Guardrino-t7 v7 is the model inside Guardrino, the AI-security gateway HisnLabs is building for Arabic, its dialects, Arabizi and English. On our own test set it caught 86.5% of the Arabic attacks, 6,814 of 7,874, with every model’s threshold set the same way. On a laptop CPU it took a median 14.8 ms to check a message.
On the same messages, the guards other teams built for Arabic caught between 7.1% and 25.8%, and two well-known guards built for English caught 14.3% and 11.4%. One model was as fast as ours: HARIS took 14.5 ms against our 14.8 ms. That is a tie, not a lead. The int8 ONNX build that the product runs took 6.7 ms.
Why Arabic matters: in the Gulf, people write to banks, telecom operators and government services in Arabic, in dialect, in Arabizi (Arabic typed in Latin letters and digits) and in English, often in one message. Prompt injection, entry LLM01 at the top of OWASP’s 2025 list for LLM applications, works in all of them [10]. A guard tested only in English leaves most of that traffic unchecked, and a guard too slow to sit in front of every message does not get switched on.
In this report:
Attacks caught against time per message
Read the chart along both axes. A guard can catch more by blocking more, and it can be fast by doing less. What a gateway needs is both at once: a high catch rate at a fixed false-block budget, and a time per message small enough to sit in front of every request. HARIS is as fast as Guardrino-t7 v7 here; it catches 7.1% of these Arabic attacks.
How Guardrino checks a message
Guardrino-t7 v7 is one layer of three. L0 makes cleaned-up copies of the message for the checks: without tatweel (the stretching stroke), diacritics and hidden characters, and with Arabizi read as Arabic. It never changes what is forwarded. L1 applies rules: Gulf personal data and secrets, known attack signatures, links. L2 is the model this report measures. The gateway then allows the message, masks what must not leave, or blocks it.
This report measures L2 alone, message by message, so that it can be compared with other classifiers. The gateway adds the other layers, conversation memory and output checks on top.
The test set
The test set is HisnLabs’ own: 13,249 attacks and 31,348 safe messages from 63 sources, mostly Arabic. It is the test split of the data Guardrino-t7 v7 was built from: kept apart from training, but drawn from the same sources. That favours our model, and it is the main reason this is not an independent test.
| Language | Attacks | Safe messages |
|---|---|---|
| Arabic (script) | 7,874 | 27,482 |
| English | 5,248 | 3,865 |
| Other or mixed | 100 | 1 |
| French | 27 | 0 |
| Total | 13,249 | 31,348 |
| Dialect label | Attacks | Safe messages |
|---|---|---|
| Gulf | 1,918 | 13,426 |
| Egyptian | 1,834 | 2,642 |
| Levantine | 559 | 1,367 |
| Maghrebi | 654 | 2,930 |
| Modern Standard Arabic | 2,526 | 3,456 |
| Iraqi | 9 | 1,361 |
| Sudanese | 62 | 182 |
The safe messages are the ordinary text an assistant in the Gulf receives: tweets, requests to a voice assistant, questions and chat, in Gulf Arabic above all, so that harmless text that merely sounds unusual is part of the test. The comparison also counts attacks written in Arabizi on their own: 1,523 of them.
| Source | Attacks | Safe messages |
|---|---|---|
gulf-tweets | 0 | 7,292 |
arabic-guardrail | 2,271 | 2,216 |
massive-ar-sa | 0 | 3,124 |
aya | 0 | 2,598 |
embedded-v6 | 957 | 957 |
da-mmlu | 0 | 1,892 |
spml | 985 | 815 |
in-the-wild | 630 | 1,049 |
bipia-clean | 0 | 1,439 |
bipia | 1,297 | 0 |
mosscap | 1,154 | 0 |
oasst2 | 0 | 1,016 |
| 51 other sources | 5,955 | 8,950 |
One source needs a warning. arabic-guardrail gives 2,271 attacks and 2,216 safe messages to the test set. It is public, so other models may have been trained on it, and its training split was in our training data. We report results with and without it (see Results).
The models compared
Six models, all of the same type: a classifier that reads one message and scores how likely it is to be a prompt attack. No safety judge, a model that rates whether content is harmful, was part of this comparison. The outside models were downloaded from Hugging Face and run as published.
| Model | Published by | Type | Built for |
|---|---|---|---|
| Guardrino-t7 v7 | HisnLabs | Prompt-attack classifier | Arabic, its dialects, Arabizi and English |
| Ara-Prompt-Guard V1 | NAMAA-Space | Prompt-attack classifier | Arabic |
| ArabGuard | d12o6aa | Prompt-attack classifier | Egyptian Arabic |
| HARIS | ZKLogic | Prompt-attack classifier | Arabic |
| Prompt Guard 2 | meta-llama | Prompt-attack classifier | English |
| Protect AI v2 | protectai | Prompt-attack classifier | English |
Results and method
| Model | Arabic attacks caught | Safe messages blocked | Median time | p95 time |
|---|---|---|---|---|
| Guardrino-t7 v7 | 86.5% (6,814 of 7,874) | 2.6% | 14.8 ms | 30.9 ms |
| Guardrino-t7 v7, set to ArabGuard’s false-block rate | 82.8% (6,520 of 7,874) | 1.7% | same model | same model |
| Guardrino-t7 v7, int8 ONNX (the product build) | not re-measured | not re-measured | 6.7 ms | 23.2 ms |
| Ara-Prompt-Guard V1 | 25.8% (2,033 of 7,874) | 2.0% | 66.5 ms | 152.5 ms |
| ArabGuard | 19.7% (1,553 of 7,874) | 1.7% | 32.4 ms | 51.0 ms |
| HARIS | 7.1% (561 of 7,874) | 1.5% | 14.5 ms | 28.1 ms |
| Prompt Guard 2 | 14.3% (1,128 of 7,874) | 2.8% | 61.9 ms | 110.9 ms |
| Protect AI v2 | 11.4% (894 of 7,874) | 1.9% | 65.8 ms | 114.9 ms |
Our false blocks are higher than most. Every threshold was set to block 1 in 100 safe messages on the validation sample, but on the test set Guardrino-t7 v7 blocked 2.6% of safe messages, 804 of 31,348. So we also report it at a stricter threshold, set so it blocks no more safe messages than ArabGuard: 519 of 31,348. There it still catches 82.8% of the Arabic attacks, against 19.7% for ArabGuard.
Speed: Guardrino-t7 v7 took a median 14.8 ms per message, 30.9 ms at the 95th percentile. HARIS took 14.5 ms: the two are tied. The other models took between 32.4 ms and 66.5 ms.
The product runs an int8 ONNX build of the same model [9], which took a median 6.7 ms (23.2 ms at p95). Its catch rate was not measured again on this test set. What we measured instead: on 1,000 rows, the int8 build gives the same verdict as the full-precision model on 98.7% of them.
By dialect
| Dialect | Arabic attacks in the set | Caught by Guardrino-t7 v7 |
|---|---|---|
| Gulf | 1,918 | 86% (1,642 of 1,918) |
| Egyptian | 1,834 | 86% (1,573 of 1,834) |
| Levantine | 559 | 97% (540 of 559) |
| Maghrebi | 654 | 95% (624 of 654) |
| Modern Standard Arabic | 2,526 | 83% (2,102 of 2,526) |
Gulf and Egyptian attacks are caught at about the same rate, and Modern Standard Arabic is the lowest of the five. The Levantine and Maghrebi sets are small, 559 and 654 attacks, so a few dozen messages move those rows: read them as a rough indication.
How we measured
- Same messages for every model: the 13,249 attacks and 31,348 safe messages above, tested from 2026-10-26 to 2026-10-27.
- Same threshold rule for every model: a classifier gives a score and a threshold turns it into block or allow. Each model’s threshold was set on a separate validation sample to block 1 in 100 safe messages, then used unchanged on the test set. Comparing default thresholds would mostly compare how strict each model is.
- Same machine for every model: one Apple MacBook Pro with an Apple M1 Max, on the CPU with 4 threads, one message at a time (batch 1), 300 Arabic messages from short to long after 50 warm-up messages, on 2026-10-27. The time covers tokenising, the model and the score.
- The machine was also running a training job, so absolute times are higher than on an idle machine; all models ran under the same load, one after the other, then again in reverse order. Medians moved by at most 2.0 ms between the two passes.
- Without the overlapping source, arabic-guardrail, Guardrino-t7 v7 catches 4,596 of 5,603 Arabic attacks (82%).
- Every count is in the data file, so anyone can recompute the shares.
Limits
- It is our own test, not an independent one. The test set is mostly Arabic and close to the data Guardrino was trained on, which favours our model. We would welcome an independent test.
- The false blocks drift. The thresholds were set for 1 in 100 on validation; on the test set ours reached 2.6%. That is one reason a pilot starts in watch-only mode, where the false blocks can be checked on your own safe traffic before anything is blocked.
- The outside models were built for English, for one dialect or mainly for Modern Standard Arabic. This test shows what happens when they meet text they were not built for. It is not a judgement of those models.
- One public source may overlap with training data, ours and other teams’; without it our catch rate is 82%.
- Speed was measured on one laptop CPU under load. Your hardware, message lengths and batch sizes will give other numbers.
- The int8 product build was timed, but its catch rate was not measured again; it agrees with the measured model on most rows, not all.
- This measures one model on single messages. Attacks spread over several turns, and the gateway’s other layers, are outside this test.
- Guardrino is in development and offered through watch-only pilots. These are the results of one model version, not a promise about your traffic.
What comes next
Version 8 is training now. It adds Arabic content-safety heads, so that the same model can also flag harmful content, not only attempts to manipulate the assistant. It has no results yet, and we will not guess them. Its report will follow the same method, with the same test set and the same machine, whatever it shows.
See the data, or run it on your own traffic
Request a pilot: Guardrino runs in watch-only mode on your messages and reports what it would have done, blocking nothing until you decide. See the data: the comparison page has every count, the method and the limits, and the data file (JSON) behind it.
Three guides go further: Arabic LLM guardrails, LLM guardrails for banks, telecoms and government in the GCC and Arabic prompt injection. An earlier, smaller version of the model is open on Hugging Face as Guardrino-t7 Open [3], with this comparison on its model card; HisnLabs keeps v7 for the gateway.
How Guardrino and HisnLabs fit in
Guardrino is the gateway HisnLabs is building so that companies in the Gulf can check what their AI assistants read and say, in Arabic, its dialects, Arabizi and English. It is in development; a watch-only pilot runs it on your own traffic and blocks nothing until you decide.