---
license: other
license_name: merlin-research-release
base_model: microsoft/deberta-v3-xsmall
library_name: transformers
pipeline_tag: text-classification
tags:
  - agents
  - agent-safety
  - tool-use
  - prompt-injection
  - deberta-v3
---

# Merlin

Merlin is a 70.8M-parameter local encoder that classifies a proposed AI-agent
tool invocation as `safe` or `unsafe` using its surrounding context.

This repository contains the portable checkpoint. Use the reference package at
<https://github.com/kontext-security/merlin>; a generic Transformers pipeline
does **not** reproduce the benchmark because Merlin uses four independently
budgeted fields, deterministic history normalization, and a validation-fitted
calibrator.

## Inputs

1. user request
2. prior interaction history
3. current tool name and arguments
4. tool descriptions/schemas

Prior ReAct history is converted to canonical JSON tool/argument/observation
events. `Thought` and `Final Answer` text is excluded. The current action is
reduced to tool name and arguments. Each field has its own token budget within a
512-token packed sequence.

## Results

Strict binary evaluation on TS-Bench (`0.0` safe; `0.5` and `1.0` unsafe), fixed
0.5 threshold:

| Split | N | Accuracy | Precision | Recall | F1 |
|---|---:|---:|---:|---:|---:|
| All TS-Bench | 7,182 | 91.19% | 92.66% | 88.45% | 90.51% |
| ASB-Traj | 5,231 | 99.73% | 99.76% | 99.68% | 99.72% |
| AgentDojo-Traj | 1,220 | 71.80% | 51.14% | 50.85% | 51.00% |
| AgentHarm-Traj | 731 | 62.38% | 83.42% | 59.43% | 69.41% |

The pooled score is dominated by ASB-Traj and is not evidence of uniform
cross-environment performance. See the GitHub repository for the full protocol,
preprocessing code, data provenance, system measurements, and limitations.

## Training

- Base: `microsoft/deberta-v3-xsmall` at revision
  `4b419818330868dff6a60ad3e6b1c730f8b8c0c6`
- Train: 2,192 examples (841 safe, 1,351 unsafe)
- Validation: 789 examples
- Epochs: 5; learning rate: 2e-5; batch size: 8; gradient accumulation: 2
- Sigmoid calibration coefficient: 1.427213430140093
- Sigmoid calibration intercept: 2.953687013257505
- Default threshold: 0.5

## Intended use

Use Merlin as a low-latency, local safety signal before executing an agent tool
call. It is not a complete authorization layer and should be combined with
least privilege, deterministic policy, sandboxing, and human confirmation for
consequential actions.

Do not use it as the sole control for high-impact actions, as a general content
moderator, or outside the documented input representation without evaluation.

## Data and license

The base model is MIT licensed. Merlin was fine-tuned on TS-Bench data from
<https://github.com/MurrayTom/ToolSafe>. That repository had no explicit
repository license at release time, so the checkpoint is marked `other` and no
raw TS-Bench examples are mirrored here. Review upstream terms before commercial
use or redistribution. Reference code is Apache-2.0.