Kai v0 (BF16)

Kai is a compact 0.8B decision model specialized in agent security, designed for fast reasoning from cloud GPUs to edge devices. It checks agent actions against security policies and helps detect cross-prompt injection (XPIA) in untrusted content. Serve it with AgentArmor.

This repository contains one merged BF16 checkpoint at its root, with no adapter or FP32 duplicate. The rank-32 LoRA was merged into Qwen/Qwen3.5-0.8B-Base@dc7cdfe2ee4154fa7e30f5b51ca41bfa40174e68. Its 452 BF16 and 36 FP32 tensors preserve the source export; FP32 is retained for stability-sensitive parameters. head.pt contains the pointer readout and checkpoint temperature. cutoffs.json and v0_questions.json freeze the decision contract. No evidence head is included.

Initial development results

Compared with the general-purpose Kev family, Kai specializes in agent security. Kev-4B has five times Kai's nominal parameter count. The trainer reports these initial-model-v0 (S2) results:

Development metric	Kai-0.8B	Kev-4B
ToolCall accuracy	208/240 (86.7%)	173/240 (72.1%)
ToolCall false denials among allowed calls	19/120 (15.8%)	16/120 (13.3%)
XPIA attack recall, BIPIA	609/703 (86.6%)	275/703 (39.1%)
XPIA benign false-positive rate	9/235 (3.83%)	4/235 (1.70%)

Both models use the same development examples and calibration procedures, with separately fitted cutoffs. ToolCall uses the factorized score and benign twin-group calibration (NP alpha 0.20, delta 0.05); BIPIA uses the XPIA logit margin and benign calibration-component maxima (NP alpha = delta = 0.05). Observed false-positive rates differ. These development panels informed model selection; this is not a locked-test or deployment-wide accuracy claim. See v0-manifest.json for the registered results and source hashes, and release.json for the counts and baseline cutoffs.

Validation and limitations

The trainer's native MLX BF16 parity read passes: four registered batches, 13,703 question rows, bit-identical saved logits, no moved decisions, exact smoke results. manifest.json records the parity gate. This is separate from vLLM numerical parity, which has not been established. AgentArmor's native Codex and Claude GPU smoke tests validate integration, not benchmark accuracy.

Kai v0 can flag benign short text. Chat-log and tool-output scans are experimental and advisory; multi-turn benchmark performance is not established. The BIPIA cutoff was calibrated on its document population, not arbitrary short text or tool envelopes. Model decisions are not security guarantees.

Artifacts and license

manifest.json, merge.json, and v0-manifest.json record source provenance; unpublished FP32 by-products are provenance only. Personal filesystem prefixes are removed from public metadata while content hashes are retained. release.json maps this public layout to the BF16 source export. SHA256SUMS covers every payload except itself and the Hub's .gitattributes.

Apache-2.0; the upstream Qwen license is included as LICENSE-Qwen3.5-0.8B-Base.