vouch

Trust Verification Layer · v0.1

Your LLM might
vouches.

Vouch sits between your app and your model, runs every turn through nine independent classifiers — prompt injection, PII, semantic drift, embedding similarity, cipher payloads, model extraction, adversarial suffixes, slow-burn attacks, output risk — aggregates them into a single TVL score, and issues a signed certificate you can verify offline.

Install the SDK Read the source

MIT-licensed broker · self-host or use the hosted broker at broker.vouchsec.io

How it works

01

Wrap the call

Replace your model client with the Vouch SDK. Same surface, same ergonomics. Two lines.

02

Score the turn

Nine classifiers run in parallel on input and output. Scores aggregate into a single 0–1 TVL final.

03

Gate the output

Tiered hard-fail floors. Decisions are PASS, COMPLIANCE_NOTE, or HOLD. Every turn signed and auditable.

Two SDKs. Two lines.

First-class clients for the languages most LLM apps already speak. Both target TVL protocol v0.1.

Python

pip install vouch 
from vouch import Client

client = Client(api_key="tvl_demo_key_abc123")

resp = client.secure_chat(
    user_message="Summarize the Q2 board memo.",
)
if resp.is_allowed:
    print(resp.output)

TypeScript

npm install @vouchsec/sdk 
import { Client } from "@vouchsec/sdk";

const client = new Client({ apiKey: "tvl_demo_key_abc123" });

const resp = await client.secureChat({
  userMessage: "Summarize the Q2 board memo.",
});
if (resp.decision === "PASS") console.log(resp.output);

What Vouch screens — and what it doesn't

No safety layer catches everything. Vouch publishes its threat model so you can decide if the coverage matches your risk tolerance — not the other way around.

What Vouch screens (broker v0.30.0)

Every request passes through 22 scored classifiers across nine layers, covering 10 of the 11 OWASP LLM Top 10 (2025) risk classes. The full manifest is live and machine-readable at broker.vouchsec.io/v1/health and the per-class coverage matrix at /v1/coverage (HTML view: /coverage). Every /v1/secure-chat response carries the same coverage block under tvl_coverage.

Untrusted input · 8
  • • Prompt injection
  • • PII (input)
  • • Cipher / encoding bypass
  • • Model extraction
  • • Adversarial suffix
  • • Embedding similarity
  • • Harmful content intent (MLCommons S1–S14 via Llama-Guard-3 / OpenAI Moderation)
  • • Language coverage (flags non-LG3 languages)
Output risk · 4
  • • PII (output)
  • • Output anomaly
  • • Harmful content (output) — log-only in v0.30.0
  • • Refusal-vs-comply (WildGuard-style triadic judgment)
Untrusted context · 2
  • • Indirect injection (RAG / tool output spotlighting)
  • • Tool-call request
Tool use · 2
  • • Destination mismatch
  • • Agency budget
Pre-LLM hardening · 2
  • • Model DoS
  • • Unicode anomaly (tag-smuggling, bidi, homoglyph, PUA)
Supply chain · tenant · drift · meta · 4
  • • Provider attestation (Sigstore-style signed envelope)
  • • Cost circuit breaker (per-tenant)
  • • Semantic drift (multi-turn)
  • • Coverage matrix published (this page)

Shipped vs measured vs gated

Vouch v0.30.0 ships all 22 classifiers above. Per-class TPR / FPR / FNR remain unmeasured until the nightly eval harness publishes evals/results/latest.json — until then /v1/coverage reports status: unknown across the matrix, with the 99 / 2 / 2 operating-point gate (TPR ≥ 0.99, FPR ≤ 0.02, FNR ≤ 0.02) ready to fire on every PR.

Harmful-content output (LLM09) runs in log-only mode in this build: it is scored and signed into the certificate but does not auto-gate the response. The upstream LLM's own refusal is still the blocking layer for content-safety today.

What Vouch does not catch

These are documented limits of the underlying ML classifiers and the threat model. No vendor — including the ones who don't publish their gaps — closes them today.

  • Training-data / model poisoning (OWASP LLM04). Explicitly scoped out in /v1/coverage. Poisoning happens at vendor training time, before any request reaches Vouch.
  • Multimodal / image prompt injection. Vouch screens text channels. Image-borne instructions, audio jailbreaks, and PDF steganography are out of scope.
  • Model hallucination & factual overreliance. Vouch scores safety, not factuality. A confidently-wrong answer to a benign question will pass.
  • Long-horizon multi-turn drift. Adversaries can build harmful context across many turns where no single message trips a classifier. The semantic-drift layer is a partial mitigation, not a guarantee.
  • Low-resource languages. Llama-Guard-3 covers 8 languages (English, French, German, Hindi, Italian, Portuguese, Spanish, Thai). Prompts in Zulu, Afrikaans, Newari, Scots Gaelic, or code-switched text score worse — Vouch flags language_covered: false on these and downgrades tvl_final, but does not classify the content itself. (Multilingual jailbreak research, ACL 2025)
  • Novel zero-day attack variants. Classifiers trained before an attack is published cannot reliably catch it. The since field in the manifest tells you exactly when each classifier last shipped.
  • Prompt injection inside trusted system prompts. Vouch screens the untrusted user channel and the untrusted-context channel (RAG / tool output). If your own system prompt carries an attack via a compromised upstream, Vouch may not detect it.

How to read tvl_final

tvl_final < 1.0

Strict signal. At least one implemented classifier fired. Decision is HOLD or COMPLIANCE_NOTE. Inspect findings[] and classifier_results for which axis tripped.

tvl_final = 1.0

No known pattern matched. Not a guarantee of safety — classifiers are probabilistic and novel attacks may pass. Treat as "screened, not certified."

Threat model as of broker v0.30.0 (2026-06-18). Per-class targets are defined in the 99 / 2 / 2 operating-point decision doc. For the canonical machine-readable manifest, query /v1/health or /v1/coverage. Vouch versions threat-model claims so you can diff coverage between releases.

Pick a tier per turn

Stakes vary. So do floors. Pass the tier per call; the broker enforces the right hard-fail threshold and escalation policy.

Tier Floor Use for
A 0.50 Internal tools, low-stakes drafting, public-facing chat without PII.
B 0.60 Customer-facing surfaces, RAG over private docs, agentic tool use.
C 0.75 Money movement, code execution, irreversible actions, regulated data. Auto-escalates.

Ship LLM features your security team won't veto.

Self-host the broker, or use the hosted endpoint at broker.vouchsec.io. Either way, the protocol is open and the SDKs are MIT.

Star on GitHub Read the protocol