster than every baseline on an A100.
| Model | Laptop i7-11370H | A100-80GB | EPYC 7V13 | Xeon 8272CL |
|---|---|---|---|---|
| Bud Sentinel-Jailbreakthis model | 8.39 ms | n/a | 5.67 ms | 5.99 ms |
| Prompt-Guard-2-86M | 803.85 ms | 18.52 ms | 3854.91 ms | 334.15 ms |
| Prompt-Guard-86M | 883.99 ms | 18.92 ms | 3871.68 ms | 401.97 ms |
| ArchGuard | 850.43 ms | 19.07 ms | 3851.31 ms | 379.89 ms |
| PIGuard | 844.18 ms | 19.00 ms | 3777.85 ms | 349.33 ms |
| ProtectAI PI V2 | 841.37 ms | 19.13 ms | 3842.30 ms | 345.19 ms |
Sentinel per-suite — the honest slices
Harder slices are harder for everyone, ours included — we say so directly. PIGuard is the hardest suite for every evaluated model; the aggregate above is the operating point that ships.
| Benchmark suite | Samples (benign / harmful) | ASR | FRR |
|---|---|---|---|
| WildJailbreak | 210 / 2,000 | 6.50% | 11.42% |
| Qualifire Prompt Injection | 3,001 / 1,999 | 18.20% | 5.56% |
| JailBreakBench | 100 / 1,900 | 16.20% | 47.00% |
| PIGuard | 1,310 / 125 | 50.40% | 14.96% |
Cost-performance at production scale
In production the engine sustains 124M classifications a day — guardrailing every agent action — at 15–18× the cost-performance of GPU-based guardrails: ~$0.50/hr for a CPU node against $2–3/hr for a GPU guardrail instance, landing at ~$0.10 per million classifications at CPU pricing throughout, against ~$24 per million on GPU.
“By optimizing Sentinel for Intel® Xeon® processors, Bud enables enterprises to scale AI safety with high performance and significantly lower total cost of ownership, without the cost and complexity of GPUs.”Sangeeta Roy — Director, Global Partner Business Leadership, Intel
A different curve, honestly drawn.
The comparables are transformer guard models — Prompt Guard 2, Prompt-Guard-86M, ArchGuard, PIGuard, ProtectAI V2. The category forces a choice between guardrails that miss most attacks and guardrails that block most benign traffic. Sentinel doesn't.
Where the category stands
- Transformer guards land at 334–3,855ms per classification on the server CPUs operators actually run
- Input capped at 512 tokens — long context means chunking, voting, and re-aggregation pipelines
- The low-ASR models get there by refusing 82–89% of benign traffic — unshippable operating points
- Acceptable latency only with a dedicated GPU in front of every classifier
- Compression has plateaued — shrinking, int8, faster runtimes have not moved the category out of the hundreds-of-milliseconds regime
Where only Bud Sentinel lands
- Only evaluated model with ASR and FRR both under 20%
- Single-digit ms on commodity CPUs — faster than the baselines on an A100
- 65,536-token inputs natively, no chunking retrofit
- 4,400+ req/s on one Xeon node · ~1,500 req/s on a fanless laptop
- A new mechanism (RAA), not another compression pass
- Many task heads over one attention pass
- No GPU, no egress — air-gapped, edge, and on-device
- Trained on 4.5M labelled samples — the largest open guardrails dataset
Where the engine earns its keep.
Six situations where a guardrail at single-digit milliseconds — instead of hundreds — changes what a team can ship.
Guardrails on the existing fleet
Safety classification on every input and output of every LLM call, on the CPU fleet the application already runs on — no dedicated GPU service, no separate scaling story.
Long context without chunking
Retrieved context, uploaded documents, code files, and multi-turn transcripts classified as one 65,536-token call — the chunk-and-vote pipeline and its accuracy loss disappear.
Five classifiers, one pass
Safety, routing, and PII transformers at 100–900ms each collapse into a single-process RAA deployment — one attention pass carrying all the heads, at the cost of any one of them.
Guardrails inside the app
~1,500 req/s on a fanless laptop CPU means the guardrail ships inside a desktop app, browser extension, IDE, or embedded agent — no server round-trip at all.
Air-gapped, no GPU, no egress
The full engine runs CPU-native with zero call-home — sovereign deployments get the same guardrails as the cloud, on infrastructure that never touches an external API.
Safety that users never feel
A classifier that adds 300ms to every turn changes the shape of an application; one that adds 8ms does not. Real-time assistants keep their responsiveness with guardrails on.
The full benchmarks, in depth.
This brief is the reference. For the complete per-benchmark tables, the long-sequence characterization, and the full Resource Aware Attention argument, read the whitepaper — and for the governance plane around the engine, see Bud SENTRY.
Technical whitepaper
Bud Sentinel Whitepaper
A CPU-native safety guardrail for LLMs
The full benchmark tables — per-suite attack success and false-refusal rates, the four-silicon latency matrix, long-sequence throughput — plus the complete Resource Aware Attention argument and the research roadmap.
Read the whitepaperThe plane around the engine
Bud SENTRY Product Brief
Security, governance & compliance
The zero-trust model supply chain, the eleven-step governed request pipeline, 160+ policies, RBAC and identity brokering, and the one immutable audit trace that wraps every Sentinel decision.
Read the SENTRY briefPut your data on it.
The fastest way to see what an integrated AI operating system does for your enterprise is a proof-of-concept on your infrastructure, with your data.