hubin/jev-guard-v3.2-2b

Jev Guard v3.2 · 2B

Website · 中文版

Jev Guard for Hermes · 下载与安装（cys做的）

选择你的系统，下载安装器后按教程执行。安装器会自动下载插件和独立兼容运行环境，支持默认安装与指定 profile。

下载内容	入口
Windows（WSL）安装器 · cys	下载 Windows（WSL）安装器
Linux 安装器 · cys	下载 Linux 安装器
中文安装教程 · cys	从下载到启动，含默认安装、指定 profile 和更新

本次 Hermes 插件改进、兼容安装适配及教程贡献标记：cys。-cys 是安装入口的贡献标记；原文件名及旧链接继续保留，项目与安装包版本号不变。

服务状态（2026-10-22）：此前托管审核服务器已离线，目前未提供新的可用 API 地址。安装文件可下载；实际对话需要可用的 Jev 审核服务和大模型服务配置。首次安装即使跳过健康检查，也必须填写服务地址，详见教程。

Watch the introduction with English/Chinese captions

Your policy tree. Jev reviews each agent step.

Maintain an editable policy tree for content, cyber, privacy and compliance. Route every user request and proposed tool action from the root to a leaf, then classify its safety and category before the harness proceeds. Users can change routing descriptions, leaf taxonomies and review rules. A blocked user request never reaches the assistant model; a blocked tool action never executes, and the interception appears in the conversation.

Wenbin Hu · HKUST × ModeIO

93.20% full-path routing accuracy · 91.78% overall safety accuracy · 58.0 ms mean native forward latency.

Routing uses 1,000 held-out cases; safety is 73,415/79,987 supervised records. Forward latency is a case-weighted mean over 147,643 records and excludes the complete routing-plus-review sequence.

Model information

Item	Configuration
Base model	Qwen/Qwen3.5-2B
Adaptation	Rank-8 LoRA on language-backbone attention projections
Checkpoint	v3.2 continuation from v3.1; selected update 1,508 after one epoch
Context	16,384 tokens; oversized serving requests rejected
Routing / single choice	Candidate-conditioned softmax
Multi-label categories	Independent candidate sigmoid probabilities
Safety	Linear two-class head: unsafe / safe
Ordinal score	Scalar severity plus three ordered learned thresholds
Serving	Text only; native multimodal training/evaluation requires original media

The package contains the adapter, typed heads, routing tree and standalone inference code. Download the Qwen base weights separately. This is a classifier, not a chat model; it does not generate a rationale. A category/severity prediction is not an authorization decision.

Training data

v3.2 trains on 377,930 native task cases + 8,000 router cases, including retained GSPR3 and Omni examples plus cybersecurity and privacy sources. Code tasks retain complete source functions from PrimeVul/DiverseVul; other tasks cover phishing, prompt injection, vulnerability severity/root cause, scoped security assistance, privacy-policy practices, information flow and policy compliance. v3.1 introduced meaningful CWE names and hierarchical router supervision. v3.2 unifies English leaf taxonomies, merges content/privacy branches, removes the agent branch and uses category masks: unknown labels are ignored, weak rule labels have weight 0.25.

The full native validation corpus has 65,530 records; checkpoint selection uses 2,048 stratified native development records plus 1,000 routing records. Router train/validation/test = 8,000/1,000/1,000. The current data archive is private: hubin/jev-guard-training. It preserves versioned data, provenance, hashes and original media references. Source-specific licensing restrictions remain applicable.

The continuation uses global batch 256, maximum microbatch 32, 65,536 padded tokens per GPU, seed 42, adapter LR 2e-5 and head LR 5e-5 on four GPUs. A validation plateau was not established for this one-epoch run. See training-config.json and checkpoint/identity.json for the recorded configuration and identity.

Evaluation

Domain	Task records	Safety-labeled records	Safety accuracy	Category micro-F1
Content	11,909	11,909	85.20%	61.86%
Cyber	61,972	57,478	93.77%	46.96%
Privacy	69,051	5,889	82.92%	78.40%
Compliance	4,711	4,711	95.31%	58.17%

Native evaluation covers 147,643 task-case records across 109 benchmark views. Safety uses only safety-supervised records; category micro-F1 uses only category-supervised records. These are task records, not necessarily independent source examples. The numbers above are ordinary safety accuracy, not balanced accuracy. Original v3.1 test inputs, candidate strings, gold labels, modes and supervision are retained; no mapped-gold evaluation is substituted.

Full-path routing accuracy is 93.20% (932/1,000): greedy routing from root, without gold intermediate nodes or probability/margin filtering, with explicit caller audit context. Ordinal severity exact accuracy is 15.28% on 1,466 cases, normalized MAE 0.1727. Controlled AgentDojo action-state replay caught 49/52 malicious proposals and allowed 87/97 benign proposals; 9 benign non-allow decisions and 1 API error remained. No attacker action was executed; this is not an end-to-end attack-success evaluation.

Per-benchmark results and denominators: evaluation-summary.json. Single-choice, multi-label and ordinal probabilities match the deployed checkpoint in inference-parity.json.

Inference

Hosted HTTPS API

Service status (2026-10-22): the hosted reviewer is offline. The previous temporary tunnel below is historical and currently unavailable. Supply a working reviewer URL or self-host; installing the plugin does not start the hosted server.

Previous endpoint (not a working quick start):

curl -fsS https://theft-anticipated-won-threats.trycloudflare.com/health
curl -fsS https://theft-anticipated-won-threats.trycloudflare.com/predict \
  -H 'Content-Type: application/json' \
  -d '{"input":"Classify this request: explain gravity. Educational explanations are allowed.","options":["No applicable risk category","Unauthorized credential access"],"mode":"single","safety_applicable":true}'

This is a temporary hosted preview endpoint. Requests use the existing v3.2 checkpoint (update 1,508); inputs are not written to gateway logs. It accepts text up to 16,384 tokens without truncation. A full routing path makes several /predict calls. Capacity limits return HTTP 429; try again later. The endpoint may change when the tunnel is recreated.

Self-hosted inference

python3 -m venv .venv
source .venv/bin/activate
python -m pip install huggingface_hub
hf download hubin/jev-guard-v3.2-2b --local-dir jev-model
cd jev-model
python -m pip install -r requirements.txt
CUDA_VISIBLE_DEVICES=0 python serve.py --checkpoint checkpoint \
  --base-model Qwen/Qwen3.5-2B --port 29660

from jev_inference import JevClassifier
model = JevClassifier("checkpoint", base_model="Qwen/Qwen3.5-2B")
result = model.predict(
    "Assess this request: explain what gravity is.",
    options=["No applicable risk category", "Unauthorized credential access"],
    mode="single", safety_applicable=True,
)
print(result["safety"], result["safety_probs"], result["probabilities"])
# Multi-label: mode="multi". Severity: mode="score", options in this order:
# ["low", "medium", "high", "critical"].

curl -fsS http://127.0.0.1:29660/predict \
  -H 'Content-Type: application/json' \
  -d '{"input":"Assess this request: explain gravity.","options":["No applicable risk category","Unauthorized credential access"],"mode":"single","safety_applicable":true}'

The self-hosted server binds loopback. For your own remote deployment set JEV_API_KEY, use an authenticated HTTPS proxy and pass the API key through the client environment. Hugging Face hosts the downloadable weights; the hosted API above runs separately.

Use in Hermes（cys做的）

中文分步安装教程（cys） covers both systems, default/named profiles, provider setup, updates, and service-offline installation.

The plugin keeps the existing 0.1.1 wheel version. It includes the separate permission configuration beside the policy tree, shared review/execution rules, final execution checks, single-use human approval, and the Exa keyless response-format fixes. The plugin manifest stays at 0.1.0 and the isolated Hermes source stays at 0.21.1.

This download update adds editable node execution rules, explicit task-evidence boundaries through /jev-task, and decision explanations that distinguish request review, admission, action review, approval replies and execution checks. Audit links use recorded identities; viewing history does not retain or restore revoked authorization.

New installations include two text-review rules under cyber and compliance: check the scope of actions against actual security-testing targets, and check the supplied requirements when the user explicitly asks to act under a particular policy or contract. These rules do not grant file, network or credential permissions. Translation, explanation and authorized evidence gathering are not rejected merely because execution details or policy evidence are still being collected. Updates preserve an existing profile's policy tree; configure these rules in /safety-policy if desired.

Use either installer below. Both support the default home and --profile NAME, preserve existing policies, permissions and connection settings on update, and install the necessary Hermes support in ~/.hermes/jev-runtime. They do not replace your normal hermes executable or modify its source. A named profile gets its own plugin, policy and permission files.

Prerequisites: Linux (or an existing Windows WSL Ubuntu distro), Python 3.11–3.13 with venv/pip, or uv. The installer can reuse Python already managed by Hermes. Python dependencies are downloaded on first installation. A working Jev reviewer and your assistant provider credentials are still required for conversations.

Linux

curl -fL https://huggingface.co/hubin/jev-guard-v3.2-2b/resolve/main/downloads/install-hermes-jev-linux-cys.sh -o install-hermes-jev-linux-cys.sh
# Set this to your CURRENT working reviewer, not the historical tunnel above.
JEV_ENDPOINT='https://YOUR-JEV-SERVER'
bash install-hermes-jev-linux-cys.sh --endpoint "$JEV_ENDPOINT"
~/.local/bin/jev-hermes

# Install/update only a named profile:
bash install-hermes-jev-linux-cys.sh --profile work --endpoint "$JEV_ENDPOINT"
~/.local/bin/jev-hermes --profile work

Windows (WSL)

Run in PowerShell 7. This uses an existing WSL Ubuntu; it does not install or reset Windows/WSL.

Invoke-WebRequest 'https://huggingface.co/hubin/jev-guard-v3.2-2b/resolve/main/downloads/install-hermes-jev-windows-cys.ps1' -OutFile "$env:TEMP/install-hermes-jev-windows-cys.ps1"
$jevEndpoint = 'https://YOUR-JEV-SERVER'
& "$env:TEMP/install-hermes-jev-windows-cys.ps1" -Endpoint $jevEndpoint
# Named profile (replace Ubuntu only if your distro has another name):
& "$env:TEMP/install-hermes-jev-windows-cys.ps1" -Distro Ubuntu -Profile work -Endpoint $jevEndpoint

Then run ~/.local/bin/jev-hermes --profile work inside Ubuntu. -HermesHome accepts a Linux base-home path. -SkipHealthCheck / Linux --skip-health-check explicitly installs without live service validation; it does not make an unavailable reviewer usable. A first installation still requires -Endpoint / --endpoint; only updates with saved endpoint settings may omit it. The tutorial explains how to use an explicit local placeholder when preparing an installation while the service is offline.

Configure, update and inspect

The new launchers use the isolated compatible Hermes. For the native command, run ~/.hermes/jev-runtime/bin/hermes -p work jev-chat (omit -p work for default). Configure an assistant provider with the same executable and setup. Existing profiles retain their provider configuration; a new profile needs its own setup. Plain hermes continues to use your existing Hermes installation and is not the supported entry for these new execution checks.

In chat, /safety-policy opens the policy tree and a separate permission editor. Permissions live at <profile-home>/jev-guard/permissions.json; the reviewer context and final execution gate read the same rules. Network search and page reading are distinct operations. ask uses a real human approval limited to the proposed action, not a persistent or session-wide grant. Unknown or unavailable review remains blocked by default. API credentials, when needed, stay in JEV_API_KEY or the configured environment variable.

# Repeat installation to update; omit --endpoint to preserve its current value.
bash install-hermes-jev-linux-cys.sh --profile work
~/.hermes/jev-runtime/bin/jev --profile work doctor
~/.local/bin/jev-hermes --profile work --once -q "Explain gravity in two sentences."
~/.local/bin/jev-hermes --profile work --resume SESSION_ID

downloads/install-hermes-jev.txt remains a compatible alias of the Linux entry for existing website links. The wheel download keeps its original filename. The small source support bundle includes upstream code and the necessary integration changes; provenance is recorded in hermes-jev-compatibility.json. It uses upstream commit 8cba75ea94ea4b5da43b6cc22439cd5c2b5b5a7c and includes its license.

Validation boundary: the earlier package was checked for isolated installation, repeated updates, configuration preservation and command loading in WSL Ubuntu. The changes in this download update received source and package-integrity checks only; installation, conversation and service-connection tests were not run for this update. Earlier session records do not exhaust all permission combinations or failure paths. Published-package conversation checks remain pending until a working reviewer endpoint is available. Native Linux outside WSL has not been separately exercised.