Prowl stage-3 multilingual secret encoder + card

README.md

@@ -0,0 +1,108 @@
+---
+license: apache-2.0
+base_model: distilbert-base-multilingual-cased
+pipeline_tag: text-classification
+library_name: transformers
+language:
+  - multilingual
+  - en
+  - de
+  - fr
+  - es
+  - ru
+tags:
+  - security
+  - secret-detection
+  - credentials
+  - dlp
+  - code
+metrics:
+  - f1
+  - precision
+  - recall
+---
+
+# Prowl secret encoder
+
+A multilingual text classifier that scores whether a fragment of text — a line of code, a config
+value, a Jira comment, a log line, a chat message — **contains a leaked credential**. It is stage 3
+of [Prowl](https://github.com/Lercas/prowl), a high-precision secret scanner, and is responsible for
+the free-form and multilingual tail that regex and the linear model miss.
+
+This model is **not a standalone scanner**. It is one stage of an ensemble; on its own it is a
+recall booster, not a precision oracle. To scan a repo, use Prowl.
+
+## What it does
+
+- **Input:** a short text span (≤512 tokens; the tool feeds ~128).
+- **Output:** two logits → `softmax(...)[1]` is P(text contains a secret).
+- **Decision:** fires at `P ≥ 0.90`, a threshold calibrated on a held-out validation split to
+  **precision ≥ 0.95** (value-disjoint from the benchmark — no leakage).
+
+## Role in the ensemble
+
+Prowl combines three stages by union: a Go regex/checksum/entropy cascade, a char+word TF-IDF
+logistic regression, and this encoder. Adding the encoder to the other two, measured on
+[ProwlBench](https://github.com/Lercas/prowl/blob/main/benchmark/PROWLBENCH.md) (3,843 leakage-safe
+cases):
+
+| Configuration | Precision | Recall | F1 |
+|---|:--:|:--:|:--:|
+| cascade ∪ LR | 0.974 | 0.848 | 0.909 |
+| **+ this encoder** | **0.971** | **0.970** | **0.970** |
+
+The encoder lifts recall by 0.12 at a 0.003 precision cost. Against DeepPass2 (the prior
+ML-for-secrets baseline) on the same cases, the full ensemble wins 1,815 disagreements and loses 36
+— a **98.1% win rate** — and reaches recall 1.00 on German, French, Spanish, and Russian prose
+passwords (DeepPass2: 0.75 / 0.87 / — / —).
+
+Standalone recall at a fixed precision of 0.97, by channel:
+
+| code | Jira | Confluence | log |
+|:--:|:--:|:--:|:--:|
+| 0.984 | 0.996 | 0.998 | 0.947 |
+
+## Usage
+
+```python
+import torch
+from transformers import AutoTokenizer, AutoModelForSequenceClassification
+
+tok = AutoTokenizer.from_pretrained("Podric/prowl-secret-encoder")
+model = AutoModelForSequenceClassification.from_pretrained("Podric/prowl-secret-encoder").eval()
+
+def secret_score(text: str) -> float:
+    enc = tok(text, return_tensors="pt", truncation=True, max_length=128)
+    with torch.no_grad():
+        return torch.softmax(model(**enc).logits, -1)[0, 1].item()
+
+secret_score('DB_PASSWORD = "tR4!nf0rce-2026-prod"')   # high
+secret_score("the deployment finished without errors")  # low
+# fire at >= 0.90
+```
+
+## Training
+
+- **Base:** `distilbert-base-multilingual-cased` (104 languages, 6 layers, 134M params).
+- **Objective:** binary sequence classification (secret-bearing / not).
+- **Data:** the [Prowl secrets corpus](https://huggingface.co/datasets/Podric/prowl-secrets-corpus)
+  — 503k labeled records across code, tickets, logs, and prose. Real-secret sources (CredData, HF
+  PII sets) are held out by origin so the validation split is not a memorization check. Positives are
+  oversampled and real-origin records up-weighted.
+- **Calibration:** the operating threshold is fixed post-hoc on validation to a precision target, not
+  learned, so it transfers to the ensemble's union rule.
+
+## Limitations
+
+- **Binary, not typed.** It says *secret / not secret*; the secret **type** (AWS vs Stripe vs …)
+  comes from Prowl's cascade.
+- **A stage, not a scanner.** High recall comes at a precision that only makes sense inside the
+  ensemble, where the cascade supplies structured-token precision. Do not deploy it alone as a gate.
+- **Span-level, not token-level.** It flags a span; Prowl localizes the exact value.
+- **Distilled size.** Chosen for CPU-friendly latency over a larger encoder; the few remaining misses
+  are ambiguous, label-noisy cases.
+
+## License
+
+Apache-2.0, inherited from the base model. See the [Prowl repository](https://github.com/Lercas/prowl)
+for the scanner (MIT) and the dataset card for data provenance and source licenses.

config.json

@@ -0,0 +1,28 @@
+{
+  "activation": "gelu",
+  "architectures": [
+    "DistilBertForSequenceClassification"
+  ],
+  "attention_dropout": 0.1,
+  "bos_token_id": null,
+  "dim": 768,
+  "dropout": 0.1,
+  "dtype": "float32",
+  "eos_token_id": null,
+  "hidden_dim": 3072,
+  "initializer_range": 0.02,
+  "max_position_embeddings": 512,
+  "model_type": "distilbert",
+  "n_heads": 12,
+  "n_layers": 6,
+  "output_past": true,
+  "pad_token_id": 0,
+  "qa_dropout": 0.1,
+  "seq_classif_dropout": 0.2,
+  "sinusoidal_pos_embds": false,
+  "tie_weights_": true,
+  "tie_word_embeddings": true,
+  "transformers_version": "5.12.1",
+  "use_cache": false,
+  "vocab_size": 119547
+}

model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:bbcec73040456f44c8a4b71fef61c9b8fc873f43c27c43d23a5fdf52f56ade32
+size 541317368

tokenizer_config.json

@@ -0,0 +1,15 @@
+{
+  "backend": "tokenizers",
+  "cls_token": "[CLS]",
+  "do_lower_case": false,
+  "is_local": false,
+  "local_files_only": false,
+  "mask_token": "[MASK]",
+  "model_max_length": 512,
+  "pad_token": "[PAD]",
+  "sep_token": "[SEP]",
+  "strip_accents": null,
+  "tokenize_chinese_chars": true,
+  "tokenizer_class": "BertTokenizer",
+  "unk_token": "[UNK]"
+}