G2-nano-safety

A ~60M-parameter outbound judge (ALLOW / REDACT / BLOCK) for messages sent to an agent. Not a chatbot. JSON (spans, redacted text) is assembled by a deterministic net, not generated by the 60M model.

Overview

G2-nano-safety is initialized from G2-nano-base. A 3-way classification head votes ALLOW, REDACT or BLOCK. A regex detector and a secret veto run first; an assembler builds the API JSON.

It is not G2-nano-instruct, not a NER tagger, and not an Ollama chat model. Hugging Face is the intended surface (weights + net). There is no Ollama chat tag for this model.

The application sends only message; the runtime attaches destination, tool history and policy overrides for the contextual judge (see Usage).

Model variants

Same generation, different jobs:

G2-nano-base — pretrained LM
G2-nano-instruct — chat SFT (not recommended over G1 for chat)

This repository is the safety head + assembler, not a sibling chat checkpoint.

What this version is

Runtime fills tool, destination and history; the app sends the user message. Output:

{
  "decision": "REDACT",
  "findings": [
    {
      "text": "lea.ctx@exemple.fr",
      "start": 17,
      "end": 35,
      "type": "EMAIL",
      "role": "contact",
      "action": "REDACT"
    }
  ],
  "redacted_message": "Envoie un mail à [EMAIL] pour confirmer le créneau."
}

decision	Effect
ALLOW	Message is sent unchanged
REDACT	Message is sent; `redacted_message` + `findings`
BLOCK	Nothing is sent; `redacted_message` is empty

Closed experiments (JSON generation, sft_cls_v2 39/39 on templates seen in training) are not this checkpoint.

Architecture

Regex detector (detect).
Secret veto → BLOCK.
60.04M backbone (G2-nano-base shape) with a 3-logit head; argmax.
Assembler → JSON.

Property	Value
Backbone parameters	60.03M (+3×576 head)
Layers / hidden	14 / 576
Attention	GQA, 9 query heads / 1 KV head
Context length	2048 tokens native; classifier run at 1024
Vocabulary	16,388 (16,384 SentencePiece + 4 chat tokens)
Head	3-way ALLOW / REDACT / BLOCK

Training

Init: G2-nano-base (never the instruct checkpoint)
Run: sft_cls classification SFT (step 104)
Data: 432 twin cases + 50 gold cases, packed at sequence length 1024
Hardware: NVIDIA Jetson Orin Nano (8GB unified memory)
Official eval: internal contextual bench, 39 cases, ids held out from training (data/bench_context.jsonl)

Usage

Do not call generate() as if this were a chat model. Use judge.py (trust_remote_code weights + deterministic net):

import sys
sys.path.insert(0, "G2-nano-safety")  # cloned repo dir (judge.py lives here)
from judge import judge, load_judge

tok, model, device = load_judge("G2-nano-safety")
out = judge(
    "Envoie un mail à Lea pour confirmer le créneau.",
    tool_context="mail.send",
    tok=tok, model=model, device=device,
)
print(out["decision"])          # REDACT
print(out["redacted_message"])  # Envoie un mail à [EMAIL] pour confirmer le créneau.

Or from the shell:

python3 judge.py --repo G2-nano-safety \
  --message "Envoie un mail à Lea pour confirmer le créneau." \
  --tool-context "mail.send"

Evaluation

Internal contextual bench, N=39, decision metric (higher is better). Leak = 0. False-positive rate on ALLOW gold = 2.6%. Official score 36/39 (92.3%).

System	Decision	Leak	FPR
G2-nano-safety (`sft_cls` + assembler)	92.3%	0	2.6%
Naive regex (match → BLOCK)	46.2%	0	12.8%
GLiNER edge + wrapper	61.5%	12.8%	23%
Shieldstral Q4 + our assembler	69.2%	17.9%	12.8%

Extended contextual set, N=200 (the 39 historical cases plus 161 new deterministic cases: 46 ALLOW, 82 REDACT, 72 BLOCK): 153/200 (76.5%), leak 4.0%, FPR 0.5%, ahead of Shieldstral Q4 (133/200), GLiNER edge (118/200) and naive regex (98/200). Honest reserve: the 39 selection cases are part of the 200, so this is an extension, not a pure hold-out — and REDACT drops to 43.9% (often over-BLOCK or ALLOW). BLOCK stays at 100%, ALLOW at 97.8%.

This is a small internal set, not a public safety leaderboard. Shieldstral is a ~3B judge: the comparison is “same post, different stack,” not “we beat Mistral on safety.” Do not cite sft_cls_v2 39/39 (templates seen in training). Do not cite JSON-generation 43/52 as the product score.

Limitations

Not a chatbot; no conversation quality.
N=39 is small; the N=200 extension reuses the selection set and shows a REDACT weakness (43.9%).
Three errors on the official set are over-BLOCK (act_not_quote_en, clean_local_code, local_contact_redact).
English-centric tokenizer and benches.
Must not be the only control around high-stakes or secret-bearing traffic.

This model should not be used as a substitute for access control, encryption, or human review of dangerous tool use.

License

Apache 2.0.

Open weights: classifier weights plus the assembler, not a chat GGUF. Training data and intermediate runs stay private.

AZERDSQ
/

G2-nano-safety