The UK research group Voxiferi Labs, founded by well-regarded open-source firewall Smoothwall co-founder Richard “Dick” Morrell, calls its proposed product the Voxiferi Ingress Gateway. It is designed to sit between a data source and the system that consumes it, such as an AI training pipeline, retrieval-augmented generation (RAG) system, inference endpoint, data warehouse, or cloud service.

Richard "Dick" Morrell, Founder of Voxiferi Labs

Its basic rule is simple. If data, or instructions embedded in data, cannot pass a defined verification policy, it does not get through.

That is not a novel idea in computing. Databases validate schemas before accepting rows. Mail servers reject messages that fail authentication and reputation checks. Firewalls block unwanted network traffic before it reaches applications. So, why not AI?

But in the rush to build AI systems, especially Retrieval-Augmented Generation (RAG) systems and agents, the input problem is much larger. They consume documents, prompts, code, APIs, tool output, model files, and claims about their runtime environments. Any of those can be wrong, malformed, poisoned, or actively hostile.

Voxiferi argues that AI needs an ingress firewall. Morrell says in an unpublished document that the gateway parses and validates each incoming record, scores its structure and likely processing cost, and either lets it proceed with a signed audit trail or quarantines it. Voxiferi believes doing that can both reduce the amount of data an LLM must process and block some attacks before they reach the model.

That is a big claim. It is also one that can be tested.

Steve Westmoreland, a former Boeing Chief Information Security Officer and now Voxiferi’s CTO, puts the case in blunter terms: “Detection is what you do when prevention has failed. The industry has spent a decade building better detectors and almost nothing on prevention. Every incident we are seeing—the data pipelines, the agent escapes, the supply chain compromises—comes from the same gap. Nothing was verified at ingress. Everything downstream is a consequence of that single decision.”

John Mark Walker, Voxiferi Labs’ chief evangelist, makes a similar argument:

“After every AI incident, the same response arrives—stricter sandboxes. Better classifiers. More monitoring. Harder kill switches. The industry treats containment as an engineering problem: Build a stronger box, and the thing inside cannot get out. The 2026 agent escapes at OpenAI and Anthropic should have ended this belief. They didn't. The industry is still building stronger boxes. The boxes are still failing. And the reason is simple: the problem was never the box. The problem was what was allowed through the door.”

The point is not that sandboxing, output filtering, monitoring, and runtime controls are useless. They are not. The point is that they often act after untrusted information has already entered the system.

Walker also cites findings from What’s In My Big Data (WIMBD), an open-source toolkit for analyzing large text datasets: “Half the documents in major training corpora are duplicates. A quarter are corrupted, synthetic, or contaminated. The industry responded by building bigger models to learn around the mess. It spent hundreds of billions on compute. It spent almost nothing on verification at the point of entry.”

Whether those percentages apply broadly across all major training datasets is a question for independent analysis. But the general problem is real enough: Large AI datasets contain duplicates, junk, synthetic content, broken formatting, poor metadata, and material of uncertain provenance. Cleaning that mess after ingestion is expensive. It may also be too late.

Kit Cosper, Voxiferi’s CEO and a founding Red Hat employee, aims for the AI industry’s safety posture: “The safety pledges that made [AI] companies credible were the first things to go. Anthropic deleted its pause-training commitment. OpenAI dropped the word 'safely' from its mission statement. What replaced them was the appearance of containment without the substance. The industry learned that the fastest way to survive a safety crisis was to look like it was responding while continuing to ship. That is not a fix. That is a marketing decision.”

Cosper’s larger point is harder to dismiss: Company pledges are not a security architecture. Under competitive or financial pressure, policies can change. A technical control that validates inputs before a system uses them is more durable than a promise to be careful.

As Voxiferi puts it in an as-yet-unpublished technical paper, “The correct place to fix a problem is the place where the problem enters. Not the place where the problem manifests.”

Voxiferi is not proposing an offline data-cleaning service. The company says its gateway would run inline, in the same data path an application already uses. According to its technical material, the gateway could run as an application-library call, a Kubernetes-style sidecar, a Linux systemd service, or a local API. In each case, the goal is synchronous admission control. A record is accepted before it reaches the target system, or it is quarantined before it can contaminate a model, vector database, training corpus, or downstream application. That's an important distinction.

A nightly data-quality process can discover bad data only after it has been indexed, copied, retrieved, or used in inference. An output filter may catch some harmful generated text, but it cannot take back a prompt-injection instruction that has already landed in an LLM’s context window. Nor can it undo a poisoned document that has already influenced an agent’s behavior.

Voxiferi describes the product as deliberately conservative. It is not meant to repair or reinterpret bad records. If a field is incomplete, malformed, ambiguous, or outside policy, the system is supposed to reject or quarantine it rather than guess what it meant.

In other words, it is admission control, not automated cleanup.

The gateway’s processing path has three steps:

Log the decision. Accepted and rejected records generate audit events. Voxiferi says the log records the item’s identifier, its disposition, calculated metrics, and—for accepted records—the destination and size. Rejected records receive a reason code and a quarantine destination.

The aim is not to make chatbots write better prose. It is to restore a meaningful trust boundary in systems that increasingly accept outside content as both data and possible instructions.

The gateway is based on what Morrell calls Morrell's Law of AI data:

“That the accuracy, safety, and running cost of an AI system are bounded by the structure of the data it takes in, not by the size of the model or the amount of compute behind it. Noise that enters at intake cannot be removed downstream. Structure the data at the point of entry, and a small model on modest hardware will match or beat a very large one in the cloud.”

That is a strong proposition. It contains one conventional observation and one much stronger claim.

The conventional part is that clean, well-labeled, structured data is generally more useful than noisy, inconsistent, or poorly understood data. Anyone who has spent time with databases, ETL pipelines, search indexes, or machine-learning datasets knows that.

The stronger part is that Voxiferi’s approach can reliably make a smaller local model match or outperform a substantially larger cloud model. That requires benchmarking against real workloads, published methods, and independent review.

Voxiferi’s proposed “structure coefficient” attempts to quantify the relationship between usable structured fields and non-conforming ones.

In the company’s terminology,

​

Where Fstructured represents validated, schema-compliant, machine-readable fields, while Funstructured represents missing, malformed, ambiguous, placeholder, or otherwise non-conforming fields, a higher score indicates more validated structure and less noise.

The company then adds an efficiency calculation using estimated Shannon information content, processing energy, and a bits-per-joule result. Voxiferi says the logarithmic portion of that model is derived from Shannon-Hartley and rate-distortion theory.

Practical policy controls are more familiar than the mathematical packaging. The gateway compares each record with four thresholds:

If a record fails any of these tests, the gateway quarantines it.

This is the heart of Voxiferi’s pitch. Rather than asking an LLM whether a record “looks” trustworthy, the product applies a deterministic policy before the model sees the data. It tries to prevent an LLM from deciding whether a document is really data, really an instruction, or really an authentic description of the environment in which it is operating.

That is a sensible architectural direction. It does not, however, make the difficult questions disappear. Someone still has to write the schemas, establish the policy thresholds, define trusted sources, handle exceptions, and decide what the system should do with useful but imperfect data.

Voxiferi applies the same ingress idea to both data pipelines and autonomous AI agents. For a RAG system, the approach is relatively conventional. Documents should have provenance. They should be validated against expected structure. They should be signed or otherwise authenticated before indexing or retrieval. The objective is to reduce indirect prompt injection and knowledge-base poisoning, where hostile instructions are buried in material that a model later treats as trusted context.

For agents, the company expands the definition of input. An agent does not only consume prompts and documents. It also operates on assumptions about its runtime environment. Is network egress allowed? Which endpoints are approved? Which certificate authorities can it trust? Is the system clock accurate? Does the simulated environment match the one the agent believes it is using?

Voxiferi says it should validate those assertions against the actual runtime configuration before allowing an agent to act.

Its broader VoxSuite architecture combines ingress validation with a separate Runtime Protection Service. The runtime service is intended to intercept tool calls before execution and use Linux Landlock-based confinement at the system-call boundary.

The two pieces solve different problems.

Ingress validation can help determine whether a document, prompt, record, or configuration claim should enter the workflow. Runtime controls can limit what an agent may do after it has received allowed input. A schema check cannot stop a model from opening a network connection. A kernel-level policy cannot prove that a retrieved document is authentic or safe. In principle, a system needs both.

The proposed trust model also relies on cryptographic signatures.

Voxiferi says a trusted source can sign a record before submission. The gateway verifies the signature, runs structural checks, and then re-signs accepted records to preserve a chain of custody across ingestion. Its documentation specifies Ed25519 signatures for records, actions, and state transitions.

The company also proposes Security Information and Event Management (SIEM)-friendly audit logging: structured JSON logs that are hash-chained and marked with what it calls “VOX Checksums.” Those logs are intended to feed systems such as Splunk, Microsoft Sentinel, and Datadog while making later tampering easier to detect.

The names matter less than the operational details.

An AI security team needs to answer basic forensic questions after an incident:

Cryptographic signing and tamper-evident logs can help answer those questions. But they work only if the operational plumbing is sound: Key management, rotation, revocation, timestamping, policy-change controls, log retention, access controls, and independent verification.

Voxiferi’s material does not yet provide enough independent detail to assess those issues. It also does not establish false-positive rates, benchmark methodology, how well its structure measures detect genuinely malicious inputs, or whether the system can distinguish dangerous content from merely messy data. It's still a work in progress.

Those are not small gaps. They are precisely the kinds of questions an outside security review and reproducible testing would need to address.

One of Voxiferi’s more unusual claims is that besides a host-CPU version,  it has created a CUDA version of the gateway for Nvidia GPUs.  The company says GPU-side validation could check records in the same memory space as the inference workload. That could avoid a CPU round trip, serialization overhead, and queuing delay. Since GPUs can process many tasks in parallel, the company also argues that they could validate and score thousands of records concurrently. This gateway is intended to work with Nvidia NIM, TensorRT-LLM, vLLM, and Nemotron deployments.

There is a plausible argument here. In a high-throughput AI inference pipeline, a CPU-side inspection stage can become a bottleneck. Moving some validation closer to the GPU workload could reduce overhead.

But it also creates another system that must be benchmarked, secured, monitored, and maintained. Every inline security control faces the same trade-offs. That is inspection depth, latency, throughput, operational complexity, and false positives. The real question is not whether a gate can score records quickly. It is whether it can do so without becoming the next performance choke point—or a new target for attackers.

Voxiferi says it has reference implementations in Rust, Go, Python, Perl, and Java. It also states it packages a Linux command-line version as a Debian package for Ubuntu 24.04 and Linux Mint 23, along with a Windows 11 version that includes a GUI and service wrapper.

The company further claims to have tested the technology with Nvidia Nemotron, OpenAI GPT-5, Anthropic Claude, and Google Gemini. Those are company claims from the supplied material and were not independently verified for this article.

Morrell’s central thesis is testable. Voxiferi proposes a controlled experiment using the same underlying dataset in two forms: one unstructured and one validated and structured at ingress. Researchers would then train or evaluate models of different sizes on both datasets and measure accuracy, compute use, energy consumption, latency, throughput, and rejection rates.

That is the right way to judge the technology.

Nobody needs to prove that clean, well-structured data is better than garbage. That has been standard engineering practice for decades. The questions are whether Voxiferi’s structure coefficient, information-content calculation, energy measurement, admission thresholds, and security claims produce a measurable advantage over AI's existing data-quality tools, provenance controls, and model-security systems.

The company’s broader architectural argument is stronger than some of its specific performance claims. AI systems have widened the definition of input faster than enterprises have improved their ability to decide what to trust. A document can become context. Context can become an instruction. An instruction can trigger a tool call. A tool call can become an external action.

Moving trust decisions earlier in that chain makes perfect sense.

Whether Voxiferi’s Ingress Gateway is the answer will depend on the evidence: reproducible benchmarks, real-world deployment results, independent security testing, transparent policy controls, and a clear explanation of what the system catches, what it misses, and how much it costs to run.

That is where the real work begins.

Noteworthy Linux, AI, and open-source stories:

If you’re a decision maker at your company, you need to be on the bleeding edge of, well, everything. But before you go signing up for seminars, conferences, lunch ‘n learns, and all that jazz, just know there’s a far better (and simpler) way: Subscribing to The Deep View.

This daily newsletter condenses everything you need to know about the latest and greatest AI developments into a 5-minute read. Squeeze it into your morning coffee break and before you know it, you’ll be an expert too.

Subscribe right here. It’s totally free, wildly informative, and trusted by 600,000+ readers at Google, Meta, Microsoft, and beyond.