You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

Bolt CLS Content

Bolt CLS Content is a binary text classifier for detecting unsafe/policy-violating content in raw text. It is one of four Bolt CLS classifiers (PII, Content, Jailbreak, Router) used together in the production request-safety pipeline.

Model Overview

Bolt CLS Content is trained specifically to flag whether a piece of raw text is likely to contain unsafe or policy-violating content, acting as the first-pass sieve in front of a heavier downstream reviewer model.

Key design goals:

Very high recall (catch nearly all unsafe content) even at the cost of precision
Fast, lightweight scoring suitable for gating every request in a production pipeline
A calibrated score that downstream systems can threshold for different use cases

Model Details

Type: Text classifier (binary, single-label)
Architecture: ModernBERT (ModernBertForSequenceClassification)
Base model: aisquared/bolt-embedding-large — frozen during training (only the classification head was trained). bolt-embedding-large is itself AI Squared's own encoder, fine-tuned from ibm-granite/granite-embedding-english-r2.
Hidden size: 768 · Layers: 22 · Attention heads: 12
Max input length: 8,192 tokens
Pooling: mean

Training Data

Training data combines four sources:

An in-house content-safety dataset with its own is_sensitive labels.
nvidia/Nemotron-3.5-Content-Safety-Dataset, a public safety dataset — unsafe rows keep their real violated_categories as labels; the rest are safe.
LLM-LAT/harmful-dataset, a public harmful-content dataset — all rows treated as unsafe, labeled "Harmful Content".
yahma/alpaca-cleaned, a general-instructions dataset — all rows treated as safe negatives.

Balancing: unlike the PII and jailbreak merges, this one explicitly balances to a 50/50 class split — it pools every unsafe row and every safe row separately, downsamples both to the smaller of the two counts, then shuffles.

Split: 80% train / 20% test (seed 42) on the balanced+shuffled data (a separate stratified 90/10 eval carve-out happens later, on top of this 80% train portion, during training itself).

Known caveat: the LLM-LAT/harmful-dataset column mapping used in preparing this data was based on an assumed schema for typical harmful-content datasets, rather than one verified directly against that dataset's actual columns.

Training

Trained with AI Squared's internal classifier training pipeline, shared across all four Bolt CLS classifiers. This is a frozen-base run — only the classification head was trained on top of the frozen aisquared/bolt-embedding-large encoder.

Objective/loss: weighted focal loss (γ = 2.0 by default) on top of standard cross-entropy, with inverse-class-frequency weighting plus an extra ×2.0 multiplier on the positive (unsafe) class — biases the model toward catching positives, consistent with the sieve design.
Hyperparameters: learning rate 2e-5 · 4 epochs · per-device batch size 1 with 32 gradient-accumulation steps (effective batch size 32) · cosine LR schedule, 6% warmup · weight decay 0.01 · max grad norm 1.0 · max sequence length 8,192 tokens · seed 42.
Threshold selection: after training, the eval-split positive-class scores are swept to find the F1-optimal decision threshold (ties broken by recall, then precision); that threshold and its metrics are saved to threshold.json and shipped with the model — this is the same file Threshold Guidance below is drawn from.
Hardware: Nvidia H200

Threshold Guidance

Two thresholds are relevant to this model:

Threshold	Value	Where it's used
F1-optimal	0.5271	The threshold that maximizes F1 on the held-out eval set — use this if consuming the raw score standalone.
Production sieve threshold	0.30	The low threshold the production sieve stage uses to flag prompts for unsafe content. Set deliberately low because a sieve flag is not a hard block — it routes to a downstream reviewer model for the final decision, so false positives are cheap and false negatives are the thing to avoid.

If you're integrating this model outside of the production sieve, default to the F1-optimal threshold (0.5271) unless you have the same "flag → model review" downstream step, in which case the lower 0.30 threshold is appropriate.

Evaluation

Reported production target at the operating threshold: FNR < 1%, FPR < 69% (the sieve intentionally trades a high false-positive rate for a very low false-negative rate, since flagged content still gets a real decision from a downstream reviewer model rather than an automatic block). Held-out eval metrics at the F1-optimal threshold (0.5271):

Metric	Value
Accuracy	0.91105
F1	0.91589
Precision	0.87048
Recall	0.96630

Intended Use

Low-threshold pre-filter (sieve) in the production request pipeline, flagging prompts that may contain unsafe/policy-violating content for downstream review by a larger reviewer model.
Standalone content-safety screening where a binary flag on raw text is sufficient and a permissive (high-recall, lower-precision) operating point is acceptable.

Out of scope: using this model's flag as a final block decision — by design it is a first-pass filter with a high tolerated false-positive rate; final adjudication happens downstream.

Deployment Notes (Hugging Face Inference Endpoints)

If you're deploying this model on HF Inference Endpoints:

The two frontmatter lines above are required. Without pipeline_tag and library_name set, HF cannot identify this repo's task/architecture, which blocks every specialized engine (vLLM, TEI, TGI, SGLang) from even appearing as selectable options — you'll only see "Default," along with a "no handler.py found" warning. Adding these two lines is what unlocks the full engine list on the deployment screen.
Manually select vLLM as the Inference Engine on the deployment screen — it is not selected by default, and the default recommendation may pick a different engine that doesn't correctly support this architecture's classification head. This has to be set explicitly every time you create a new endpoint; it is not remembered from prior deployments and cannot currently be pinned via any repo file.
No handler.py or requirements.txt is needed once vLLM is selected — vLLM reads config.json directly.

Usage

from transformers import pipeline

classifier = pipeline("text-classification", model="aisquared/bolt-cls-content")
result = classifier("Your text here")
print(result)

Limitations

High false-positive rate (up to ~69%) at the production sieve threshold is expected and by design — this model should not be used anywhere a low FPR is required without raising the threshold toward the F1-optimal value.
Evaluated against an internal content-safety eval set; performance on content categories not represented there is not guaranteed.
As with any threshold-based classifier, behavior near the threshold boundary should be spot-checked before relying on it in a new context.