Commit TinyGuard-Injection

README.md

@@ -0,0 +1,56 @@
+---
+license: apache-2.0
+language:
+  - zh
+  - en
+tags:
+  - safety
+  - guardrail
+  - prompt-injection
+  - security
+  - text-classification
+  - mlx
+metrics:
+  - f1
+  - accuracy
+---
+# TinyGuard-Injection (base + fine-tuned)
+
+**Bilingual prompt-injection detector (incl. indirect injection) trained completely from scratch** · 9.1M parameters · MLX/Metal · Apache-2.0 (code) · fully synthetic training data
+
+[中文说明](MODEL_CARD-injections.zh.md)
+
+## Model description
+
+A 3-way guardrail deployed at LLM-app input gates and RAG retrieval gates: `benign / direct injection / indirect injection`. Complements Meta Llama Prompt Guard 2 (22M/86M, **no Chinese support**): this model is trained bilingual with equal weight.
+
+- Backbone: shared TinyGuard-Encoder (same pretrained base as TinyGuard-Command)
+- Fine-tune: 12,330 bilingual labeled examples across six carriers (code & collaboration platforms, emails & web pages, long RAG chunks, tickets & customer-service dialogs, benign hard negatives, hidden-character & encoded payloads), with "minimal-difference pairs" and anti-overrefusal design
+
+## Results (held-out data only, never seen in training)
+
+| Benchmark | Metric | Value |
+|---|---|---|
+| Validation set, 616 rows | acc / macro-F1 | **99.0% / 0.990** |
+| Adversarial set, 40 rows (zero-width chars / JSON rules / Japanese carriers / quoted disclaimers) | intervention recall / precision / F1 | 75% / 88% / 0.81 |
+
+Reference: Llama Prompt Guard 2-86M reports EN injection F1 ≈ 0.98 with no Chinese. This model provides first-tier Chinese capability; its English adversarial numbers are below Meta's home turf (expected at 9.1M vs 86M).
+
+## Usage
+
+Weights: [`QuanxinLi/TinyGuard-Injection`](https://huggingface.co/QuanxinLi/TinyGuard-Injection) ·
+Code & training pipeline: [`Quanxin-Lee/TinyGuard`](https://github.com/Quanxin-Lee/TinyGuard)
+
+```python
+# quickstart (transformers/MLX dual format) — see the GitHub repo for the full walkthrough
+```
+
+## Limitations
+
+- 5/40 misses on the adversarial set: JSON-encoded rules, URL-less "prioritize this" phrasing, direct asks inside authorized framing (red-team wording) — all weak-signal forms.
+- English training volume is lower than Chinese; English adversarial generalization needs strengthening.
+- Recommended to stack with a regex layer: this model handles semantics, regex handles known fingerprints.
+
+## Training details & data statement
+
+All data is synthetic/hand-written — no real user data. The full training pipeline, four audit scripts (three deep-scan rounds) and every dataset ship with the repository.

README.zh.md

@@ -0,0 +1,56 @@
+---
+license: apache-2.0
+language:
+  - zh
+  - en
+tags:
+  - safety
+  - guardrail
+  - prompt-injection
+  - security
+  - text-classification
+  - mlx
+metrics:
+  - f1
+  - accuracy
+---
+# TinyGuard-Injection（基座 + 微调）
+
+**从零训练的双语提示注入检测器（含间接注入）** · 9.1M 参数 · MLX/Metal · Apache-2.0（代码）· 训练数据全合成
+
+[English](MODEL_CARD-injections.md)
+
+## 模型描述
+
+部署在 LLM 应用输入口与 RAG 检索口的三分类护栏：`benign / direct injection / indirect injection`。与 Meta Llama Prompt Guard 2（22M/86M，**不含中文**）互补：本模型中英双语同权训练。
+
+- 基座：共享 TinyGuard-Encoder（与 TinyGuard-Command 同一预训练底座）。
+- 微调：12330 条双语标注，六类载体（代码与协作平台、邮件网页、超长 RAG 片段、工单客服、良性高难负例、隐藏字符与编码），含"最小差异对"与防过拒设计。
+
+## 成绩（全部为留出数据，从未参与训练）
+
+| 评测集 | 指标 | 数值 |
+|---|---|---|
+| 验证集 616 条 | acc / macro-F1 | **99.0% / 0.990** |
+| 对抗集 40 条（零宽字符/JSON 规则/日文载体/引用免责） | 干预 recall / precision / F1 | 75% / 88% / 0.81 |
+
+对照：Llama Prompt Guard 2-86M 官方卡报告英文注入检测 F1≈0.98，但无中文；本模型中文注入为第一梯队能力，英文对抗集略弱于其英文主场（预期内，9.1M vs 86M）。
+
+## 用法
+
+权重：[`QuanxinLi/TinyGuard-Injection`](https://huggingface.co/QuanxinLi/TinyGuard-Injection) ·
+代码与训练管线：[`Quanxin-Lee/TinyGuard`](https://github.com/Quanxin-Lee/TinyGuard)
+
+```python
+# quickstart（transformers/MLX 双格式）——完整流程见 GitHub 仓库
+```
+
+## 局限
+
+- 对抗集漏检 5/40：JSON 化规则、无 URL 的"prioritize this"类、授权框架下的直接索要（红队话术）——均为弱信号形态。
+- 英文部分训练量低于中文同类项目主场，英文对抗泛化待加强。
+- 建议与正则层叠用：本模型管语义，正则管已知指纹。
+
+## 训练细节与数据声明
+
+数据 100% 合成/人工编写，无真实用户数据。训练管线、审计脚本（含三轮深度扫描）与全部数据集随仓库开源。

config.json

@@ -0,0 +1,26 @@
+{
+ "architectures": [
+  "TinyGuardClassifier"
+ ],
+ "model_type": "tinyguard",
+ "hidden_size": 256,
+ "num_hidden_layers": 6,
+ "num_attention_heads": 4,
+ "intermediate_size": 1024,
+ "vocab_size": 16384,
+ "max_position_embeddings": 512,
+ "num_classes": 3,
+ "pad_token_id": 0,
+ "framework": "mlx",
+ "license": "apache-2.0",
+ "id2label": {
+  "0": "benign",
+  "1": "direct",
+  "2": "indirect"
+ },
+ "label2id": {
+  "benign": 0,
+  "direct": 1,
+  "indirect": 2
+ }
+}

inference.py

@@ -0,0 +1,5 @@
+"""TinyGuard inference quickstart (requires pip install mlx)"""
+import mlx.core as mx, mlx.nn as nn
+from huggingface_hub import hf_hub_download
+import json, sys
+# See the repo quickstart for the full walkthrough; placeholder stub here.

model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7cd58a93f479420a246b883667e88cdf75678b88ea97b9ace95a39d5a4a5c88c
+size 36246180