Guardrails that run on a CPU change where you can put them

Lasso Security announced LEAP in early September: an AI guardrail that drops the transformer, runs on commodity CPUs with no GPU, and returns a decision in under five milliseconds. The company positions it on detection accuracy. We would point somewhere else.

GPU-backed guardrails have a placement problem

A guardrail implemented as a transformer needs accelerated inference to hit a tolerable latency budget. That forces it into the same tier as the model it is protecting: a GPU-bearing service, usually centralised, usually reachable over a network hop.

The consequence is architectural. Every call that needs checking has to travel to where the checker lives. You end up with a small number of chokepoints, which is operationally convenient and a poor match for how agent systems actually fan out. The interesting traffic in an agentic deployment is not the user prompt at the front door — it is the tool call three hops in, the retrieved document, the inter-agent message. Routing all of that through a central GPU service is a latency budget nobody wants to spend and a dependency nobody wants to own.

A control you can only afford to run at the perimeter is a perimeter control, whatever the marketing says.

Sub-five-millisecond on a CPU is a topology change

At five milliseconds and no accelerator, the checker can sit in the process. It can run as a sidecar next to each agent, inside the tool-invocation path, at the point where a retrieved document enters context. It becomes cheap enough to apply per-hop rather than per-session.

That is the difference between screening what enters the system and screening what moves within it. For agent architectures — where the majority of consequential decisions are internal and never touch a user-facing boundary — the second is the one that matters.

The trade to interrogate

Transformer-free almost certainly means a narrower detection envelope. Classical techniques are strong on known patterns and weaker on novel phrasing and semantic indirection, which is precisely where prompt injection lives. A vendor claiming top-tier accuracy without a transformer is making a claim about their benchmark set, and benchmark sets for injection are notoriously unrepresentative.

The right posture is layered rather than substitutive. Use a cheap in-process check everywhere, on every hop, as a floor. Keep an expensive semantic check at the boundaries where the consequences are highest. The failure mode to avoid is treating a fast, cheap, narrow detector as a replacement for the slow, expensive, broad one because it is easier to deploy.

The release is worth attention not because guardrails got more accurate, but because they got small enough to put where the risk actually is.

Written by the Devence Lab research team.