tronrover commited on
Commit
a4e8c3b
·
verified ·
1 Parent(s): 5b81fdc

Results on eight public sets: regulated-advice-bench for tax and legal, decontaminated safety and security test splits; Jev scored on the same rows

Browse files
Files changed (3) hide show
  1. README.md +42 -49
  2. assets/sev_results.png +2 -2
  3. results.json +80 -206
README.md CHANGED
@@ -17,11 +17,11 @@ with Gemma-4.
17
 
18
  ![How Sev works: text and question become one point, the closest answer wins, and the question decides where the point lands](assets/sev_teaser.png)
19
 
20
- ![Sev against Jev, Tev1-4B and Kev-4B on nine public benchmarks, and mean AUROC against latency per request](assets/sev_results.png)
21
 
22
- - **Level with Jev on public guard benchmarks.** On nine public, human-labelled safety, security, tax
23
- and legal sets, Sev averages **0.939 AUROC against Jev's 0.939**, with every model
24
- reading the same input. It is ahead of Jev on five of the nine: tax, AEGIS 2.0, Nemotron, PolyGuard and XSTest.
25
  - **Ask your own question.** Any yes/no or multiple-choice policy question, in plain words. The
26
  question is part of the input, so a new policy is a new question, not a new model.
27
  - **Open data, permissive licenses.** Every training source allows commercial use. No private or
@@ -143,48 +143,43 @@ the assistant's reply.
143
 
144
  ## Results
145
 
146
- AUROC on nine public, human-labelled sets. Every model gets the same text and the same question: on
147
- tax and legal, the user's message and the assistant's reply, read up to at least 1,024 tokens (which
148
- covers 99% of rows). Jev's scores come from the Jev-bench comparison on the same rows, where Jev was
149
- asked a one-line question per row. Tev1-4B (`togethercomputer/Tev1-4B-experimental`) and Kev-4B
 
 
150
  (`jaredpalmer/kev-4b`), two other open Jev-style models, were scored zero-shot with their own readouts
151
  and our questions. Bold is the best in each column.
152
 
153
- | Model | Tax | Legal | AEGIS 2.0 | Nemotron | PolyGuard | XSTest | jailbreak | PolyGuard sec. | deepset | Mean |
154
- |---|---|---|---|---|---|---|---|---|---|---|
155
- | **Sev** (this model) | **0.981** | 0.861 | **0.953** | **0.918** | **0.958** | **0.985** | 0.979 | 0.859 | 0.958 | **0.939** |
156
- | Jev (TypeSafe, jev-1.13.0) | 0.979 | **0.894** | 0.933 | 0.896 | 0.952 | 0.961 | **0.998** | **0.877** | 0.961 | 0.939 |
157
- | Tev1-4B (Together) | 0.980 | 0.836 | 0.940 | 0.892 | 0.918 | 0.944 | 0.978 | 0.704 | **0.978** | 0.908 |
158
- | Kev-4B (jaredpalmer) | 0.966 | 0.755 | 0.944 | 0.897 | 0.922 | 0.942 | 0.986 | 0.648 | 0.969 | 0.892 |
159
 
160
- Sev in more detail, with Alinia's public [regulated-advice-bench](https://huggingface.co/datasets/alinia/regulated-advice-bench)
161
- as two more columns. Best F1 picks the threshold on the test set itself, so it is an upper bound; F1
162
  and false-positive rate at 0.5 are the untuned default.
163
 
164
- | | Tax | Legal | AEGIS 2.0 | Nemotron | PolyGuard | XSTest | jailbreak | PolyGuard sec. | deepset | regulated-advice-bench tax | regulated-advice-bench legal |
165
- |---|---|---|---|---|---|---|---|---|---|---|---|
166
- | AUROC | 0.981 | 0.861 | 0.953 | 0.918 | 0.958 | 0.985 | 0.979 | 0.859 | 0.958 | 0.974 | 0.817 |
167
- | Best F1 | 0.964 | 0.768 | 0.857 | 0.776 | 0.848 | 0.924 | 0.924 | 0.778 | 0.912 | 0.959 | 0.768 |
168
- | F1 at 0.5 | 0.783 | 0.735 | 0.826 | 0.755 | 0.846 | 0.903 | 0.867 | 0.774 | 0.843 | 0.805 | 0.748 |
169
- | False-positive rate at 0.5 | 56% | 28% | 19% | 20% | 7% | 14% | 2% | 34% | 0% | 51% | 21% |
170
 
171
  **Reading the tables.**
172
  - **Sev has seen these distributions.** It was trained on the train splits of AEGIS 2.0, Nemotron,
173
- PolyGuardMix (which contains WildGuardMix, the source of PolyGuard's prompts), jailbreak-classification
174
- and deepset. Test rows that match a training text were removed, but these five sets are
175
- in-distribution for Sev. Tev1-4B and Kev-4B were trained on general decision data, not on safety or
176
  security data, and Jev's training data is not disclosed.
177
- - **PolyGuard security is partly a length test:** prompt length alone reaches about 0.98 AUROC on these
178
- rows.
179
  - **Legal advice is hard to label.** The human reviewers of the legal set agree only at
180
  Krippendorff's alpha ~0.37, so small gaps there are noise.
181
- - **Tax and legal come from Alinia's human-labelled advice benchmark.** The first two columns are the
182
- rows of the Jev-bench comparison; regulated-advice-bench is the public release of the same benchmark.
183
- They are not independent: 280 of regulated-advice-bench's 338 tax conversations and 223 of its 332 legal conversations also appear, in at least one language, among the Jev-bench rows.
184
 
185
  ## Choosing a threshold
186
 
187
- For safety and security, 0.5 is a reasonable default: the false-positive rate at 0.5 is 0% to 20% on six of these seven sets, and 34% on PolyGuard security, whose compliant rows are harmful requests without a jailbreak wrapper.
188
 
189
  For tax and legal advice, compliant replies score high, so 0.5 flags many of them: 51% of
190
  compliant tax replies and 21% of compliant legal replies on regulated-advice-bench. A higher
@@ -207,14 +202,14 @@ If you have even a few hundred labelled examples, set it on them.
207
  ## Speed
208
 
209
  One A100-40GB, bf16. Latency is the p50 per request at batch 1; throughput is at batch 32. All three
210
- models were timed on the same 200 texts, drawn evenly from the nine sets, with tax and legal as user
211
  message + reply. A request is one text and one question; answer embeddings are cached.
212
 
213
  | Model | Architecture | p50 per request (ms) | Throughput, batch 32 (texts/s) | Mean AUROC |
214
  |---|---|---|---|---|
215
- | Sev | Gemma-4-E4B-it + LoRA, embedding readout | 90 | 17 | 0.939 |
216
- | Kev-4B | Qwen3.5-4B-Base + LoRA + pointer head | 107 | 21 | 0.892 |
217
- | Tev1-4B | Qwen3.5-4B, LoRA SFT, letter output | 123 | 7 | 0.908 |
218
 
219
  ## Training
220
 
@@ -260,25 +255,23 @@ The model reads each one as user message + reply.
260
 
261
  | Set | Guard | Source | Rows | Positives |
262
  |---|---|---|---|---|
263
- | Tax advice (human labels) | tax | Alinia, not public (Jev-bench rows) | 2,871 | 1,467 |
264
- | Legal advice (human labels) | legal | Alinia, not public (Jev-bench rows) | 2,232 | 918 |
265
- | AEGIS 2.0 | safety | [nvidia/Aegis-AI-Content-Safety-Dataset-2.0](https://huggingface.co/datasets/nvidia/Aegis-AI-Content-Safety-Dataset-2.0) (test prompts) | 1,303 | 494 |
266
- | Nemotron, 12 languages | safety | [nvidia/Nemotron-Safety-Guard-Dataset-v3](https://huggingface.co/datasets/nvidia/Nemotron-Safety-Guard-Dataset-v3) (test) | 12,485 | 3,938 |
267
- | PolyGuard, 17 languages | safety | [ToxicityPrompts/PolyGuardPrompts](https://huggingface.co/datasets/ToxicityPrompts/PolyGuardPrompts) (test) | 13,464 | 3,434 |
268
- | XSTest | safety (over-refusal) | [Paul/XSTest](https://huggingface.co/datasets/Paul/XSTest) | 425 | 175 |
269
- | jailbreak-classification | security | [jackhhao/jailbreak-classification](https://huggingface.co/datasets/jackhhao/jailbreak-classification) | 359 | 110 |
270
- | PolyGuard security | security | [ToxicityPrompts/PolyGuardPrompts](https://huggingface.co/datasets/ToxicityPrompts/PolyGuardPrompts) (adversarial flag) | 5,933 | 2,295 |
271
- | deepset prompt injections | security | [deepset/prompt-injections](https://huggingface.co/datasets/deepset/prompt-injections) (test) | 115 | 59 |
272
  | regulated-advice-bench, tax | tax | [alinia/regulated-advice-bench](https://huggingface.co/datasets/alinia/regulated-advice-bench) `tax` | 3,042 | 1,593 |
273
  | regulated-advice-bench, legal | legal | [alinia/regulated-advice-bench](https://huggingface.co/datasets/alinia/regulated-advice-bench) `legal` | 2,988 | 1,719 |
274
-
275
- Rows, labels and the harm-type scope (hate, sexual, violence, wrongdoing) of the first nine follow the
276
- Jev-bench suite configs, including their fixed exclusion lists, which remove the same items for every
277
- system.
 
 
 
 
 
 
 
278
 
279
  ## Limitations
280
 
281
- - **Legal advice is the weak spot** (0.861 AUROC against Jev's 0.894). It rests on synthetic
282
  training data, and the human labels themselves are noisy.
283
  - **Thresholds.** See above: tax and legal need a higher threshold than 0.5.
284
  - **Long inputs.** The text is cut to its first 1,024 tokens. Training texts are single messages or one
 
17
 
18
  ![How Sev works: text and question become one point, the closest answer wins, and the question decides where the point lands](assets/sev_teaser.png)
19
 
20
+ ![Sev against Jev, Tev1-4B and Kev-4B on eight public benchmarks, and mean AUROC against latency per request](assets/sev_results.png)
21
 
22
+ - **Level with Jev on public guard benchmarks.** On eight public, human-labelled safety, security, tax
23
+ and legal sets, Sev averages **0.936 AUROC against Jev's 0.934**, with every model
24
+ reading the same input. It is ahead of Jev on six of the eight: tax, AEGIS 2.0, Nemotron, PolyGuard, XSTest and deepset.
25
  - **Ask your own question.** Any yes/no or multiple-choice policy question, in plain words. The
26
  question is part of the input, so a new policy is a new question, not a new model.
27
  - **Open data, permissive licenses.** Every training source allows commercial use. No private or
 
143
 
144
  ## Results
145
 
146
+ AUROC on eight public, human-labelled sets: Alinia's
147
+ [regulated-advice-bench](https://huggingface.co/datasets/alinia/regulated-advice-bench) for tax and
148
+ legal, and six safety and security test splits with every test prompt that is a copy, rewrite or
149
+ translation of a training prompt removed. Every model gets the same text and the same question: on tax
150
+ and legal, the user's message and the assistant's reply, read up to at least 1,024 tokens. We scored Jev
151
+ through its API, with one policy question and two lines of criteria per guard. Tev1-4B (`togethercomputer/Tev1-4B-experimental`) and Kev-4B
152
  (`jaredpalmer/kev-4b`), two other open Jev-style models, were scored zero-shot with their own readouts
153
  and our questions. Bold is the best in each column.
154
 
155
+ | Model | Tax | Legal | AEGIS 2.0 | Nemotron | PolyGuard | XSTest | PolyGuard sec. | deepset | Mean |
156
+ |---|---|---|---|---|---|---|---|---|---|
157
+ | **Sev** (this model) | **0.974** | 0.817 | **0.943** | **0.923** | **0.961** | **0.982** | 0.908 | 0.978 | **0.936** |
158
+ | Jev (TypeSafe, jev-1.13.0) | 0.961 | **0.903** | 0.923 | 0.905 | 0.942 | 0.977 | **0.910** | 0.955 | 0.934 |
159
+ | Tev1-4B (Together) | 0.973 | 0.798 | 0.928 | 0.898 | 0.916 | 0.935 | 0.738 | **0.979** | 0.896 |
160
+ | Kev-4B (jaredpalmer) | 0.970 | 0.744 | 0.930 | 0.900 | 0.911 | 0.932 | 0.707 | 0.970 | 0.883 |
161
 
162
+ Sev in more detail. Best F1 picks the threshold on the test set itself, so it is an upper bound; F1
 
163
  and false-positive rate at 0.5 are the untuned default.
164
 
165
+ | | Tax | Legal | AEGIS 2.0 | Nemotron | PolyGuard | XSTest | PolyGuard sec. | deepset |
166
+ |---|---|---|---|---|---|---|---|---|
167
+ | AUROC | 0.974 | 0.817 | 0.943 | 0.923 | 0.961 | 0.982 | 0.908 | 0.978 |
168
+ | Best F1 | 0.959 | 0.768 | 0.861 | 0.829 | 0.874 | 0.908 | 0.845 | 0.935 |
169
+ | F1 at 0.5 | 0.805 | 0.748 | 0.841 | 0.824 | 0.873 | 0.879 | 0.844 | 0.860 |
170
+ | False-positive rate at 0.5 | 51% | 21% | 20% | 21% | 7% | 14% | 26% | 0% |
171
 
172
  **Reading the tables.**
173
  - **Sev has seen these distributions.** It was trained on the train splits of AEGIS 2.0, Nemotron,
174
+ PolyGuardMix (which contains WildGuardMix, the source of PolyGuard's prompts) and deepset. Near-copies
175
+ of training prompts were removed from the test sets, but these four sets are in-distribution for Sev. Tev1-4B and Kev-4B were trained on general decision data, not on safety or
 
176
  security data, and Jev's training data is not disclosed.
 
 
177
  - **Legal advice is hard to label.** The human reviewers of the legal set agree only at
178
  Krippendorff's alpha ~0.37, so small gaps there are noise.
 
 
 
179
 
180
  ## Choosing a threshold
181
 
182
+ For safety and security, 0.5 is a reasonable default: the false-positive rate at 0.5 is 0% to 26% on these six sets.
183
 
184
  For tax and legal advice, compliant replies score high, so 0.5 flags many of them: 51% of
185
  compliant tax replies and 21% of compliant legal replies on regulated-advice-bench. A higher
 
202
  ## Speed
203
 
204
  One A100-40GB, bf16. Latency is the p50 per request at batch 1; throughput is at batch 32. All three
205
+ models were timed on the same 200 texts, drawn evenly from the evaluation sets, with tax and legal as user
206
  message + reply. A request is one text and one question; answer embeddings are cached.
207
 
208
  | Model | Architecture | p50 per request (ms) | Throughput, batch 32 (texts/s) | Mean AUROC |
209
  |---|---|---|---|---|
210
+ | Sev | Gemma-4-E4B-it + LoRA, embedding readout | 90 | 17 | 0.936 |
211
+ | Kev-4B | Qwen3.5-4B-Base + LoRA + pointer head | 107 | 21 | 0.883 |
212
+ | Tev1-4B | Qwen3.5-4B, LoRA SFT, letter output | 123 | 7 | 0.896 |
213
 
214
  ## Training
215
 
 
255
 
256
  | Set | Guard | Source | Rows | Positives |
257
  |---|---|---|---|---|
 
 
 
 
 
 
 
 
 
258
  | regulated-advice-bench, tax | tax | [alinia/regulated-advice-bench](https://huggingface.co/datasets/alinia/regulated-advice-bench) `tax` | 3,042 | 1,593 |
259
  | regulated-advice-bench, legal | legal | [alinia/regulated-advice-bench](https://huggingface.co/datasets/alinia/regulated-advice-bench) `legal` | 2,988 | 1,719 |
260
+ | AEGIS 2.0 | safety | [nvidia/Aegis-AI-Content-Safety-Dataset-2.0](https://huggingface.co/datasets/nvidia/Aegis-AI-Content-Safety-Dataset-2.0) (test prompts) | 1,220 | 544 |
261
+ | Nemotron, 12 languages | safety | [nvidia/Nemotron-Safety-Guard-Dataset-v3](https://huggingface.co/datasets/nvidia/Nemotron-Safety-Guard-Dataset-v3) (test) | 14,298 | 6,268 |
262
+ | PolyGuard, 17 languages | safety | [ToxicityPrompts/PolyGuardPrompts](https://huggingface.co/datasets/ToxicityPrompts/PolyGuardPrompts) (test) | 24,051 | 8,571 |
263
+ | XSTest | safety (over-refusal) | [Paul/XSTest](https://huggingface.co/datasets/Paul/XSTest) | 371 | 134 |
264
+ | PolyGuard security | security | [ToxicityPrompts/PolyGuardPrompts](https://huggingface.co/datasets/ToxicityPrompts/PolyGuardPrompts) (adversarial flag) | 28,583 | 13,769 |
265
+ | deepset prompt injections | security | [deepset/prompt-injections](https://huggingface.co/datasets/deepset/prompt-injections) (test) | 95 | 49 |
266
+
267
+ The safety sets are scoped to four harm types (hate, sexual, violence, wrongdoing). Every safety and
268
+ security set keeps its test split's labels, minus each test prompt whose nearest training prompt has
269
+ cosine similarity of 0.95 or more under EmbeddingGemma-2, or is an exact copy. Every model is scored on
270
+ the same rows.
271
 
272
  ## Limitations
273
 
274
+ - **Legal advice is the weak spot** (0.817 AUROC against Jev's 0.903). It rests on synthetic
275
  training data, and the human labels themselves are noisy.
276
  - **Thresholds.** See above: tax and legal need a higher threshold than 0.5.
277
  - **Long inputs.** The text is cut to its first 1,024 tokens. Training texts are single messages or one
assets/sev_results.png CHANGED

Git LFS Details

  • SHA256: 77b63ca630714f95da23d4428ab93c13ea6749f5b15115e0b100efa8e6c42bc8
  • Pointer size: 131 Bytes
  • Size of remote file: 213 kB

Git LFS Details

  • SHA256: 3f77fb7f7ad90b1f78c161057077e5855149e4608fd28c8b53e53a01e38977d8
  • Pointer size: 131 Bytes
  • Size of remote file: 191 kB
results.json CHANGED
@@ -1,123 +1,47 @@
1
  {
2
  "auroc_same_input": {
3
  "Sev": {
4
- "alinia_public_tax": 0.9808323477375968,
5
- "alinia_public_legal": 0.861346551135252,
6
- "aegis": 0.9533174359307988,
7
- "nemotron": 0.9182700258119252,
8
- "polyguard": 0.9581884370185889,
9
- "xstest": 0.9854628571428571,
10
- "jailbreak": 0.9790069368382621,
11
- "polyguard_sec": 0.8591660169045934,
12
- "deepset": 0.9579297820823245
13
  },
14
  "Jev (TypeSafe, jev-1.13.0)": {
15
- "alinia_public_tax": 0.979,
16
- "alinia_public_legal": 0.894,
17
- "aegis": 0.933,
18
- "nemotron": 0.896,
19
- "polyguard": 0.952,
20
- "xstest": 0.961,
21
- "jailbreak": 0.998,
22
- "polyguard_sec": 0.877,
23
- "deepset": 0.961
24
  },
25
  "Tev1-4B": {
26
- "alinia_public_tax": 0.9804371384125985,
27
- "alinia_public_legal": 0.8358104276718297,
28
- "aegis": 0.9395464986513065,
29
- "nemotron": 0.8921018117310652,
30
- "polyguard": 0.9176947462795073,
31
- "xstest": 0.9442628571428571,
32
- "jailbreak": 0.9776925885359621,
33
- "polyguard_sec": 0.7038263500379078,
34
- "deepset": 0.9776029055690073
35
  },
36
  "Kev-4B": {
37
- "alinia_public_tax": 0.9664853753129145,
38
- "alinia_public_legal": 0.755493876901344,
39
- "aegis": 0.9438790829884449,
40
- "nemotron": 0.896841311772749,
41
- "polyguard": 0.9223887597545163,
42
- "xstest": 0.9417142857142857,
43
- "jailbreak": 0.986126323475721,
44
- "polyguard_sec": 0.6481888705638019,
45
- "deepset": 0.9694309927360775
46
  }
47
  },
48
  "sev": {
49
- "alinia_public_tax": {
50
- "auroc": 0.9808323477375968,
51
- "best_f1": 0.9639734172787688,
52
- "f1@0.5": 0.7833827893175074,
53
- "fpr@0.5": 0.5612535612535613,
54
- "n": 2871,
55
- "positives": 1467
56
- },
57
- "alinia_public_legal": {
58
- "auroc": 0.861346551135252,
59
- "best_f1": 0.7675977653631285,
60
- "f1@0.5": 0.7345526445872467,
61
- "fpr@0.5": 0.2754946727549467,
62
- "n": 2232,
63
- "positives": 918
64
- },
65
- "aegis": {
66
- "auroc": 0.9533174359307988,
67
- "best_f1": 0.8568507157464212,
68
- "f1@0.5": 0.8256549232158988,
69
- "fpr@0.5": 0.19283065512978986,
70
- "n": 1303,
71
- "positives": 494
72
- },
73
- "nemotron": {
74
- "auroc": 0.9182700258119252,
75
- "best_f1": 0.7760338814150473,
76
- "f1@0.5": 0.7547501372872049,
77
- "fpr@0.5": 0.20252720252720252,
78
- "n": 12485,
79
- "positives": 3938
80
- },
81
- "polyguard": {
82
- "auroc": 0.9581884370185889,
83
- "best_f1": 0.8476485497043087,
84
- "f1@0.5": 0.84625087596356,
85
- "fpr@0.5": 0.06799601196410768,
86
- "n": 13464,
87
- "positives": 3434
88
- },
89
- "xstest": {
90
- "auroc": 0.9854628571428571,
91
- "best_f1": 0.9239130434782609,
92
- "f1@0.5": 0.9028871391076115,
93
- "fpr@0.5": 0.136,
94
- "n": 425,
95
- "positives": 175
96
- },
97
- "jailbreak": {
98
- "auroc": 0.9790069368382621,
99
- "best_f1": 0.9237668161434978,
100
- "f1@0.5": 0.8669950738916257,
101
- "fpr@0.5": 0.020080321285140562,
102
- "n": 359,
103
- "positives": 110
104
- },
105
- "polyguard_sec": {
106
- "auroc": 0.8591660169045934,
107
- "best_f1": 0.7775787965616044,
108
- "f1@0.5": 0.7737556561085973,
109
- "fpr@0.5": 0.33754810335349095,
110
- "n": 5933,
111
- "positives": 2295
112
- },
113
- "deepset": {
114
- "auroc": 0.9579297820823245,
115
- "best_f1": 0.9122807017543859,
116
- "f1@0.5": 0.8431372549019608,
117
- "fpr@0.5": 0.0,
118
- "n": 115,
119
- "positives": 59
120
- },
121
  "rab_tax": {
122
  "auroc": 0.974301388450246,
123
  "best_f1": 0.9590377113133939,
@@ -133,6 +57,54 @@
133
  "fpr@0.5": 0.2127659574468085,
134
  "n": 2988,
135
  "positives": 1719
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
136
  }
137
  },
138
  "thresholds": {
@@ -178,48 +150,6 @@
178
  "recall": 0.9409918392969241,
179
  "f1": 0.9264524103831892
180
  }
181
- },
182
- "alinia_public_tax": {
183
- "0.5": {
184
- "fpr": 0.5612535612535613,
185
- "recall": 0.9897750511247444,
186
- "f1": 0.7833827893175074
187
- },
188
- "0.8": {
189
- "fpr": 0.48646723646723644,
190
- "recall": 0.9822767552828903,
191
- "f1": 0.8025619604566973
192
- },
193
- "0.9": {
194
- "fpr": 0.4472934472934473,
195
- "recall": 0.9802317655078391,
196
- "f1": 0.8140390602887064
197
- },
198
- "0.95": {
199
- "fpr": 0.40883190883190884,
200
- "recall": 0.978186775732788,
201
- "f1": 0.8256616800920599
202
- },
203
- "0.98": {
204
- "fpr": 0.3425925925925926,
205
- "recall": 0.9747784594410361,
206
- "f1": 0.8466548253404381
207
- },
208
- "0.99": {
209
- "fpr": 0.297008547008547,
210
- "recall": 0.9713701431492843,
211
- "f1": 0.8612873980054397
212
- },
213
- "0.995": {
214
- "fpr": 0.24715099715099714,
215
- "recall": 0.9693251533742331,
216
- "f1": 0.8788627935723115
217
- },
218
- "0.999": {
219
- "fpr": 0.12962962962962962,
220
- "recall": 0.9591002044989775,
221
- "f1": 0.9208115183246073
222
- }
223
  }
224
  },
225
  "legal": {
@@ -264,65 +194,9 @@
264
  "recall": 0.5648632926119838,
265
  "f1": 0.7018431514275388
266
  }
267
- },
268
- "alinia_public_legal": {
269
- "0.5": {
270
- "fpr": 0.2754946727549467,
271
- "recall": 0.809368191721133,
272
- "f1": 0.7345526445872467
273
- },
274
- "0.8": {
275
- "fpr": 0.2359208523592085,
276
- "recall": 0.7973856209150327,
277
- "f1": 0.746938775510204
278
- },
279
- "0.9": {
280
- "fpr": 0.21232876712328766,
281
- "recall": 0.7919389978213508,
282
- "f1": 0.7557172557172557
283
- },
284
- "0.95": {
285
- "fpr": 0.1917808219178082,
286
- "recall": 0.7788671023965141,
287
- "f1": 0.7586206896551724
288
- },
289
- "0.98": {
290
- "fpr": 0.1750380517503805,
291
- "recall": 0.7647058823529411,
292
- "f1": 0.7589189189189189
293
- },
294
- "0.99": {
295
- "fpr": 0.15449010654490106,
296
- "recall": 0.7538126361655774,
297
- "f1": 0.7633756205184776
298
- },
299
- "0.995": {
300
- "fpr": 0.136986301369863,
301
- "recall": 0.7407407407407407,
302
- "f1": 0.7649043869516311
303
- },
304
- "0.999": {
305
- "fpr": 0.09817351598173515,
306
- "recall": 0.7004357298474946,
307
- "f1": 0.7609467455621302
308
- }
309
  }
310
  }
311
  },
312
- "benchmark_overlap": {
313
- "tax": {
314
- "rab_items": 338,
315
- "items_sharing_a_reply": 280,
316
- "shared_replies": 1299,
317
- "jevbench_rows": 2871
318
- },
319
- "legal": {
320
- "rab_items": 332,
321
- "items_sharing_a_reply": 223,
322
- "shared_replies": 1151,
323
- "jevbench_rows": 2232
324
- }
325
- },
326
  "latency_a100": {
327
  "Sev": {
328
  "p50_ms": 90.37737251492217,
 
1
  {
2
  "auroc_same_input": {
3
  "Sev": {
4
+ "rab_tax": 0.974301388450246,
5
+ "rab_legal": 0.8171577937399234,
6
+ "aegis": 0.9427835668290986,
7
+ "nemotron": 0.9234368306947225,
8
+ "polyguard": 0.9610062942854292,
9
+ "xstest": 0.9820202783550601,
10
+ "polyguard_sec": 0.9078515809218515,
11
+ "deepset": 0.9778172138420587
 
12
  },
13
  "Jev (TypeSafe, jev-1.13.0)": {
14
+ "rab_tax": 0.960554652276588,
15
+ "rab_legal": 0.9027120519700322,
16
+ "aegis": 0.9226037678384963,
17
+ "nemotron": 0.904750045895219,
18
+ "polyguard": 0.9419810266999138,
19
+ "xstest": 0.977029409912463,
20
+ "polyguard_sec": 0.9097988686458153,
21
+ "deepset": 0.9554125998225377
 
22
  },
23
  "Tev1-4B": {
24
+ "rab_tax": 0.9727526007719245,
25
+ "rab_legal": 0.7977687377573507,
26
+ "aegis": 0.9276929059345632,
27
+ "nemotron": 0.8978858695177069,
28
+ "polyguard": 0.9160940029128933,
29
+ "xstest": 0.9351501983752124,
30
+ "polyguard_sec": 0.7384812236283134,
31
+ "deepset": 0.9791481810115351
 
32
  },
33
  "Kev-4B": {
34
+ "rab_tax": 0.9698135866153552,
35
+ "rab_legal": 0.7443278685217962,
36
+ "aegis": 0.9304788113470239,
37
+ "nemotron": 0.9002001607723431,
38
+ "polyguard": 0.9105472580907253,
39
+ "xstest": 0.9324264752188425,
40
+ "polyguard_sec": 0.706694782313543,
41
+ "deepset": 0.9702750665483585
 
42
  }
43
  },
44
  "sev": {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
45
  "rab_tax": {
46
  "auroc": 0.974301388450246,
47
  "best_f1": 0.9590377113133939,
 
57
  "fpr@0.5": 0.2127659574468085,
58
  "n": 2988,
59
  "positives": 1719
60
+ },
61
+ "aegis": {
62
+ "auroc": 0.9427835668290986,
63
+ "best_f1": 0.861111111111111,
64
+ "f1@0.5": 0.8407534246575342,
65
+ "fpr@0.5": 0.19674556213017752,
66
+ "n": 1220,
67
+ "positives": 544
68
+ },
69
+ "nemotron": {
70
+ "auroc": 0.9234368306947225,
71
+ "best_f1": 0.8286759554759865,
72
+ "f1@0.5": 0.8235468564650059,
73
+ "fpr@0.5": 0.20747198007471981,
74
+ "n": 14298,
75
+ "positives": 6268
76
+ },
77
+ "polyguard": {
78
+ "auroc": 0.9610062942854292,
79
+ "best_f1": 0.8741775836972343,
80
+ "f1@0.5": 0.8728405218004466,
81
+ "fpr@0.5": 0.06589147286821706,
82
+ "n": 24051,
83
+ "positives": 8571
84
+ },
85
+ "xstest": {
86
+ "auroc": 0.9820202783550601,
87
+ "best_f1": 0.9084507042253521,
88
+ "f1@0.5": 0.8791946308724832,
89
+ "fpr@0.5": 0.13924050632911392,
90
+ "n": 371,
91
+ "positives": 134
92
+ },
93
+ "polyguard_sec": {
94
+ "auroc": 0.9078515809218515,
95
+ "best_f1": 0.8446201789364339,
96
+ "f1@0.5": 0.8437890856428149,
97
+ "fpr@0.5": 0.2561765897124342,
98
+ "n": 28583,
99
+ "positives": 13769
100
+ },
101
+ "deepset": {
102
+ "auroc": 0.9778172138420587,
103
+ "best_f1": 0.9347826086956522,
104
+ "f1@0.5": 0.8604651162790697,
105
+ "fpr@0.5": 0.0,
106
+ "n": 95,
107
+ "positives": 49
108
  }
109
  },
110
  "thresholds": {
 
150
  "recall": 0.9409918392969241,
151
  "f1": 0.9264524103831892
152
  }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
153
  }
154
  },
155
  "legal": {
 
194
  "recall": 0.5648632926119838,
195
  "f1": 0.7018431514275388
196
  }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
197
  }
198
  }
199
  },
 
 
 
 
 
 
 
 
 
 
 
 
 
 
200
  "latency_a100": {
201
  "Sev": {
202
  "p50_ms": 90.37737251492217,