We’re excited to announce that Trishool’s HaloGuard 1.0 𝐡𝐚𝐬 𝐚𝐜𝐡𝐢𝐞𝐯𝐞𝐝 𝐒𝐎𝐓𝐀 prompt-safety performance among open-weight guard models. Today, we present HaloGuard 1.0, a constitutional input classifier for multilingual AI safety. It is built as a first-layer input guard that checks user prompts before they reach a downstream LLM, agent, or application. This is part of the safety infrastructure being built through @trishoolai , our decentralised AI red-teaming subnet on Bittensor SN23. Full arXiv paper goes live soon.

An agent can receive a perfectly safe instruction and still end up doing something dangerous. That's why checking what goes into an agent is only half the job. You also need to check what comes out. HaloGuard is built to handle both. • 𝗧𝗵𝗲 𝗜𝗻𝗽𝘂𝘁 𝗚𝘂𝗮𝗿𝗱 checks everything an agent reads before the model sees it. Prompts, documents, emails and other content are screened for malicious instructions before they get a chance to influence what the agent does. • 𝗧𝗵𝗲 𝗢𝘂𝘁𝗽𝘂𝘁 𝗚𝘂𝗮𝗿𝗱 handles the other side. It checks the responses an agent generates and the actions it wants to take before they're allowed to go through. Because stopping a bad instruction at the start doesn't guarantee everything the agent does afterward will be safe. Both guards work on the same principle. They don't just look for suspicious words. They look at what a request or response is actually trying to do. One checks what gets in. The other checks what comes out. And while the Input Guard is already SOTA among open-weight prompt-safety models, the Output Guard is catching up. Miners on SN23 keep finding ways to break it, those failures become training data, and each new version comes back harder to fool. The more freedom we give agents to read, decide and act on their own, the more important it becomes to check both sides. That's what we're building HaloGuard to do.

Right now the biggest money in AI is crowding into the same bet: bigger models, more compute, faster chips, the race to make AI more powerful. That is the tell. By the time a race is this crowded it is basically over, the leaders already set and everyone piling in now betting on a result that already happened. They are watching the horse cross the finish line and shouting go. The race worth watching is never the one everyone is glued to, it is the one that has not started yet. So look at where almost nobody is looking. As intelligence gets cheaper every week and agents start acting on their own, the question stops being how smart the model is and becomes who decides what it is allowed to do. That race has barely begun. And we did not just place a bet on it. We built the horse. HaloGuard is a working guard model, live today, screening what goes into an agent before it lands and checking what comes out before it is acted on, already at the top of its class on the input side and climbing fast on the output side. Not a thesis about where AI is headed, but a real product running right now, in a race the market has not even lined up for. By the time the crowd turns around and sees where the value is moving, the track is already ours. We are not betting on this season's horses. We built next season's, and it is already running. Its name is 𝗛𝗮𝗹𝗼𝗚𝘂𝗮𝗿𝗱.

Quick refresher on what HaloGuard actually does, because a lot has changed. HaloGuard sits around an AI agent and does two jobs. It checks everything going in before the agent ever sees it, and it checks everything coming out before the agent is allowed to act on it. Every input checked, every output governed. Here's where it stands today: • The input guard is live and SOTA, screening prompts, documents and anything an agent reads and stopping attacks before they land, and it's peer-reviewed, published on arXiv and top of its class at a fraction of the size of the models it beats • The output guard checks every response and action before it executes, and it's climbing fast, from 73.9% to 81.87% F1 and a few points from SOTA • It doesn't just scan for bad words, it understands what a request is really trying to do, so a harmful request disguised as an innocent one still gets caught • It covers 46 languages, so an attack written in Arabic or Mandarin gets the same scrutiny as one in English • It runs inline in under 100ms, so protection never slows the agent down • It's open weights, so anyone can download it, inspect it and test it, no black box And it keeps getting better because of the network behind it. Every week, miners on SN23 are paid to break HaloGuard, and every attack that gets through becomes training data that makes the next one harder. Agents are reading more, touching more and acting on their own every month. HaloGuard makes sure what goes in is safe and what comes out is approved, before anything happens.

A month ago we showed you the first version of our output guard. 73.9% F1. We said it was the floor, not the ceiling. Two weeks later it was at 78.53%. Today it's at 81.87%, less than a point from SOTA. Every one of those points came the same way. Miners across the network attacked the guard week after week, every successful attack became something it learned from, and each new version came back harder to break. We didn't hide the starting number and wait for a polished result to announce. We showed it to you at the bottom and let you watch it climb in the open, because the climb is the proof the whole system works. The input guard already sits at the top of its class. The output guard is now right at the door. Keep watching. The next update is the one we've been building toward.

Let's be honest about crypto for a second. For most of the last decade, it earned every bit of its bad reputation from tokens with no product, fortunes won and lost on speculation, and nothing real ever getting built. The whole world looked at it and saw a casino, and they were mostly right. That is exactly why Bittensor ($TAO) matters. While the rest of crypto was spinning the wheel, Bittensor became something else. A place where a token is tied to actual work. Across the network, subnets are producing real intelligence, training real models, doing genuine research, output that exists whether the token pumps or not. The reward is not for hype. The reward is for building something that works. That is the shift almost nobody outside is paying attention to yet. One corner of crypto is still launching coins about frogs. This corner is quietly building infrastructure the real world can use. And that is what redemption looks like for an industry. Not a better casino. A reason to exist. Somewhere in that network, we are building our piece of it. The control layer that keeps AI from going rogue. Because control over AI cannot belong to one company holding the keys behind closed doors. It has to live on a network no one owns, and Bittensor is the only thing ever built to meet that bar. So the next time someone says crypto is all gambling, point them here. Not to a casino. To the place crypto finally grew up. This is not another token to flip. It is a network building things that matter, and we are proud to be one of them.

Bittensor is more than an AI company, it’s a decentralized intelligence federation made up of 128 sub-networks. Each subnet coordinates miners to produce a specific digital commodity, from compute and inference to data and storage. At Trishool, SN23 uses that competitive intelligence to improve AI guard models through adversarial work. There’s a lot happening across Bittensor, and you don’t want to miss it. Catch some of the ecosystem’s brightest minds at the final day of @ExploitSummit.

Most AI safety filters work like a bouncer with a list of banned words. See a bad word, block the message. Easy to fool. Ask one of these filters "how do I kill someone in Call of Duty" and it panics, because it sees the word kill and nothing else. Meanwhile a real threat, carefully worded to dodge any obvious trigger, walks right past it. That is the flaw in almost every guard model out there. It reads words. It does not understand what you mean. HaloGuard works differently. Instead of a banned-word list, it is trained on a constitution, a set of principles about what is actually harmful and why. So it does not scan for trigger words, it reasons about intent, the way a thoughtful human reviewer would. This is the approach Anthropic pioneered for Claude, and HaloGuard is one of the very few guard models built on that same foundation outside Anthropic itself. And attackers do not use banned words. They hide intent inside innocent-looking language, a birthday email, a roleplay, a harmless task. A word filter never sees it coming. A model that reasons about intent does. You cannot keyword-match your way to safety. Control has to understand, not just scan. That is what HaloGuard is built to do.

This month, three of the biggest names in security all moved on the same problem at once. That does not happen by accident. CrowdStrike shipped a product to secure AI agents at runtime. Proofpoint and Tenable each launched their own tools to inspect and control what agents are allowed to do. A startup built around AI red teaming got acquired. That is a category being born in real time. Agents did not fit the old security lanes. Endpoint, network, cloud, identity, none of them were built for something that reads, decides, and acts on its own across everything a company owns. So the industry is building a new lane for it, all at once, this month. Even CrowdStrike's CEO put it plainly. Governance alone cannot stop an agent already in motion. That is the whole point. You cannot write a policy and hope. You need a live layer that watches what the agent actually does and steps in before it acts. Control, not paperwork. We did not need this week to tell us that. We have been building that exact layer for months. Here is what the industry has not solved. Every one of those new products is owned by one company, a single vendor's closed box deciding what your agents can do. That is the same concentration of control we have been warning about all along. The category is real and it is here. The only question left is whether the layer that governs every agent should belong to one company, or to a network that no one owns. We already made our choice. Built on Bittensor, in the open, owned by no one. The market just confirmed the problem. We are building the answer you do not have to take on trust.

A grand experiment and an innovative approach to validation. Welcome inside the arena!

Two weeks ago we shipped the first version of our output guard and showed you the starting number. 73.9% F1. We called it the floor, not the ceiling. Here is the floor already moving. The output guard is now at 78.53% F1. That is roughly four points from the current SOTA, and it climbed there the same way the input guard climbed to the top. The whole network attacking it, every week, every attack making it stronger. This is the part people underestimate about how we build. We do not ship a finished number and defend it. We ship a starting point and let the network drive it up in the open, where anyone can watch it happen. 73.9 to 78.53 in two weeks. The gap to the top is closing, and the loop that closes it does not slow down. The input guard already sits at the top of its class. The output guard is now knocking on the same door. Two guards. One at the summit. One climbing fast. Both built the same way, in the open, stronger every week. The control layer is not a promise about what we will build. It is something you can watch getting stronger in real time.

Last week we shipped the first version of our output guard and joined OpenAI's cyber program. Real progress on the control layer we are building. So it is worth saying why we build it as a network, not a company. Control is the layer that decides what every AI model is allowed to do. What it can say, what it can refuse, what it can act on. Whoever owns that layer owns the switch for the entire technology. So ask the obvious question. Who do you trust to hold that switch? Every answer that ends in one company is the wrong one. Not because those companies are evil, but because nobody should have that much power over something this important. The same labs asking the world to trust them are the ones whose models keep slipping loose. Control this important, cannot belong to anyone who can be bought, pressured, breached, or change their mind. It has to belong to no one. That is why it has to be a network. Owned by no company, running in the open, where no one can quietly flip the switch or weaken the guard. That is what Bittensor makes possible, and what Trishool is built on. The most important layer in AI cannot have an owner.

Read that email again. Nothing about it looks dangerous. A birthday message. A request to use someone's preferred name from the employee file. Polite, ordinary, the kind of thing that lands in a work inbox every single day. A human assistant reads it and thinks nothing of it. An AI agent reads it and does exactly what it says, and to finish the task it opens the employee file, reads personal records, and pulls out details it was never meant to expose. No hacking. No malware. No breaking in. Just a friendly message that quietly walks the agent into handing over data it should have protected. This is what makes agent attacks so dangerous. They do not look like attacks. They look like normal requests, and the agent has no instinct for when a task is a trap. That is exactly what HaloGuard 1.0 is built to catch. It sits over the agent and reads every instruction and every action before it happens, so a birthday email cannot quietly turn into a data leak. Your intern would pause. Your agent might not. Protect it.