slm-threat-detection-v1

A LoRA-fine-tuned 0.6B-parameter small language model (SLM) that classifies user prompts as benign, sensitive, or jailbreak. It is the local classifier ("SLM Classifier") used as the sensitivity-routing gate in the privacy-preserving middleware architecture described in:

Ait Hsine, A.; Arabo, A. A Privacy-Preserving Middleware Architecture for Detecting Prompt Injection and Sensitive Data Exposure in Large-Language-Model Interactions. Electronics 2026, 1, 0.

In that architecture, this model's job is not to make the final security verdict. It decides whether a prompt is allowed to leave the local trust boundary: prompts it (or a pattern-matching layer) flags as sensitive or jailbreak are kept local; only prompts it assesses as benign are permitted to reach an external LLM for further contextual reasoning. See the paper for the full routed architecture, threat model, and end-to-end evaluation.

Model Details

• Base model: sarthakrastogi/narasimha-b-0.6b (Narasimha-0.6B), a Qwen3-architecture decoder-only transformer, itself already tuned for adversarial-prompt classification as part of the Rival toolkit. This release performs further LoRA specialization on top of that checkpoint rather than fine-tuning from a general-purpose base model.

• Architecture: 28 layers, hidden size 1024, 16 attention heads over 8 key-value heads (grouped-query attention), 151,936-token vocabulary, 596,049,920 total parameters.

• Fine-tuning method: LoRA (rank 16, α = 32, dropout 0.05, no bias, RSLoRA/DoRA disabled) applied to the four attention projections only (q_proj, k_proj, v_proj, o_proj); feed-forward blocks are frozen. 4,587,520 trainable parameters (0.77% of the total).

• Task format: generative classification, not a classification head. Each example follows the template:

  Classify the following prompt into one of the categories: benign, sensitive, jailbreak. Prompt: [user prompt]. Classification:
  

  The first token generated after Classification: is parsed as the predicted label.

• License: Apache 2.0. This applies to the LoRA adapter released here; please also review the license terms of the base checkpoint, sarthakrastogi/narasimha-b-0.6b, before downstream use.

Training Data

Fine-tuned on the 700-prompt training partition of the Prompt Injection and Sensitive Data Exposure Detection dataset (200 benign, 200 sensitive, 300 jailbreak prompts; both manually curated and synthetically generated). A separate, class-balanced 150-prompt validation partition (50 per class) from the same dataset was used to track validation loss during training; no best-checkpoint selection was performed against it.

This dataset is distinct from the evaluation set used for the results below — the two share no generation template, and the evaluation set's benign class is drawn from a different distribution. See the Comparison_Dataset for the held-out 120-prompt evaluation set used for all reported metrics.

Training Procedure

Platform	Google Colaboratory (free tier)
Accelerator	NVIDIA T4 (16 GB); free-tier allocation is not guaranteed, so this applies to the reported run rather than the platform generally
Framework	Hugging Face Transformers (≥4.35.0), PyTorch (≥2.0.0), PEFT 0.18.0
Precision	fp16 (T4 is a Turing-generation device without hardware bfloat16 support)
Learning rate	5×10⁻⁵, linear schedule
Batch size	1 per device, gradient accumulation over 8 steps (effective batch size 8)
Epochs	2 (175 optimizer steps total)
Checkpoint released	Final epoch (best-checkpoint selection was not enabled)
Random seed	Framework default (not explicitly set)

Evaluation

Evaluated on the independent 120-prompt Comparison_Dataset (40 benign — 20 general + 20 "hard negatives" lexically adjacent to genuine secrets — 40 jailbreak, 40 sensitive), as part of a six-way comparison reported in the paper linked above.

Standalone performance (binary task: attack/sensitive vs. benign):

Metric	Value
Accuracy	84.17% (95% CI: 77.5–90.8%)
F1	87.25%
Precision	94.20%
Recall	81.25%
False positive rate	10.00%
Mean latency	3193.7 ms/prompt (CPU-only; 6 vCPU AMD EPYC-Milan VPS, 11 GiB RAM — see paper Section 4.9 for full environment details)

Per-category detection:

Category	Rate
Benign specificity	90.0%
Jailbreak recall	67.5%
Sensitive-data recall	95.0%

False positives on hard negatives (benign prompts lexically adjacent to secrets, e.g. "write a regex to scan for leaked GitHub tokens"): 3/20 (15%), vs. 1/20 (5%) on general benign prompts.

In the paper's routed architecture, this model is responsible for 58 of 70 (82.9%) local-retention decisions, with pattern matching accounting for the remaining 12.

Intended Use and Limitations

• This model is designed to run as one component of a larger routed pipeline (alongside deterministic pattern matching and, for prompts it clears, an external LLM reasoning layer) — see the paper for the full architecture. It is not intended or evaluated as a standalone content-safety filter.
• Recall is asymmetric: substantially stronger on sensitive-data detection (95.0%) than on jailbreak detection (67.5%), likely reflecting a training corpus dominated by structured-secret examples. In the paper's architecture this asymmetry is judged tolerable because jailbreak prompts carry no confidentiality requirement, but it may not be tolerable in other deployments.
• CPU-only inference latency (~3.2 s/prompt) is well outside an interactive budget; see the paper's discussion of encoder-based alternatives for latency-sensitive deployments.
• Evaluated only against non-adversarial (not evasion-aware) prompts; robustness against an adversary adapting to this specific classifier is untested.
• Two known sensitive-data misclassifications in the evaluation set involve unstructured, context-dependent confidential content (e.g., a salary-sheet reference) rather than structured secrets — the model's recall on this category is not expected to generalize to sensitivity that depends on business context rather than surface form.

How to Use

The repository currently ships the fine-tuned adapter as a single archive, slm.zip. Download and extract it, then load it as a PEFT adapter on top of the base checkpoint:

huggingface-cli download v1adam/slm-threat-detection-v1 slm.zip --local-dir .
unzip slm.zip -d slm-threat-detection-v1

from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

base_model_id = "sarthakrastogi/narasimha-b-0.6b"
adapter_path = "slm-threat-detection-v1"  # the folder extracted above

tokenizer = AutoTokenizer.from_pretrained(base_model_id)
base_model = AutoModelForCausalLM.from_pretrained(base_model_id)
model = PeftModel.from_pretrained(base_model, adapter_path)

prompt = (
    "Classify the following prompt into one of the categories: "
    "benign, sensitive, jailbreak. "
    "Prompt: My AWS key is AKIAIOSFODNN7EXAMPLE. Classification:"
)
inputs = tokenizer(prompt, return_tensors="pt")
output = model.generate(**inputs, max_new_tokens=3)
print(tokenizer.decode(output[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

Note: the exact file names inside slm.zip (adapter config, adapter weights, tokenizer files) follow the standard PEFT save_pretrained() layout, but were not independently re-verified when this card was written — if the extracted contents differ from adapter_config.json / adapter_model.safetensors, adjust adapter_path or the loading call accordingly. For easier downstream use, consider unpacking slm.zip directly into the repository root in a future update so the model can be loaded with a single PeftModel.from_pretrained("v1adam/slm-threat-detection-v1") call, without a manual download-and-extract step.

Citation

If you use this model, please cite both the model and the paper it was built for:

@misc{aithsine2026model,
  author = {Ait Hsine, Adam},
  title = {slm-threat-detection-v1: Fine-Tuned Narasimha-0.6B for Prompt Injection Detection},
  year = {2026},
  publisher = {Hugging Face},
  url = {https://huggingface.co/v1adam/slm-threat-detection-v1}
}

@article{aithsine2026middleware,
  author = {Ait Hsine, Adam and Arabo, Abdullahi},
  title = {A Privacy-Preserving Middleware Architecture for Detecting Prompt Injection and Sensitive Data Exposure in Large-Language-Model Interactions},
  journal = {Electronics},
  year = {2026},
  volume = {1},
  number = {1},
  pages = {0}
}

(DOI and page numbers to be added once the article record is finalized by the publisher.)

Related Resources

• Paper: A Privacy-Preserving Middleware Architecture for Detecting Prompt Injection and Sensitive Data Exposure in Large-Language-Model Interactions (Electronics, 2026)
• Training corpus: v1adam/Prompt_Injection_and_Sensitive_Data_exposure_detection
• Evaluation set: v1adam/Comparison_Dataset
• Base checkpoint: sarthakrastogi/narasimha-b-0.6b (Rival toolkit)