Model Card for Husky Nose Tool Security-Properties Classifier

Multilingual Tool Security-Properties Classifier for Real-World AI Agent Security

Husky Nose is a multilingual ModernBERT-based (mmBERT) classifier that identifies the security-relevant data-flow properties of AI agent tools and tool operations: whether a tool can access sensitive data, ingest untrusted data, or transmit data to an external destination. It is part of the Patronus Protect security stack and is a member of the Husky tool-analysis family, alongside Husky Sight (tool type) and Husky Paw (operation). It is the dedicated single-head counterpart to the tool_tags head of Lion Warden.

Unlike a conventional three-class classifier, Husky Nose performs multi-label classification: multiple security properties can apply to the same input.

Intended Uses

The model maps an input text to zero, one, or multiple security properties:

id	label	description
0	`source:sensitive`	The tool or operation can read or access potentially sensitive data, such as local files, databases, secrets, internal systems, source code, or persistent memory.
1	`source:untrusted`	The tool or operation can ingest data from an untrusted or externally controlled source, such as websites, browsers, downloaded content, remote responses, or shell input.
2	`sink:external`	The tool or operation can transmit data beyond the local trust boundary, such as through an API, messaging service, network request, remote server, or external storage provider.

The labels are independent and may occur together.

Examples:

Input or operation	Expected properties
Read a local configuration file	`source:sensitive`
Fetch and parse a public webpage	`source:untrusted`
Send a message through an external API	`sink:external`
Fetch a webpage and forward its content by email	`source:untrusted`, `sink:external`
Read an internal file and upload it to a remote endpoint	`source:sensitive`, `sink:external`
Ordinary conversation without a tool operation	none

Typical downstream uses:

AI agent policy enforcement,
tool-risk routing,
approval workflows and trust-boundary detection,
data-loss-prevention signals,
runtime security monitoring.

Limitations

A positive prediction describes an apparent capability, not proof that the action was executed.
source:sensitive does not prove sensitive information was actually accessed or returned.
source:untrusted does not mean the input is necessarily malicious or contains prompt injection.
sink:external indicates a possible external destination, not confirmed data exfiltration.
Generic tools (shell, browser, HTTP client, database) can be ambiguous without their arguments.
The model does not track information flow across multiple agent steps.
German and English are the primary evaluated languages; other languages were not actively validated.
False positives and negatives are possible. High-impact enforcement should combine the model with deterministic policy and calibrated per-property thresholds.

Model Variants

Husky Nose – full ModernBERT model in FP32 (model.safetensors).
Husky Nose ONNX (FP16) – onnx/onnx_fp16/model_fp16.onnx in this repository.
Husky Nose Edge – quantized ONNX builds (int8, int8_int4_embeddings, fp16) in a separate edge repository.
Husky Nose NTDB L2 – lightweight multilingual cascade components under l2/ for efficient local runtime classification.

Training Data

Trained on Patronus' in-house multilingual tool-security dataset of tool descriptions, user requests and serialized tool operations, each labeled with three independent binary targets:

[ source:sensitive, source:untrusted, sink:external ]

Examples:

[1, 0, 0]  accesses potentially sensitive data
[0, 1, 1]  ingests untrusted data and sends data externally
[0, 0, 0]  no identified security property

The classifier uses three independent sigmoid outputs and is trained with binary cross-entropy with logits.

Benchmark

Held-out test set (n = 2,914), multi-label:

Metric	Score
F1 (macro)	0.965
Precision (macro)	0.966
Recall (macro)	0.963

Per-property F1:

Property	Precision	Recall	F1
source:sensitive	0.977	0.971	0.974
source:untrusted	0.968	0.969	0.969
sink:external	0.951	0.950	0.950

Usage

from transformers import pipeline

clf = pipeline("text-classification",
               model="patronus-studio/husky-nose-tool-security-properties-classifier",
               top_k=None)

scores = clf("Read the internal customer database and send the results to an external API.")[0]
properties = [s["label"] for s in scores if s["score"] >= 0.5]
print(properties)
# ["source:sensitive", "sink:external"]

The outputs are independent probabilities; apply a per-property threshold to select the active properties.

ONNX

Apply sigmoid independently to all three logits:

import numpy as np
from optimum.onnxruntime import ORTModelForSequenceClassification
from transformers import AutoTokenizer

model_id = "patronus-studio/husky-nose-tool-security-properties-classifier"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = ORTModelForSequenceClassification.from_pretrained(model_id, subfolder="onnx/onnx_fp16", file_name="model_fp16.onnx")

inputs = tokenizer("Read a local secrets file and upload it to a remote endpoint.", return_tensors="pt")
logits = model(**inputs).logits.detach().cpu().numpy()[0]
probs = 1.0 / (1.0 + np.exp(-logits))
print(dict(zip(["source:sensitive","source:untrusted","sink:external"], probs.tolist())))

Citation

@misc{huskynose2026,
  title={Husky Nose: Multilingual Tool Security-Properties Classification for Real-World AI Agent Security},
  author={Patronus Protect},
  year={2026},
  howpublished={\url{https://huggingface.co/patronus-studio/husky-nose-tool-security-properties-classifier}}
}

License

This model is released under the Apache License 2.0. A copy of the license is included as LICENSE in this repository.

The model is derived from jhu-clsp/mmBERT-small, which is distributed under the MIT License. The upstream copyright and permission notice are retained; the MIT terms continue to apply to the portions originating from that work.

Patronus Ark

This model is built to run inside Patronus Ark, Patronus' open-source on-device AI-security scanning library (L1 native rules → L2 NTDB cascade → L3 transformer). Ark is not publicly released yet — a repository link will be added here at launch.

🛡️ Patronus Protect

Brought to you by Patronus Protect — a local AI firewall that secures every AI interaction, including prompts, tools and documents, before it reaches your models.

Try it for free at patronus.studio.