Lasso LEAP Explained: Sub-5ms CPU Guardrails, RAPID Escalation and Benchmark Gaps

What Lasso LEAP actually is

Lasso Security announced LEAP on September 2, 2026 as a new transformer-free AI guardrail designed to run on ordinary CPUs rather than requiring a GPU for every security decision. The company says LEAP can inspect prompts, outputs and agent actions and return a decision in under five milliseconds while sustaining hundreds to thousands of times the throughput of existing guardrails.

Those speed and throughput figures are vendor benchmark claims, not independently reproduced measurements. The public launch material does not publish enough methodological detail to treat them as a universal performance result.

Primary source: Lasso Security launch announcement.

LEAP and RAPID are a two-stage architecture

Lasso does not claim that every policy decision can be handled by the fast CPU path. The platform pairs LEAP with RAPID, a self-hosted LLM-as-a-judge intended for the smaller fraction of requests that need more contextual judgment against plain-language policy.

Lasso says a routing layer sends the overwhelming majority of traffic to LEAP and escalates ambiguous cases to RAPID. The company also says RAPID can be 100–200x cheaper than calling a commercial cloud LLM API for the same judgment work. That cost multiple is also a vendor estimate: the launch material does not disclose the exact model, hardware utilization, traffic mix, prompt lengths or cloud comparison used to produce it.

The architecture is important because a production system's latency and cost will depend not only on the LEAP fast path, but also on the escalation rate to RAPID. A deployment that escalates 1% of requests can behave very differently from one that escalates 20%.

The sub-5ms result is not yet a reproducible benchmark

The strongest claim in the launch is the combination of CPU-only execution, sub-5ms decisions and GPU-class detection quality. The public announcement, however, does not provide the information needed for an independent reproduction.

I did not find a public LEAP benchmark that specifies all of the following:

• evaluation dataset or attack corpus;
• number of examples and class balance;
• precision, recall, false-positive rate and false-negative rate;
• exact CPU model, core count and memory configuration;
• single-request versus batched inference;
• median, p95 and p99 decision latency;
• exact competing guardrails and their versions;
• throughput in requests per second under a named load profile;
• adaptive-attack testing or multi-turn agent scenarios.

Without those details, the correct interpretation is "Lasso reports under 5ms", not "LEAP has independently proven under-5ms end-to-end latency."

The distinction also matters operationally. Engine classification time is not the same as full request-path latency after network hops, policy lookup, logging, routing, retries and any RAPID escalation.

Do not transfer older Lasso platform numbers onto LEAP

Lasso's broader website currently advertises platform-level figures including 98.6% threat-detection accuracy, under 50ms classification latency and a 570x cost-efficiency claim relative to cloud-native guardrails. Those figures appear on the broader platform site and are not presented there as a LEAP-specific, independently reproduced benchmark.

They therefore should not be silently substituted for a LEAP precision/recall result or combined with the new sub-5ms launch claim into a synthetic score.

Source: Lasso Security platform site.

Independent security research shows why adaptive testing matters

An independent 2025 study, Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents, evaluated eight defenses against indirect prompt injection and reported that adaptive attacks bypassed all eight, with attack success rates above 50%.

That paper did not evaluate LEAP and should not be presented as evidence that LEAP is vulnerable. Its relevance is methodological: guardrail evaluations that only test static attacks can substantially overstate robustness when the attacker adapts to the defense.

For a stronger LEAP evaluation, an independent test should include both fixed attack sets and adaptive attacks, multi-turn tool use, indirect prompt injection, data exfiltration attempts and benign-but-unusual traffic to measure false positives.

Research source: Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents.

F5 CASI and ARS are useful context, but not comparable scores

F5 Labs publishes CASI and ARS leaderboards for model-level resistance to prompt injection, jailbreaks and agentic attack scenarios. Those benchmarks are useful evidence that AI-security evaluation needs separate dimensions for attack resistance, task performance and cost.

They are not a benchmark of LEAP. CASI/ARS scores describe the tested foundation models and their resistance under F5's harness, whereas LEAP is a guardrail layer placed around AI applications and agents. Ranking a guardrail against a foundation-model safety score would mix different systems and evaluation targets.

Source: F5 Labs CASI and ARS leaderboards.

Pricing and access remain unclear

The LEAP launch does not publish a self-serve list price, per-request price, or public usage tier. It says LEAP is already in production at global enterprises and the U.S. federal government, but that is a deployment claim rather than an availability guarantee for ordinary developers.

Because no authoritative public LEAP price card was found in this verification pass, pricing should remain unknown/custom rather than copied from third-party pricing sites.

The same caution applies to hardware sizing. "Runs on ordinary CPUs" does not tell a buyer how many cores are required for a particular requests-per-second target, how memory use scales with policy complexity, or how performance changes under concurrent multi-tenant traffic.

SWE-bench Verified and SWE-bench Pro are not relevant here

I found no LEAP-specific SWE-bench Verified or SWE-bench Pro result, and none should be expected as a primary measure of this product. Those benchmarks measure software-engineering issue resolution by coding systems, while LEAP is a runtime security guardrail.

A fair LEAP evaluation should instead measure detection quality, false positives, false negatives, adaptive attack success rate, throughput, tail latency, escalation rate, operational cost and behavior under agent/tool-use workloads.

Public feedback is too sparse for a reliable consensus

I searched for attributable first-hand developer reports on X, Reddit and public repositories that included enough detail to reproduce a LEAP test—such as product version, hardware, attack set, request volume and measured latency. I did not find a sufficiently reliable set in this bounded pass.

Lasso's own LinkedIn and launch posts provide product claims and customer statements, but those are first-party marketing evidence, not independent user sentiment. With no strong reproducible public sample, the responsible conclusion is that independent field feedback is currently sparse.

Practical evaluation checklist

For an enterprise considering LEAP, the most useful proof-of-concept would hold the traffic and policies constant and report:

• precision, recall, false-positive and false-negative rates by threat class;
• adaptive versus non-adaptive attack success;
• p50, p95 and p99 end-to-end latency;
• requests per second on a named CPU configuration;
• percentage of traffic escalated from LEAP to RAPID;
• RAPID latency and cost for escalated decisions;
• performance on long-context and multi-turn agent traffic;
• failure behavior when the guardrail or policy service is unavailable;
• cost per million inspected requests and cost per successfully blocked attack.

That would make the economic claim testable. A very fast classifier is valuable only if it keeps false negatives low enough for the threat model and false positives low enough that users do not route around it.

Confidence and what to watch next

Confidence is high that LEAP was announced on September 2, 2026, is described by Lasso as transformer-free and CPU-based, and is paired with RAPID as an escalation path. Confidence is also high that the sub-5ms, throughput and 100–200x cost figures are company claims rather than independent measurements.

Confidence is low/unknown on reproducible LEAP accuracy, tail latency, hardware-normalized throughput, pricing and adaptive-attack robustness because the launch material does not expose the necessary benchmark details.

The next evidence worth tracking is an independent LEAP benchmark with a named attack corpus and hardware setup, published precision/recall and tail latency, a disclosed RAPID escalation rate, customer-visible pricing, and reproducible first-hand deployment reports.