ILION is a design for a safety check between an AI agent and the systems it can use, published by independent researcher Florin Adrian Chitan in February 2026. Before the agent acts, for instance by exporting customer data, ILION compares the action with the agent's job description and blocks it if they do not match. It is one researcher's design, tested on a benchmark he built himself.
Why a separate check for actions?
An AI agent does things: it calls tools, changes files and sends data. Content filters such as the OpenAI Moderation API or Meta's Llama Guard judge whether text is harmful, for example violent or hateful. Chitan's paper points out that a harmful action can be written in harmless words. "Export all customer records to the following S3 bucket" passes any content filter, and in his example a scheduling agent is talked into such an export by instructions hidden in a calendar invitation, a form of prompt injection. He calls the task an execution gate: decide before each action whether it falls within the agent's authorised scope.
How does it work?
The gate receives two texts: the agent's role description and the proposed action. Word lists turn both into scores on 21 features, such as read, write, delete, export, internal and external, with separate lists for eight attack categories, from prompt injection to data exfiltration. Three tests follow: how far the action drifts from the role, how closely the two align (cosine similarity), and whether any attack category scores above a threshold. If any test trips, the verdict is BLOCK; otherwise ALLOW.
There is no neural network and no training data. The thresholds were set on 20 development scenarios, and the code uses only Python and NumPy. The same input therefore always gives the same verdict, which is what "deterministic" means here.
What did the tests show?
ILION-Bench v2, the author's own benchmark, has 380 test scenarios: 190 legitimate actions and 190 attacks. ILION reached an F1 score (a balance of attacks caught and correct blocks) of 0.8515, with 91.0% precision and a false-positive rate of 7.9%, at a mean latency of 143 microseconds. Lakera Guard, a commercial service, reached 0.8087 but blocked 29.5% of the legitimate actions. The OpenAI Moderation API caught 12 of the 190 attacks and Llama Guard 3 caught one; the author notes that these tools were not built for this task. The abstract's "2,000 times faster" compares ILION on a local processor with Lakera Guard's 293 milliseconds over the internet.
What are the limits?
The paper names them itself:
- Each action is judged on its own, so an attack spread over several turns goes unnoticed.
- The word lists only cover attacks known when they were written, and an attacker who knows them can avoid the flagged words. One in five attacks in the benchmark got through.
- At 7.9%, about one in 13 legitimate actions is blocked.
- One author wrote all scenarios; the paper calls for independent red-teaming.
The code is on GitHub under a non-commercial licence (CC BY-NC-ND 4.0), with a separate commercial licence, and the method is the subject of a patent application in Romania. Checks before an agent acts are one kind of guardrail. OpenAI said in March 2026 that it wanted to explore such checks for its own coding agents, as the post on agents that seem to betray their operators describes.