README.md

metadata

license: other
license_name: merlin-research-release
base_model: microsoft/deberta-v3-xsmall
library_name: transformers
pipeline_tag: text-classification
tags:
  - agents
  - agent-safety
  - tool-use
  - prompt-injection
  - deberta-v3

Merlin

Merlin is a 70.8M-parameter local encoder that classifies a proposed AI-agent tool invocation as safe or unsafe using its surrounding context.

This repository contains the portable checkpoint. Use the reference package at https://github.com/kontext-security/merlin; a generic Transformers pipeline does not reproduce the benchmark because Merlin uses four independently budgeted fields, deterministic history normalization, and a validation-fitted calibrator.

Inputs

1. user request
2. prior interaction history
3. current tool name and arguments
4. tool descriptions/schemas

Prior ReAct history is converted to canonical JSON tool/argument/observation events. Thought and Final Answer text is excluded. The current action is reduced to tool name and arguments. Each field has its own token budget within a 512-token packed sequence.

Results

Strict binary evaluation on TS-Bench (0.0 safe; 0.5 and 1.0 unsafe), fixed 0.5 threshold:

Split	N	Accuracy	Precision	Recall	F1
All TS-Bench	7,182	91.19%	92.66%	88.45%	90.51%
ASB-Traj	5,231	99.73%	99.76%	99.68%	99.72%
AgentDojo-Traj	1,220	71.80%	51.14%	50.85%	51.00%
AgentHarm-Traj	731	62.38%	83.42%	59.43%	69.41%

The pooled score is dominated by ASB-Traj and is not evidence of uniform cross-environment performance. See the GitHub repository for the full protocol, preprocessing code, data provenance, system measurements, and limitations.

Training

• Base: microsoft/deberta-v3-xsmall at revision 4b419818330868dff6a60ad3e6b1c730f8b8c0c6
• Train: 2,192 examples (841 safe, 1,351 unsafe)
• Validation: 789 examples
• Epochs: 5; learning rate: 2e-5; batch size: 8; gradient accumulation: 2
• Sigmoid calibration coefficient: 1.427213430140093
• Sigmoid calibration intercept: 2.953687013257505
• Default threshold: 0.5

Intended use

Use Merlin as a low-latency, local safety signal before executing an agent tool call. It is not a complete authorization layer and should be combined with least privilege, deterministic policy, sandboxing, and human confirmation for consequential actions.

Do not use it as the sole control for high-impact actions, as a general content moderator, or outside the documented input representation without evaluation.

Data and license

The base model is MIT licensed. Merlin was fine-tuned on TS-Bench data from https://github.com/MurrayTom/ToolSafe. That repository had no explicit repository license at release time, so the checkpoint is marked other and no raw TS-Bench examples are mirrored here. Review upstream terms before commercial use or redistribution. Reference code is Apache-2.0.