JMasr/balidea-attack-detector-es-gl-v2

balidea safeguard · attack_detector · v2

Multilingual (ES/GL) safeguard classifier for clinical chatbot traffic — a full fine-tune of FacebookAI/xlm-roberta-base (no LoRA). Part of the v2 rebuild on a provenance-aware train/val/test methodology; supersedes the deprecated v1.

⚠️ Validation caveat. This model was trained with gold-in-train: ~161 rows of the production .ods acceptance set are in the training split, so the standard acceptance gate against the full .ods is not a clean check and was skipped for this upload. It is validated only on the held-out 20% gold-test slice below. The .ods is a curated 886-prompt set, not live production traffic — treat these numbers as a proxy and confirm on real traffic before relying on the model.

Model details

Field	Value
Base model	FacebookAI/xlm-roberta-base
Task / policy	attack_detector / attack-production-v2 (production-v2)
Languages	es, gl
Labels	0 = negative/pass, 1 = positive/flag
Decision threshold	0.8300
Temperature (Guo et al. 2017)	1.8357
Calibration slice	val (recall=0.9222797927461139, fp=0.0037488284910965324)
Dataset slug	v2-attack_detector-seed20260526

Held-out gold-test (production .ods slice unseen in training)

n = 60 (18 positive, 42 negative).

Operating point	recall	FP	ROC-AUC	acceptance
shipped (threshold=0.830, val-calibrated)	0.8333	0.0	0.9987	❌
gold-recalibrated (threshold=0.92)	0.75	0.0	—	❌

ROC-AUC is threshold-free (model quality); recall/FP depend on the operating point. Confidence intervals and per-language slices are in the project's reports/v2/attack_detector_lr_check_goldtrain.json.

Training

Known-good XLM-R recipe with early stopping (no epoch grid, no LoRA, no focal loss):

• epochs ceiling: 4 (early stopping, patience 2, metric eval_loss)
• learning rate: 3e-05
• weight decay: 0.01, warmup ratio: 0.06
• batch size: 16, max length: 256, seed: 20260526

Train split sources (n=5169, labels={'0': 3866, '1': 1303}):

source	rows
balidea_malign	1872
prod_medical_queries	1106
chitchat	1086
snomed_clinical	849
ods	161
author_seeds	95

Usage

from safeguard.inference import SafeguardClassifier  # applies temperature + threshold

clf = SafeguardClassifier("attack_detector-v2")  # or a local path / this repo id
print(clf.predict_detailed(["texto a clasificar"]))

Raw transformers (remember to apply temperature 1.836 and threshold 0.830):

from transformers import AutoModelForSequenceClassification, AutoTokenizer
model = AutoModelForSequenceClassification.from_pretrained("REPO_ID")
tokenizer = AutoTokenizer.from_pretrained("REPO_ID")