--- title: "Research · Highflame" description: "Highflame Research, adversarial findings, threat analysis, and original work on agent identity, authorization, and runtime security." doc_version: "0.1.0" last_updated: "2026-07-25T03:14:58.002Z" canonical: "https://www.highflame.com/research" --- ▸ RESEARCH # Highflame Research. Original work on agent identity, authorization, and runtime security, adversarial findings, threat breakdowns, and the research that powers every safeguard we ship. ▸ PUBLISHED RESEARCH ## Peer-reviewed work behind the models The transformer architectures powering Highflame's in-house guardrail models, published in full, with how each benchmarks against the field. Pulse · arXiv:2506.07330 ### JavelinGuard: Low-Cost Transformer Architectures for LLM Security Compact, stateless guardrail models (~110M to 450M params) for single-request analysis. Over 95% F1 on prompt injection at sub-100ms latency. [Read on arXiv →](https://arxiv.org/abs/2506.07330) How Pulse compares: state-of-the-art accuracy at a fraction of the latency and footprint. Model Avg latency (CPU) Size (params) Injection F1 Edge Pulse ~47ms ~450M ~95.3% Excellent DeBERTa-v3-base (tuned) ~80-150ms ~184M ~93-95% Excellent LlamaGuard (7B) ~500-1000ms+ ~7B High (context-dependent) Poor Large commercial LLM API (e.g. GPT-4) ~1000-3000ms+ Billions+ High (slow, costly) Not applicable DeepContext · arXiv:2602.16935 ### DeepContext: Stateful Real-Time Detection of Multi-Turn Adversarial Intent Drift in LLMs Stateful, multi-turn guardrails that track conversational intent drift in real time, catching attacks that single-request filters miss. [Read on arXiv →](https://arxiv.org/abs/2602.16935) How DeepContext compares: recurrent intent-tracking beats repetitive large-model inference on multi-turn attacks. Model Multi-turn F1 Avg latency (T4 GPU / API) Defense strategy DeepContext 0.84 ~19ms Stateful (RNN / GRU) Granite-Guardian-3.3 (8B) 0.67 ~125ms Stateless (LLM) GPT-5 Nano 0.63 ~317ms (API) Stateless API LlamaGuard 4 (12B) 0.51 ~43ms Stateless (LLM) AWS Prompt Attack Guardrails 0.38 ~235ms (API) Stateless API Azure Prompt Shield 0.19 ~77ms (API) Stateless API ▸ WHITEPAPERS ## Whitepapers Long-form technical papers on the architecture behind the fabric. Leave your details and we'll send the PDF over. - ACF-001 ### The Agent Control Fabric The identity, policy, and enforcement substrate for production agents, and why retrofitting human IAM and API gateways into the job they were never built for does not compose. 20 pages. Get the white paper ✕ ▸ TECHNICAL WHITE PAPER ## The Agent Control Fabric Tell us where to send it. Name Work email Company Email it to me We'll use this only to send the paper and the occasional product update. Unsubscribe anytime. - ID-001 ### Agent Identity: A Technical White Paper The Highflame Identity layer in depth: delegated authority, scope attenuation, DPoP sender-constrained tokens, CIBA human approval, and cascade revocation. Companion paper to ACF-001. Get the white paper ✕ ▸ TECHNICAL WHITE PAPER ## Agent Identity: A Technical White Paper Tell us where to send it. Name Work email Company Email it to me We'll use this only to send the paper and the occasional product update. Unsubscribe anytime. ▸ RESEARCH NOTES ## From the research blog Adversarial findings, threat breakdowns, and field notes from the team. [ ![](/blog/mission-drift-why-ai-agents-fail-at-step-100/hero.png) RESEARCHMay 19, 202612 min ## Mission Drift: Why AI Agents Fail at Step 100 Description: AI agents do not always fail with a crash. They drift. Learn why Step 1 testing and passive observability cannot stop Mission Drift, and how Highflame Compass provides runtime enforcement to keep autonomous agents aligned through Step 100. Read the paper → ](/blog/mission-drift-why-ai-agents-fail-at-step-100.md) - [ ![](/blog/when-ai-monitors-betray-you/hero.png) Apr 22, 20269 min ### When AI Monitors Betray You: The Failure of LLM-as-Judge Architectures A new Berkeley study shows AI models will lie, cheat, and sabotage tasks to protect other models. This breaks LLM-as-judge architectures and exposes a critical flaw in AI safety. Here’s why deterministic guardrails are now essential. ](/blog/when-ai-monitors-betray-you.md) - [ ![](/blog/why-metas-ai-alignment-director-couldnt-stop-her-own-agent--and-how-to-fix-it/hero.png) Apr 15, 20263 min ### Why Meta’s AI Alignment Director Couldn't Stop Her Own Agent, and How to Fix It A technical breakdown of Summer Yue’s 2026 OpenClaw incident. Learn why "in-band" prompt engineering fails and how ZeroID provides out-of-band deterministic control for agents. ](/blog/why-metas-ai-alignment-director-couldnt-stop-her-own-agent--and-how-to-fix-it.md) - [ ![](/blog/securing-intent/hero.png) Feb 24, 20265 min ### Securing Intent : The Next Frontier in AI Agent Protection As agents gain autonomy and multi-step reasoning becomes the norm, security systems must evolve from snapshot classifiers to trajectory-aware monitors. Because in agent systems, risk isn’t a single moment. It’s a direction. And direction can only be detected if your security layer remembers where you’ve been. ](/blog/securing-intent.md) - [ ![](/blog/agent-context-graphs-semantic-intelligence-safe-autonomy/hero.png) Jan 19, 20265 min ### Agent Context Graphs and Safe Autonomy Why logs fail for agentic AI and how context graphs and semantic intelligence create a system of record for governing autonomous systems. ](/blog/agent-context-graphs-semantic-intelligence-safe-autonomy.md) - [ ![](/blog/why-enterprise-ai-agent-security-cant-rely-on-platform-providers-alone/hero.png) Sep 03, 20256 min ### Why Enterprise AI Agent Security Can’t Rely on Platform Providers Alone 73% of enterprises face AI security incidents. Platform-native tools miss runtime threats and compliance. Learn why specialized AI agent security is essential. ](/blog/why-enterprise-ai-agent-security-cant-rely-on-platform-providers-alone.md) - [ ![](/blog/why-gpt-5s-capabilities-are-a-double-edged-sword-for-enterprise-security/hero.png) Aug 21, 20253 min ### Why GPT-5’s Capabilities Are a Double-Edged Sword for Enterprise Security With GPT-5, enterprises gain new automation and reasoning potential, but attackers move just as fast. See how Highflame secures agents and MCP-connected tools ](/blog/why-gpt-5s-capabilities-are-a-double-edged-sword-for-enterprise-security.md) - [ ![](/blog/5-blackhat-2025-takeaways-on-ai-automation-security/hero.png) Aug 15, 20254 min ### 5 Blackhat 2025 Takeaways on AI & Automation Security Secure AI models, agents, and pipelines with governance, identity-aware access, runtime protections, AI-vs-AI detection + model hardening, and human-in-the-loop controls. ](/blog/5-blackhat-2025-takeaways-on-ai-automation-security.md) - [ ![](/blog/top-5-takeaways-for-cisos-from-rsac-2025-66as2/hero.png) May 13, 20254 min ### Top 5 Takeaways for CISOs from RSAC 2025: From RSAC 2025: AI security demands a full-lifecycle strategy, identity is now the new perimeter, and open-source collaboration is reshaping threat defense. Explore five key insights every CISO needs to navigate the evolving landscape of enterprise and AI security. ](/blog/top-5-takeaways-for-cisos-from-rsac-2025-66as2.md) FROM RESEARCH TO ENFORCEMENT ## The findings ship as controls. Every result here turns into detection and policy in the fabric, then we re-scan to prove the fix. [Book a demo](/contact.md) [Explore the platform](/platform.md) ## Sitemap Full site map: [/sitemap.md](https://www.highflame.com/sitemap.md). Machine index: [/sitemap-index.xml](https://www.highflame.com/sitemap-index.xml).