When you complete a challenge in PromptSiege, an AI judge reviews your attack and grades it. Most AI products would send your conversation to a server to do that. We built it differently: the judge runs on your iPhone.
This post is about why.
What the judge does
In the dojo, you're trying to make a language model reveal a secret. When you think you've succeeded, the judge evaluates the model's response and decides whether the secret was genuinely extracted. Not just mentioned, not bluffed, but actually compromised.
That evaluation requires real language-model reasoning. It can't be a string match, because the same secret can be phrased a hundred ways. So yes, we need an LLM for this. The question is where it runs.
The cloud version, honestly examined
Let's say we did what most apps do: send your attack and the model's response to an API.
Now think about what's in that payload. Your attack is adversarial content you crafted against a real LLM. Effective injection payloads, jailbreak phrasings, system-prompt exfiltration techniques. It's exactly the material that a security researcher might not want sitting in someone else's logs:
- It's tied to your account (or at minimum your IP and timestamps).
- It sits on a third-party server, subject to that provider's retention policy, breach risk, and data-sharing practices.
- It could, in principle, be used to train models. Including models that patch against the very techniques you're practicing.
None of this requires bad intent from the provider. It's just what "your data lives on our servers" means.
The on-device version
On iPhone, the entire loop. Your attack, the defender model's response, the judge's evaluation. Happens in memory on your hardware. Apple's Neural Engine and the A-series chips make this practical; modern on-device models are genuinely capable.
Concretely, what this buys you:
- Zero data collection, provably. We don't have a privacy policy full of exceptions because there is no data to policy. Our privacy policy can be short enough to read in one breath.
- The attacker's mindset stays private. You can experiment with techniques you'd never want associated with you in a cloud log.
- It works offline. Airplane mode is a feature, not a limitation. You can train on a flight.
The trade-off is a one-time model download (around 2 GB, only with your explicit consent) and the reality that your phone's GPU does the work. For a training tool, that's a trade we'll make every time.
The bigger principle
"AI judge on device" is a small example of a larger architectural decision: don't centralize data you don't need. Every feature that runs on-device is a feature that can't leak from a server, can't be subpoenaed from a provider, and can't quietly change behavior behind your back.
We think the best privacy compliance is the kind you don't need a legal team to verify. The kind that's true by construction.