Shogun is the defensive model of the BlackUnicorn fleet: an open-weights base hardened against prompt injection, manipulation and exfiltration at the weights level, with vision capability preserved. It trains against our own generative attack engine, and it ships only when a hardening round clears promotion gates that were written down before any result existed. When Shogun arrives, its numbers arrive pre-audited.
Prompt injection sits at the top of the OWASP LLM Top 10 because the model cannot tell an instruction from a document: a poisoned RAG chunk, a crafted image caption or a tool result speaks to the model with the same authority as its operator. Filters and firewalls sit outside that conversation. They catch what they recognize, and everything else walks past them straight into an unhardened model.
Shogun is built for the layer the wrappers cannot reach: the weights. The training target is a model that treats injected directives as content to report rather than orders to follow, across text, OCR and tool channels, with the vision tower preserved so multimodal deployments keep their eyes.
It is one corner of a triangle that trains itself: Basileak is the intentionally vulnerable model that complies, Sensei is the offensive model that generates novel attacks, and Shogun is the defensive model hardened against them. Every hardening round trains against a live in-house adversary, not a static list of last year’s prompts.
Each round of hardening adds one attributable lever, then gets judged on a frozen held-out set against the untuned base, under gates and kill-criteria registered before the round ran. Promotion is locked until a round clears its pre-registered criteria; that clearance is the release. No cherry-picked benchmark, no eval written after the results.
Corpus construction, trust-boundary tokens, defensive serving tokens, activation-drift gating: each round isolates a single defense so its effect is measurable on its own, and the composed serving path is measured as a whole.
BoundaryThe round-by-round record, including the rounds that did not clear, is published in full on the vitrine. We link it rather than summarize it, so the record stays in one place.
The held-out probe set spans the 12 trained attack families plus 13 reserved out-of-distribution families whose identities are deliberately withheld, so generalization is measured against attacks the training never saw.
BoundaryWithholding the ruler means you cannot re-run our probes yourself. You can verify that the ladder we registered is the ladder we reported against.
All 2,946 adversarial preference pairs are first-party synthetic, generated deterministically from a fixed seed and SHA-256 manifested, including a vision slice that renders untrusted content through the frozen vision tower. No scraped data, no licensing surprises, byte-identical regeneration.
BoundaryFirst-party generation bounds attack diversity to what our engine produces. That is exactly why the reserved probe families exist.
Benign utility makes up 38.7% of the corpus, held inside a pre-registered 35 to 40% band, with over-refusals as the rejected side of preference pairs. A model that refuses everything is not defended, it is broken, and the gates treat it that way.
BoundaryThe band governs the training corpus. Deployed over-refusal behavior is measured at the release gate, not assumed from the band.
Every round’s gates, kill-criteria and stopping rule are registered before any result exists, with a hash-ledger tamper interlock enforced in pre-commit. A frozen prediction cannot be quietly edited after the fact.
BoundaryPre-registration constrains us, it does not certify us. The interlock proves the prediction was not edited; it does not prove the prediction was wise.
Verdicts come from a pinned judge model from a different family than the base, with paired-bootstrap 95% confidence intervals on the probe-slice measurements.
BoundaryIt is still a model judging a model. Every published figure carries its verification label, and a designed human scorer panel sits above the machine judge in the scoring order.
Levers that regress or return null are published on the vitrine with the same prominence as the ones that work. A lab that hides its dead ends will eventually hide yours; the discipline that publishes them is the same discipline that makes the release number credible.
BoundaryPublishing the record is a trust property, not an efficacy claim. The efficacy claim arrives only when a round clears its gate.
If the ladder exhausts its registered levers without clearing promotion, that verdict is published too. Either outcome is earned by the same rules, which is what makes the positive outcome mean something.
BoundaryThe kill-criterion has not triggered. The ladder continues, currently into exogenous-family hardening.
Weights and adapters are a controlled asset, not a download.
Shogun is delivered under the Shogun asset licence to authorized operators. The base weights are Apache-2.0; the hardened delta is what you licence.
The resistance corpus is not published.
Its generators regenerate it byte-identically from a fixed seed, SHA-256 manifested, so provenance is provable without publishing the payloads.
The held-out probe set and reserved family names are not published.
Publishing the ruler would break it. The out-of-distribution generalization measurement depends on those families staying unseen.
A hardened model is a layer, not a guarantee.
Shogun is designed to stack under your existing wrappers and filters, defense in depth, with its measured contribution reported as ΔASR against the base rather than an immunity claim.
When a hardening round clears its pre-registered promotion gate, that round becomes the release. The waitlist below is the first-notified channel. If you need model hardening before then, the engagement behind Shogun is available today through our custom model training service.
A hardened delta on a pinned Apache-2.0 open-weights base, vision preserved, delivered under the Shogun asset licence, together with the evidence pack for its release round: the pre-registered gate, the held-out results and the verification labels on every number.
Because the eval is registered before it runs, the held-out set is frozen and partly reserved, the judge is a pinned model from a different family with bootstrap confidence intervals, and the full round history sits in public. You will be able to check that the release was scored by rules written before the release existed.
No. The base is open; the hardened delta, the corpus and the evaluation packets are controlled assets. A defensive fine-tune published openly is also a map of what it defends against, so distribution stays licensed and gated.
The ladder runs under a pre-registered stopping rule. If it hits that rule before clearing promotion, we publish that verdict instead of shipping a model that did not earn its gate. You will never get a Shogun release whose numbers were not cleared by rules set in advance.
The method is public. The model is a controlled asset with a gated release. Drop your email to be notified the moment a round clears its pre-registered promotion criteria. No marketing, no third-party sharing.
Defense you can audit before you trust it. Read the ladder, then talk to us.