L1
Structured signals
Native detectors check exact and context-bound patterns. These include injection signals, secrets, credentials, identifiers and risky MCP or operation patterns. Findings include their location in the input.
Patronus Ark
Local security scanners for AI applications.
Patronus Ark is the scanning core behind Patronus Protect. The library analyzes inputs such as prompts, documents, tool-call data and tool results. It turns them into local security evidence for prompt injection, data loss, personal data and agentic risks.
pip install patronus-arkcargo add patronus-ark01 · What Ark does
Turn inputs into security evidence.
Ark splits long inputs into chunks, checks exact signals and classifies more complex risks through shared model representations. Applications receive structured results on which they can build policies and decisions.
L2
Non-Transformer Decision Blocks
An NTDB uses the mmBERT representation computed once. Neural heads, LightGBM, logistic regression and class centroids are fused into an inexpensive first decision.
L3
Lion Warden
The promote gate forwards only chunks where more context is likely to help. Lion Warden runs the deeper mmBERT layers and classifies multiple security tasks with one shared transformer.
02 · Ten categories
One scan interface for content, data and agents.
Each category can be activated selectively. Results remain structured whether a native rule or a local model made the decision.
Content
01
Prompt injection
Detect manipulated or competing instructions.
02
Sensitive documents
Classify document content that needs protection.
03
Threat type
Identify the type of a detected threat.
Data
04
DLP
Find secrets, credentials and additional defined data families.
05
PII
Detect personal data with evidence spans.
06
Dynamic PII
Detect semantic entities such as people, organizations and locations.
Agents
07
Tool class
Classify the tool being used.
08
Tool action
Classify the intended action.
09
Tool tags
Determine tool metadata for downstream rules.
10
Routing intent
Detect the intent behind a routing step.
03 · Two languages
Rust core. Python without a detour.
The same engine is available as a Rust crate and an abi3-compatible Python package. Async queues are the default while synchronous scans remain available for simple integrations.
Python
pip install patronus-arkfrom patronus_ark import SecurityGateway
scanner = SecurityGateway(
categories=["injection", "dlp", "pii"],
max_level="l2",
)
scanner.warmup()
results = scanner.scan_all(text)Rust
cargo add patronus-arkuse patronus_ark::{
SecurityCategory, SecurityGateway, SecurityLevel,
};
let mut scanner = SecurityGateway::with_max_level(
vec![SecurityCategory::Injection, SecurityCategory::Dlp],
SecurityLevel::L2, None, true,
);
scanner.warmup()?;
let results = scanner.scan_all(text);04 · Operations
Controlled down to each request.
Models and scanners are not a rigid bundle. Your application decides which checks are needed for a specific context.
Execution gates
Turn level, scanners, L1 rules and model groups can be controlled per request through metadata.
Async by default
A shared result queue returns completed scans while deeper checks continue in the background.
Offline capable
Asset synchronization and runtime start are separate. L1 requires no downloads at all.
Measurable
The built-in benchmark reports accuracy, macro-F1, latency, throughput and peak RSS on the shipped samples.
05 · License
Free for community and selected projects.
Ark's source code is publicly available. We provide the full library free of charge for community projects and selected initiatives; commercial licensing is available for proprietary products.
Community license
Working on a community project, research or an initiative we should support? You can use the full Ark library free of charge.
Request a community license →Commercial license
Integrate Ark into a proprietary product without releasing that product's source under the GPL.
Discuss licensing →FAQ