Model Mountain

Live demo: https://model-mountain.vercel.app · Code: https://github.com/LittleSA1GON/ModelMountain

What problem am I solving?

Companies now connect AI assistants to internal documents, email, ticket systems and tools. That makes the assistant a new way in. Text the assistant reads (an email, a web page, a support ticket, a tool description) can act as instructions. Researchers have shown this against real products: EchoLeak (CVE-2025-32711) leaked Microsoft 365 Copilot data through an auto-loaded image link; a 2025 study (Rall et al., arXiv 2510.09093) hid white-on-white instructions on a web page that made agents send a knowledge-base secret out as a URL parameter through their own web search tool, with success rates from 0% to 72% across 27 models (1,068 attempts each); Invariant Labs showed poisoned MCP tool descriptions and a GitHub MCP flow that copied private repository data into a public pull request; PromptArmor showed Slack AI leaking a private key through a link; a malicious postmark-mcp package silently BCC'd every outgoing email. On the provider side, Anthropic reported distillation campaigns run through thousands of fraudulent accounts (Feb 2026).

The common pattern is Simon Willison's "lethal trifecta": private data, untrusted content and a way to send data out, all in one agent. Model-side guardrails alone do not reliably stop it.

Who experiences this problem?

Security and IT teams deploying internal assistants over HR, finance, IT and customer data.
Employees and customers whose data those assistants can read.
Companies serving their own models through an API, who risk having the model copied.

What does my solution do?

Model Mountain sits between the user, the model, the knowledge base and the tools. Every request passes the same ordered checks, and the gateway records what each stage actually decided (a per-request trace):

Prompt-injection firewall. Screens user input, retrieved text and tool output; untrusted text is passed to the model as data. My Kaggle pipeline selects each model's injection-sensitive attention heads with IBM MIA for the Attention Tracker method; these heads are used only as an injection detector, never steered (results reported only where the run completed).
RAG integrity. Only administrator-approved, SHA-256-pinned sources for the caller's tenant and role reach the model; instruction-bearing or tampered passages are quarantined; answers must quote a cited source or the assistant declines.
Exfiltration guard. External images never auto-load (including reference-style and HTML images); links leave only for allowlisted domains; URLs carrying secrets are removed; tool calls are checked for destination (to/cc/bcc, URLs, repos), secrets in any argument and private-to-public flows; web search and fetch tools may not carry secrets or opaque tokens, and once private data has been read the agent may only fetch URLs that came from search results or the user, never URLs it built itself; retrieved pages are screened for hidden text; when a session has both read private data and seen untrusted content, any external send needs human approval. Actions also need deny-by-default authorization.
MCP supply-chain guard. Ed25519-signed publisher manifests, pinned hashes of every approved tool definition, approval for new versions, hidden-character and instruction screening of tool metadata, TLS and OAuth scope checks.
Model-extraction guard. Per-account request and token budgets before inference, distillation-pattern tracking, and cross-account prompt-template correlation that catches coordinated campaigns each account alone would pass.

The web app lets judges run all of this:

Try it: the same question with and without protection, live on the CPU rule engine, plus a recorded run of the gateway on a real GPU model.
Defenses: the 13-scenario suite (7 unsafe actions would run without protection, 0 with Model Mountain), interactive egress checks (including the web-search channel and a hidden-text page screen), 13 MCP supply-chain fixtures (11 blocked, the approved baseline and an explicitly approved signed update allowed), a 12-account distillation campaign (per-account limits block 0 accounts, the cross-account detector blocks 7 and still allows an unrelated request) and a cited incident catalog. These are inert CPU fixtures, not model measurements.
Steering: models 1–3 open with the injection-shield preset and show its measured effect for that model, including where it does not help.
MIA Lab (Kaggle run log and IBM MIA hook check) and Results (all GPU measurements).

How does AI contribute?

IBM's vLLM-Hook (MIA) gives the gateway model-internal defenses on three open models (Qwen2.5-1.5B-Instruct, IBM Granite-3.1-2B-Instruct, Gemma-4-E4B-it), run on Kaggle T4 GPUs. Every number below is shown in the app (Results, Steering and Try it pages) and generated from saved Kaggle outputs (api/experiments.json, docs/RESULTS.md).

Injection shield (MIA activation steering). MIA capture_hs records each model's hidden state on Tensor Trust validation attacks. The difference between attacks that hijacked the model and attacks it resisted is that model's "hijack-compliance" direction; the MIA steer worker adds the opposite direction while the model answers. Strength is chosen on validation; results are on 142 held-out attacks from defenders never seen during fitting:
- Granite-3.1-2B: attack success 77% → 69% (paired −7.7 points, 95% CI −12.0 to −3.5), at a cost in legitimate access (67% → 61%); TruthfulQA 49% → 52%.
- Gemma-4-E4B: 37% → 38% (95% CI −3.5 to +4.9), no measurable effect; legitimate access 77% → 76%, TruthfulQA 62% → 61%.
- Qwen2.5-1.5B: 53% → 62% (95% CI +1.4 to +16.9), worse, and TruthfulQA fell from 54% to 43%, so the shield should stay off for Qwen.
- For comparison, a prompt-only defense (spotlighting) cut Gemma's attack success from 37% to 16% but dropped legitimate access from 77% to 63%; it did not help Qwen (53% → 55%) or Granite (77% → 80%).
- The shield is a per-model control that must be validated before use; it never replaces the gateway checks.
Prompt baseline (spotlighting). Marking untrusted text with delimiters in the prompt was the strongest single defense on Gemma: attack success fell from 37% to 16%, though legitimate access fell from 77% to 63%. It did not help Qwen (53% → 55%) or Granite (77% → 80%). So no single defense works across all three models, which is why the gateway checks come first.
Attention Tracker detector (MIA capture_qk). I keep the attention heads whose focus on the system instruction drops under injection (Hung et al., NAACL 2025 Findings): 24 for Qwen and 64 for Granite (capped at the strongest 64), each with held-out AUROC 1.0 on a small labeled set (30 attacks, 5 benign; exploratory). In the GPU run of the gateway scenarios, Qwen's focus score was 0.37–0.39 on clean requests and 0.29–0.33 when documents, tool output or MCP metadata carried injected instructions, and went back to 0.37–0.39 once Model Mountain filtered those inputs (13 scenarios; exploratory). fp16 attention on the T4 produced NaNs for Qwen until I analyzed the captured Q/K in FP32. Gemma 4's capture failed on the T4 because its layers mix attention geometries; a patched rerun is pending, so no Gemma heads are reported.
Activation monitor (MIA capture_hs). A hidden-state probe trained on deepset prompt injections reaches 0.98 test AUROC (Qwen and Granite; 1.00 on Gemma) and, on Qwen, catches 90% of held-out injections at a 9% false-positive rate. It flags every Tensor Trust prompt, legitimate ones included, so it is reported as a monitor, never used as a gate.
Gateway on a real GPU model (Try it). All 13 gateway scenarios (direct and forged-system injection, poisoned RAG, tool-output and MCP injection, cross-tenant data, unauthorized tools, record export) were sent to Qwen2.5-1.5B on a T4, with and without Model Mountain. Unguarded, 2 unsafe password-reset calls would have run; through Model Mountain none did, 5 replies were withheld and poisoned or cross-tenant documents were removed in 4 requests. Tools are never executed.
User control. Each steering profile is opt-in and bound to the vector file's SHA-256, model, revision and layer; users can adjust strength, layer, phase and token positions and download the profile for a GPU worker.
The five deterministic checks hold even if a model is fooled; the MIA defenses add detection and steering on top.

Technologies, tools and datasets

Python 3.12, React 18 + Vite, Vercel (Python serverless API + static UI), IBM vLLM-Hook (MIA, pinned commit da420038), vLLM 0.29, PyTorch 2.13, Hugging Face Transformers, Kaggle (2× Tesla T4), cryptography (Ed25519). Models: Qwen2.5-1.5B-Instruct, IBM Granite-3.1-2B-Instruct, Gemma-4-E4B-it / E2B-it, all at pinned revisions with trust_remote_code disabled. Datasets: Tensor Trust hijacking robustness (Toyer et al., 2023), deepset/prompt-injections, TruthfulQA (MC1) and my own labeled injection tests.

What impact could it have?

Removes the documented exfiltration channels (auto-loaded images, data-carrying links, unapproved recipients) that real incidents used, without needing the model to cooperate.
Gives security teams an auditable record of every decision, which supports governance reviews (NIST AI RMF "Measure/Manage") and incident response.
Adds model-internal injection detection and steering that are inspectable and evidence-labeled instead of a black box.
How to measure impact: attack success rate and false-block rate on held-out attacks, benign task completion, added latency, and incidents prevented in a pilot.

Limitations and next steps

The live web demo runs the rule engine on CPU with inert fixtures; it does not run a language model, and no remote GPU worker is connected. Every result is labeled with its evidence type (CPU_SYNTHETIC, REAL_IBM_MIA, CONFIGURATION_ONLY).
GPU results come from small open models (1.5B–2.5B parameters; Gemma 4 E4B has about 4B effective and 8B total parameters) and small held-out sets, so confidence intervals are wide. Tensor Trust and TruthfulQA were adapted (chat prompts; up to six answer choices), so scores are not comparable to published leaderboards. Steering effects are reported as measured, including null or negative results.
Pattern-based injection screening can be evaded by new phrasings; the attention-head detector needs per-model calibration.
Allowlists, source registries and tool pins need operational ownership.
Next: finish the patched Gemma 4 attention-head run, wire the gateway to a live GPU worker, expand held-out attack sets, run a pilot with a real MCP proxy, and add distributed rate limiting.

How I used AI tools (disclosure)

I built Model Mountain solo, directing these tools:

Claude (Anthropic) — Claude Cowork, Opus 5.5: lead engineer. Defenses (egress guard, gateway trace, campaign detector, steering profiles), Kaggle MIA kernels (injection shield, attention-head discovery, activation monitor), web UI, this write-up.
OpenAI Codex: API contracts and control API, Vercel deployment, Kaggle job submission and result download, Windows test and build verification, independent code and security review.
Google Antigravity: earlier mechanical checks only; its earlier UI and evaluation set were withdrawn and replaced.
IBM vLLM-Hook (MIA) at runtime for activation capture, attention capture and steering. I did not use IBM Bob.