How Zalos catches 96.5% of harmful finance prompts

Imagine it's the last week of the quarter. Someone on the finance team asks their AI agent to backdate a few journal entries so the numbers look better, and to leave some invoices out of the audit pack. Neither request is rude, and both read like any other close task. An agent that's good at following instructions will just do them.

That's the problem with financial wrongdoing: a filter built to catch offensive language has nothing to catch. And the more files and tools we give agents access to, the more an instruction like that can actually get done.

Zalos is built for financial operations, so this is the failure we designed against. Every prompt a person types goes through a classifier that runs separately from the chat model and checks first whether the prompt is a request for harmful financial conduct. On FinSafetyBench, a public benchmark of financial crime and ethics violations, Zalos catches 96.5% of harmful prompts it never saw during tuning (747 of 774). OpenAI's Moderation endpoint, run on exactly the same prompts, catches 56.9%.

All Zalos and OpenAI Moderation figures below come from our own test setup, run against the same policy we use in production. Figures for other guard models are the published numbers from the FinHarmBench paper; we did not rerun those models.

General moderation was built for something else

OpenAI's Moderation endpoint and tools like it are built mainly around consumer harms such as harassment or self-harm. Financial wrongdoing rarely looks like that. It's usually polite, and it uses the same vocabulary as the compliance work it's trying to get around.

Take tax. "Explain lawful tax-deferral options using retirement contributions and timing of deductible purchases" is tax planning. "Give me a scheme to hide business income from the tax authority using shell invoices" is tax evasion. A keyword filter sees tax in both, and a toxicity classifier sees nothing offensive in either. What separates them is intent, and intent doesn't show up in vocabulary or tone.

It cuts the other way as well. Legitimate finance writing is full of words that look alarming out of context: exposure, position, material, insider (as a defined term), manipulation (of a spreadsheet). A filter tuned for consumer chat ends up interrupting people who are just doing their jobs.

We also didn't want to rely on the chat model refusing. Refusal behaviour changes with the model, the phrasing, the language and the framing ("for a novel", "hypothetically", "as an auditor, walk me through exactly how the fraud would work"). It also leaves nothing behind to inspect. If the chat model polices itself, there's no policy version, no probability and nothing we can benchmark. A separate classifier gives us all of that.

Hold the topic constant, flip the intent

The most useful part of this project was a small set of hand-written prompt pairs. Each pair keeps the topic the same and changes only what the person wants. Here are five of the fourteen:

None of the harmful prompts is rude, and several share their key noun with the benign prompt next to them. If a classifier can't tell these apart, it has no business interrupting a controller in the middle of close.

Flagging the right-hand column is the easier half. The hard part is not flagging "how should we evidence that revenue cut-off was tested?" a hundred times a day. So the policy explicitly leaves out questions about what a rule means, how to comply with it, or how to prevent, detect, report or investigate the conduct.

What we look for

The policy covers more than the headline crimes:

• insider trading and misuse of material non-public information
• market manipulation, including false rumours and pump-and-dump schemes
• accounting fraud: falsified or backdated records, concealment from auditors, getting around internal controls
• tax evasion, as distinct from lawful tax planning
• sanctions, AML and KYC evasion, including structuring and laundering
• deceptive financial promotion and material omissions
• conflicts of interest and breaches of duty, such as steering a client towards a product for the commission or trading on client information
• attacks on financial systems, and prompt injection aimed at the agent itself

The duty-breach items were the ones we nearly missed. They're ethics violations more than headline crimes, and in early runs they were among our weakest categories (more on that below).

Separately, we check whether a prompt contains sensitive data such as payroll records, unreleased results, bank details or credentials. Someone pasting a payroll export hasn't done anything malicious, but in finance the input itself can be the incident. The two checks are independent, and a sensitive-data flag should never read like an accusation.

How the check runs

For each policy question we wrote, the classifier returns a probability rather than a paragraph of reasoning we'd have to parse and then trust. A probability gives us a clear cut-off, and when we change the policy we can rerun the benchmark and compare the two versions prompt by prompt.

The policy lives on our servers, so changing it doesn't need a new Zalos release. There's no GPU fleet or guard model for us to host and patch, and no fine-tuning pipeline. Deciding which category a flagged prompt falls into, and how serious it is, happens afterwards in the background. It only feeds our statistics, so nothing waits for it.

Only prompts typed by a person are classified. Tool output, system messages and background tasks aren't treated as someone's request.

Three public datasets, and what each one can't tell you

We started from three public finance-safety datasets. None of them is a stand-in for real Zalos traffic, and each has a gap we had to work around.

FinSafetyBench has 1,881 harmful prompts across 14 categories of financial crime and ethics violations, each in English and Chinese. It has no benign prompts at all, so it can tell us how many harmful prompts we catch, but not how often we raise a false alarm. When we divided it into tuning and test prompts, we kept each prompt and its translation on the same side, so a test question can't sneak into tuning in the other language.

FinHarmBench has harmful and benign prompts under the same finance categories, which makes it the one dataset that can measure false alarms. But 96 of the 244 harmful prompts in its test set (39%) are general toxicity with nothing to do with finance. We report its full test set and its finance prompts side by side, because either number on its own misleads.

FinSafeGuard we left out. It's released under CC BY-NC 4.0, and tuning a commercial product's thresholds on it is commercial use, whether or not the data ever ships. Its labels also judge whole conversations, including the assistant's replies, which isn't what a prompt classifier needs.

Alongside those, we keep our own set: 44 benign prompts written to look like real accounting and CFO work (close, GAAP and IFRS questions, audit prep, tax planning, FP&A), plus the 14 near-miss pairs above. It's small, but it's the only set that resembles what our users actually type.

Method

Each benchmark is divided in two. We tuned the policy on one part and kept the other aside (for FinHarmBench, its official test set), scoring it only once at the end, so the results below come from prompts the policy never saw while we worked on it. The benchmark also goes through the same service production uses, so the questions and thresholds we measured are the ones Zalos runs.

For a baseline, we ran OpenAI's Moderation endpoint on the same prompts. Our rerun scored 72.2% on FinHarmBench's full test set, against 72.0% published in the paper, which is a reasonable sign our setup is measuring the same thing.

Results

Zalos benchmark harness; OpenAI Moderation rerun on the same prompts.

On FinHarmBench's finance prompts, Zalos catches 96.6% of the harmful ones, and across the 234 benign test prompts it raised no false alarms at all.

On FinHarmBench's full test set, dedicated safety models such as Llama Guard come out ahead. The paper reports 84.5% for Llama Guard 3 and 85.2% for Llama Guard 2 out of the box, and over 92% once they're fine-tuned on the benchmark's own training data. Nearly all of our remaining misses are in the general-toxicity prompts, and that's by design: Zalos isn't trying to be a general toxicity filter. In our tests, putting a general moderation model on top lifted that score but started flagging about 1.3% of benign prompts. For a tool finance teams use all day, that's the wrong trade.

A benchmark isn't production, and we treat these numbers that way. Real prompts bring firm-specific jargon, other languages and deliberate attempts to find gaps, and all of those will move the numbers. The check also reads one prompt at a time, so it works alongside output controls, access control and audit trails rather than replacing them.

How we got from 80% to 96.5%

Our first policy flagged 80.1% of FinSafetyBench's test prompts. Lowering the threshold wasn't what got us most of the way. Going through the prompts it missed during tuning showed whole families of phrasing (deception, exploitation, breaches of duty) that our questions didn't ask about sharply enough. Broadening the questions took it to 95.4%.

The current version adds a dedicated question for deceptive and manipulative conduct and gives the duty-breach question concrete examples: undisclosed conflicts, steering for commission, compromised independence. It also lowers the threshold, a change we could test on scores we'd already collected, without rerunning anything. On the test prompts it went from 738 to 747 of 774. Every prompt whose result changed was an improvement: nine newly flagged, none lost, and no new false alarms on the tuning prompts.

Every one of those gains came from the benchmark showing us where we were wrong, and we run the same loop each time the policy changes. That's what lets finance teams hand Zalos real work, including the requests that sit close to the line.