Instructions to use EverywhereSafety/SEAD-SAGE-4B-FP8 with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use EverywhereSafety/SEAD-SAGE-4B-FP8 with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="EverywhereSafety/SEAD-SAGE-4B-FP8")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# pip install -U transformers accelerate
# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("EverywhereSafety/SEAD-SAGE-4B-FP8")
model = AutoModelForCausalLM.from_pretrained("EverywhereSafety/SEAD-SAGE-4B-FP8", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=256)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use EverywhereSafety/SEAD-SAGE-4B-FP8 with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "EverywhereSafety/SEAD-SAGE-4B-FP8"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "EverywhereSafety/SEAD-SAGE-4B-FP8",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/EverywhereSafety/SEAD-SAGE-4B-FP8

SGLang

How to use EverywhereSafety/SEAD-SAGE-4B-FP8 with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "EverywhereSafety/SEAD-SAGE-4B-FP8" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "EverywhereSafety/SEAD-SAGE-4B-FP8",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "EverywhereSafety/SEAD-SAGE-4B-FP8" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "EverywhereSafety/SEAD-SAGE-4B-FP8",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use EverywhereSafety/SEAD-SAGE-4B-FP8 with Docker Model Runner:
```
docker model run hf.co/EverywhereSafety/SEAD-SAGE-4B-FP8
```

SEAD-SAGE-4B-FP8

Static FP8 version of the SAGE agentic defense model. It decides whether a pending tool action should pass or be blocked and can use bounded, read-only state queries before submitting its decision.

Paper: SEAD · Code: EverywhereSafety/SEAD · Project: everywheresafety.github.io/sead · Everywhere Safety

Checkpoint

Property	Value
Base model	Qwen3-4B-Instruct-2507
Fine-tuning	Full SFT, cumulative epoch 2
Stored format	Compressed-tensors FP8
Weight quantization	Static per-channel FP8 for Linear layers
Activation quantization	Dynamic per-token FP8
Context budget	65,536 tokens
Defender steps	6 maximum
Generation budget	1,024 tokens per step
Temperature	0.0
Thinking	Disabled

Paper-format offline metrics

The full comparison below reproduces the paper's frozen cohort (55 harmful and 95 benign trajectories) and adds the two released epoch-2 checkpoints. B is benign all-pass; H1 is exact closure interception; H2 is timing-aware interception; F1/F2 are the paper's harmonic safety–utility summaries. All values are percentages. Technical/unresolved harmful cases count as Miss for the released checkpoints.

Defender	B↑	H1↑	F1↑	H2↑	F2↑
No defense (paper)	100.00	0.00	0.00	0.00	0.00
Base Binary (paper)	51.58	0.00	0.00	17.03	25.61
Fine-tuned Binary (paper)	100.00	18.18	30.77	22.05	36.13
StepGuard (paper)	51.58	12.73	20.42	27.77	36.11
TS-Guard (paper)	71.58	7.27	13.20	38.14	49.76
Safiron (paper)	0.00	3.64	0.00	33.65	0.00
SEAD-SAGE (Base, paper)	62.11	10.91	18.56	39.20	48.06
SEAD-SAGE (paper)	95.79	34.55	50.78	58.79	72.86
SEAD-SAGE-4B (released)	100.00	47.27	64.20	66.43	79.83
SEAD-SAGE-4B-FP8 (released)	100.00	45.45	62.50	65.84	79.40

First-block timing	Early	Exact↑	Late	Miss↓
No defense (paper)	0.00	0.00	0.00	100.00
Base Binary (paper)	63.64	0.00	1.82	34.55
Fine-tuned Binary (paper)	5.45	18.18	3.64	72.73
StepGuard (paper)	41.82	12.73	1.82	43.64
TS-Guard (paper)	78.18	7.27	0.00	14.55
Safiron (paper)	85.45	3.64	0.00	10.91
SEAD-SAGE (Base, paper)	80.00	10.91	0.00	9.09
SEAD-SAGE (paper)	58.18	34.55	0.00	7.27
SEAD-SAGE-4B (released)	29.09	47.27	3.64	20.00
SEAD-SAGE-4B-FP8 (released)	30.91	45.45	1.82	21.82

Serving benchmark

OpenAI-compatible vLLM endpoint, 16 prompts, request counts 64/64/128/256 for concurrency 1/8/64/128, zero request errors.

Concurrency	Requests	P50	P95	Throughput
1	64	301 ms	453 ms	3.08 req/s
8	64	429 ms	558 ms	16.96 req/s
64	128	1.264 s	1.845 s	40.92 req/s
128	256	2.092 s	3.287 s	50.32 req/s

Usage

The checkpoint is directly loadable by vLLM through its compressed-tensors metadata; do not add runtime --quantization fp8.

vllm serve EverywhereSafety/SEAD-SAGE-4B-FP8 \
  --served-model-name SEAD-SAGE-4B-FP8 \
  --dtype bfloat16

Use the SEAD repository for prompt construction, the investigation loop, JSON extraction, and validation.

Citation

@misc{shen2026sead,
  title={SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents},
  author={Xinjie Shen and Junran Wang and Rongzhe Wei and Pan Li},
  year={2026},
  eprint={2609.34518},
  archivePrefix={arXiv},
  primaryClass={cs.CR},
  url={https://arxiv.org/abs/2609.34518}
}

Downloads last month: 27

Safetensors

Model size

4B params

Tensor type

BF16

F8_E4M3

Model tree for EverywhereSafety/SEAD-SAGE-4B-FP8

Base model

Qwen/Qwen3-4B-Instruct-2507

Quantized

(353)

this model

Dataset used to train EverywhereSafety/SEAD-SAGE-4B-FP8

Paper for EverywhereSafety/SEAD-SAGE-4B-FP8

SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents

Paper • 2609.34518 • Published 28 days ago • 4