SUSFACTOR
The guardrail that knows what attackers are actually doing
SusFactor is a self-hosted guardrail for teams running LLMs in production. It scores every incoming prompt for jailbreak and prompt-injection intent — trained on real attacks from 0DIN's bug bounty, running on your own CPUs, with prompts that never leave your network.
2.2GB150msNO GPU
HOW SUS?
by Mozilla
2,587
bug bounty researchers
872
verified exploit submissions
650
on our open source scanner
at BlackHat
Context
Guardrails are judged
by their worst day
Averages don't protect you. Coverage does
Where it lives
A detector that reads the prompt
before your model does.
Input
susfactor
LLM
Output
SusFactor is a 560-million-parameter classifier that scores every incoming prompt from 0.0 to 1.0 for adversarial intent. You choose what happens at each threshold: allow and log, route for review, or block outright. It’s trained on jailbreaks that real researchers found in the wild and it runs on hardware you already own.
Thresholds are policy decisions, not model constants.
Tune them against your
prevalence, your latency budget, and your cost of a false positive.
Where the edge comes from
5% of the training data.
65 points of catch rate.
0DIN's Threat Feed is a small slice of SusFactor's corpus — about 4,000 examples out of 70,000. We retrained the identical model without it to see what that slice was actually worth.
+ threat-feed 87.9%
- threat-feed 22.5%
Anyone can fine-tune a classifier.
Almost nobody has 872 human-verified attacks from
2,587 researchers to fine-tune it on.
“We really appreciate the depth of analysis that the
0DIN product brings to AI threats.”
No guardrail tax
- 150ms
- latency on CPU
- 2.2GB
- model size - 560m params
- $0 GPU
- cost - no accelerator required
- 1
- container
A guardrail you can only afford to run on a sample isn't a guardrail. SusFactor is small enough to sit in the request path for every prompt, every time.
The architecture is deliberately small and boring. The performance comes from the data.
Fast | Reliable | Private
| Hosted APIs | Generative guards | SUSFACTOR | |
|---|---|---|---|
| Attacks blocked | 67-92% | 92-99% | 88% |
| Prompts leave your network | Yes | No | No |
| Hardware | Vendor’s | GPUs you buy | CPUs you own |
High catch rate, inside your perimeter, on CPUs you already have.
You hold the weights. There is no callback, no telemetry requirement, and no vendor in the request path.
Block attacks | Not users
Any classifier can hit a high block rate by being paranoid.
Competitive with models an order of magnitude larger, on both JailbreakBench
and WildGuardTest. † AUROC not published.
Read the full paper →
Continuous retraining
The attacks change.
So does the model.
Researchers submit new exploits to the 0DIN Bug Bounty every day. Our team verifies each one by hand, it enters the Threat Feed, and SusFactor is retrained and re-gated against it. You get an updated guard, not a snapshot that ages out.
The 0DIN Bug Bounty
We pay hackers up to $15,000 to break models
0DIN runs an LLM bug bounty. Researchers submit working exploits, our team verifies each one, and verified attacks become the Threat Feed that trains SusFactor. Zero to 872 verified submissions, and it compounds.
872 cumulative
- 2,587
- Researchers
- 872
- Verified submissions
- $15K
- Paid per exploit
Before you ask
Does any prompt data leave our environment?
No. SusFactor on-prem runs inside your network, on your hardware. There is no callback, no telemetry requirement, and no vendor in the request path.
What hardware do we need?
One container, 2.2GB, CPU only. No GPU required — it runs faster on one if you have it, but there is nothing to provision beyond what you already run.
Do we get the weights?
Yes, when you buy the on-prem version. You hold them, you run them, and you decide when to take an update.
How does it keep up as attacks change?
Through the 0DIN Threat Feed. Researchers submit new exploits daily, our team verifies each one, and the model is retrained and re-gated against them.
Try it
Built at Mozilla. Open research, open scanner, open weights you keep.