Update README.md
Browse files
README.md
CHANGED
|
@@ -105,3 +105,155 @@ Classifier prediction
|
|
| 105 |
Architecture:
|
| 106 |

|
| 107 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 105 |
Architecture:
|
| 106 |

|
| 107 |
|
| 108 |
+
Why Shared Encoder?
|
| 109 |
+
|
| 110 |
+
Traditional guardrail systems may run:
|
| 111 |
+
|
| 112 |
+
Language model
|
| 113 |
+
Embedding model
|
| 114 |
+
Classifier model
|
| 115 |
+
Policy model
|
| 116 |
+
This increases:
|
| 117 |
+
|
| 118 |
+
CPU/GPU utilization
|
| 119 |
+
latency
|
| 120 |
+
memory consumption
|
| 121 |
+
infrastructure complexity
|
| 122 |
+
HomayShield avoids this by sharing the encoder.
|
| 123 |
+
|
| 124 |
+
Advantages:
|
| 125 |
+
|
| 126 |
+
Lower CPU usage
|
| 127 |
+
Faster inference
|
| 128 |
+
Lower memory footprint
|
| 129 |
+
Better scalability
|
| 130 |
+
Consistent semantic representation
|
| 131 |
+
Supported Languages
|
| 132 |
+
|
| 133 |
+
Current supported languages:
|
| 134 |
+
|
| 135 |
+
Turkish (tr)
|
| 136 |
+
English (en)
|
| 137 |
+
Inference begins with language detection.
|
| 138 |
+
|
| 139 |
+
If input language is unsupported:
|
| 140 |
+
|
| 141 |
+
Reject or
|
| 142 |
+
Skip evaluation
|
| 143 |
+
Detection Strategy
|
| 144 |
+
|
| 145 |
+
HomayShield combines two detection mechanisms.
|
| 146 |
+
|
| 147 |
+
1) Semantic Detection
|
| 148 |
+
|
| 149 |
+
Semantic similarity compares incoming prompt embeddings against known malicious attack embeddings.
|
| 150 |
+
|
| 151 |
+
Useful for detecting:
|
| 152 |
+
|
| 153 |
+
similar attacks
|
| 154 |
+
prompt injection variants
|
| 155 |
+
jailbreak attempts
|
| 156 |
+
semantic anomalies
|
| 157 |
+
adversarial patterns
|
| 158 |
+
2) Classifier Detection
|
| 159 |
+
|
| 160 |
+
Classifier predicts attack probability using shared embeddings.
|
| 161 |
+
|
| 162 |
+
Useful for detecting:
|
| 163 |
+
|
| 164 |
+
known attack patterns
|
| 165 |
+
learned malicious behavior
|
| 166 |
+
structured adversarial prompts
|
| 167 |
+
Inference Modes
|
| 168 |
+
|
| 169 |
+
HomayShield supports 3 inference strategies.
|
| 170 |
+
|
| 171 |
+
Option 1 — OR Logic
|
| 172 |
+
|
| 173 |
+
Security-first mode.
|
| 174 |
+
|
| 175 |
+
if semantic_score >= semantic_threshold or classifier_score >= classifier_threshold:
|
| 176 |
+
ATTACK
|
| 177 |
+
else:
|
| 178 |
+
NORMAL
|
| 179 |
+
Best for:
|
| 180 |
+
|
| 181 |
+
strict environments
|
| 182 |
+
low false negatives
|
| 183 |
+
Option 2 — Weighted Fusion
|
| 184 |
+
|
| 185 |
+
Balanced mode.
|
| 186 |
+
|
| 187 |
+
fusion_score = semantic_weight * semantic_score + classifier_weight * classifier_score
|
| 188 |
+
Best for:
|
| 189 |
+
|
| 190 |
+
balanced security
|
| 191 |
+
tunable sensitivity
|
| 192 |
+
Option 3 — Single Signal
|
| 193 |
+
|
| 194 |
+
Choose one:
|
| 195 |
+
|
| 196 |
+
semantic only
|
| 197 |
+
classifier only
|
| 198 |
+
Useful for benchmarking or lightweight deployments.
|
| 199 |
+
|
| 200 |
+
Training Pipeline
|
| 201 |
+
|
| 202 |
+
Training consists of 2 stages.
|
| 203 |
+
|
| 204 |
+
Stage 1 — Encoder Training
|
| 205 |
+
|
| 206 |
+
The encoder is trained using similarity learning.
|
| 207 |
+
|
| 208 |
+
Goal:
|
| 209 |
+
|
| 210 |
+
similar attacks cluster together
|
| 211 |
+
similar normal prompts cluster together
|
| 212 |
+
attacks and normal prompts separate clearly
|
| 213 |
+
Loss:
|
| 214 |
+
|
| 215 |
+
CosineEmbeddingLoss
|
| 216 |
+
Stage 2 — Classifier Training
|
| 217 |
+
|
| 218 |
+
After encoder training:
|
| 219 |
+
|
| 220 |
+
embeddings are extracted
|
| 221 |
+
classifier head is trained on embeddings
|
| 222 |
+
Loss:
|
| 223 |
+
|
| 224 |
+
BCEWithLogitsLoss
|
| 225 |
+
Outputs:
|
| 226 |
+
|
| 227 |
+
trained encoder
|
| 228 |
+
trained classifier
|
| 229 |
+
attack embedding bank
|
| 230 |
+
normal embedding bank
|
| 231 |
+
Training Command
|
| 232 |
+
|
| 233 |
+
python training_final.py \
|
| 234 |
+
--train /home/asimyil/train.jsonl \
|
| 235 |
+
--output-dir /home/asimyil/HomayShield_v5
|
| 236 |
+
Training Dataset
|
| 237 |
+
|
| 238 |
+
HomayShield was trained using a large dataset of:
|
| 239 |
+
|
| 240 |
+
benign prompts
|
| 241 |
+
adversarial prompts
|
| 242 |
+
Turkish prompts
|
| 243 |
+
English prompts
|
| 244 |
+
mixed-language prompts
|
| 245 |
+
Dataset includes attack categories such as:
|
| 246 |
+
|
| 247 |
+
Direct prompt injection
|
| 248 |
+
Jailbreak attacks
|
| 249 |
+
Instruction override
|
| 250 |
+
Prompt leakage
|
| 251 |
+
Data exfiltration
|
| 252 |
+
Obfuscation attacks
|
| 253 |
+
Multi-turn attacks
|
| 254 |
+
Roleplay attacks
|
| 255 |
+
Tool abuse
|
| 256 |
+
Code injection
|
| 257 |
+
Long context attacks
|
| 258 |
+
Hard negative samples
|
| 259 |
+
This helps improve detection robustness in real-world enterprise environments.
|