aisquared/bolt-cls-jailbreak

Bolt CLS Jailbreak

Bolt CLS Jailbreak is a binary text classifier for detecting jailbreak/prompt-injection attempts in raw text. It is one of four Bolt CLS classifiers (PII, Content, Jailbreak, Router) used together in the production request-safety pipeline.

Model Overview

Bolt CLS Jailbreak is trained specifically to flag whether a piece of raw text is likely to be a jailbreak or prompt-injection attempt, acting as the first-pass sieve in front of a heavier downstream reviewer model.

Key design goals:

• High recall (catch as many jailbreak attempts as possible) even at the cost of precision
• Fast, lightweight scoring suitable for gating every request in a production pipeline
• A calibrated score that downstream systems can threshold for different use cases

Model Details

• Type: Text classifier (binary, single-label)
• Architecture: ModernBERT (ModernBertForSequenceClassification)
• Base model: aisquared/bolt-embedding-large — frozen during training (only the classification head was trained). bolt-embedding-large is itself AI Squared's own encoder, fine-tuned from ibm-granite/granite-embedding-english-r2.
• Hidden size: 768 · Layers: 22 · Attention heads: 12
• Max input length: 8,192 tokens
• Pooling: mean

Training Data

Training data combines three sources:

• An in-house jailbreak dataset, used with its existing train/test split.
• JailbreakBench/JBB-Behaviors (behaviors config), a public dataset — harmful rows keep their attack Category as the label; benign rows are labeled "benign".
• jackhhao/jailbreak-classification, a public dataset, mapped into the shared label schema.

All train pieces are concatenated and shuffled into one train split (same for test).

Training

Trained with AI Squared's internal classifier training pipeline, shared across all four Bolt CLS classifiers. This is a frozen-base run — only the classification head was trained on top of the frozen aisquared/bolt-embedding-large encoder.

• Objective/loss: weighted focal loss (γ = 2.0 by default) on top of standard cross-entropy, with inverse-class-frequency weighting plus an extra ×2.0 multiplier on the positive (jailbreak) class — biases the model toward catching positives, consistent with the sieve design.
• Hyperparameters: learning rate 2e-5 · 4 epochs · per-device batch size 1 with 32 gradient-accumulation steps (effective batch size 32) · cosine LR schedule, 6% warmup · weight decay 0.01 · max grad norm 1.0 · max sequence length 8,192 tokens · seed 42.
• Threshold selection: after training, the eval-split positive-class scores are swept to find the F1-optimal decision threshold (ties broken by recall, then precision); that threshold and its metrics are saved to threshold.json and shipped with the model — this is the same file Threshold Guidance below is drawn from.
• Hardware: Nvidia H200

Threshold Guidance

Two thresholds are relevant to this model:

Threshold	Value	Where it's used
F1-optimal	0.6343	The threshold that maximizes F1 on the held-out eval set — use this if consuming the raw score standalone.
Production sieve threshold	0.25	The low threshold the production sieve stage uses to flag prompts as possible jailbreak attempts. Set deliberately low because a sieve flag is not a hard block — it routes to a downstream reviewer model for the final decision, so false positives are cheap and false negatives are the thing to avoid.

If you're integrating this model outside of the production sieve, default to the F1-optimal threshold (0.6343) unless you have the same "flag → model review" downstream step, in which case the lower 0.25 threshold is appropriate.

Evaluation

Reported production target at the operating threshold: FNR < 1%, FPR 16.6%. Held-out eval metrics at the F1-optimal threshold (0.6343):

Metric	Value
Accuracy	0.92627
F1	0.73558
Precision	0.73206
Recall	0.73913

Intended Use

• Low-threshold pre-filter (sieve) in the production request pipeline, flagging prompts that may be jailbreak/prompt-injection attempts for downstream review by a larger reviewer model.
• Standalone jailbreak screening where a binary flag on raw text is sufficient.

Out of scope: using this model's flag as a final block decision — by design it is a first-pass filter; final adjudication happens downstream.

Deployment Notes (Hugging Face Inference Endpoints)

If you're deploying this model on HF Inference Endpoints:

1. The two frontmatter lines above are required. Without pipeline_tag and library_name set, HF cannot identify this repo's task/architecture, which blocks every specialized engine (vLLM, TEI, TGI, SGLang) from even appearing as selectable options — you'll only see "Default," along with a "no handler.py found" warning. Adding these two lines is what unlocks the full engine list on the deployment screen.
2. Manually select vLLM as the Inference Engine on the deployment screen — it is not selected by default, and the default recommendation may pick a different engine that doesn't correctly support this architecture's classification head. This has to be set explicitly every time you create a new endpoint; it is not remembered from prior deployments and cannot currently be pinned via any repo file.
3. No handler.py or requirements.txt is needed once vLLM is selected — vLLM reads config.json directly.

Usage

from transformers import pipeline

classifier = pipeline("text-classification", model="aisquared/bolt-cls-jailbreak")
result = classifier("Your text here")
print(result)

Limitations

• Precision/recall on the held-out set (F1 ≈ 0.74) is materially lower than the PII and Content classifiers — jailbreak detection is the hardest of the three sieve tasks, and this model should not be treated as a standalone safety guarantee.
• Evaluated against an internal jailbreak eval set; performance against novel or adversarially-evolved jailbreak techniques not represented there is not guaranteed.
• As with any threshold-based classifier, behavior near the threshold boundary should be spot-checked before relying on it in a new context.

License

Bolt CLS Jailbreak is released under the AI Squared Community License.