DanKau/g2-guard-onnx

G2-Guard (ONNX)

ONNX export of fastino/gliguard-LLMGuardrails-300M, an encoder-based guardrail model for LLM prompt and response moderation — safety, toxicity, jailbreak and refusal detection as structured classification rather than generation.

Exported for SecuPi's unstructured AI service (SPAI), which runs it through ONNX Runtime from Java. Published so that service can fetch it without a PyTorch dependency; anyone else is welcome to use it under the same licence as the base model.

Files

file	what it is
onnx/encoder.onnx	DeBERTa-v3-base encoder over the schema prompt + text
onnx/classifier.onnx	classification head, Linear(768→1536) → ReLU → Linear(1536→1), scored at each [L] marker
onnx/span_rep.onnx	span representations (entity recognition path)
onnx/count_embed.onnx	count embedding — see the note below
gliner2_config.json, config.json	special-token ids and model configuration
tokenizer.json, tokenizer_config.json	tokenizer

The count_lstm_v2 note

This checkpoint is fine-tuned from fastino/gliner2-base-v1, so its count-embedding layer is count_lstm_v2, not the count_lstm used by gliner2-multi-v1/-large-v1. The two share the same GRU (same parameters, same gate order); they differ in what consumes its output:

• v1 concatenates the GRU output with the label embeddings and runs a per-label MLP.
• v2 adds them and runs a small transformer that attends across the label set, so a label's transformed embedding depends on which other labels were in the same request.

The export unrolls the GRU for count=1 (the only value inference uses) and reimplements the transformer's attention with shape-agnostic reshapes, because nn.MultiheadAttention otherwise freezes the traced label count into its head-split Reshape and the graph then accepts only that many labels. count_embed.onnx here takes label_embeddings (num_labels, 768) and returns transformed_embeddings of the same shape, for any num_labels.

Verified against native PyTorch: max elementwise difference 1.9e-06 for the unroll, 3.8e-06 for ONNX Runtime vs PyTorch, and 94/94 classification fixtures reproduce native label and score within 0.05.

Provenance

Exported from fastino/gliguard-LLMGuardrails-300M at revision fa88fefc9d2261075e038dd40716354b803a2cb4.

Licence

Apache 2.0, inherited from the base model. This repository redistributes the same weights in a different serialisation; all credit for the model belongs to Fastino.