C-GEO Guard
C-GEO Guard is the contrastive chunk-level detector evaluated with Counter-GEO-Bench. This repository contains the one-epoch checkpoint used in the paper, its eight attack-class centroids, the associated calibration metadata, and the original training and evaluation code.
The encoder is based on microsoft/deberta-v3-base. It produces a normalized
768-dimensional embedding for each chunk. The detector scores a chunk by its
maximum cosine similarity to the eight centroids and blocks it when the score
reaches the selected threshold.
Operating threshold
The paper uses a fixed threshold of 0.90 for the main evaluation and
cross-rewriter experiments. This operating point prioritizes a low false
positive rate. The automatically selected cosine threshold stored in
calibration.json is 0.84; it maximizes F1 on the held-out calibration set
and provides a higher-recall alternative.
Code
The tested implementation is included under code/:
scripts/build_defense_train.py: construct the contrastive training data.scripts/train_defender.py: train the DeBERTa-v3 encoder and centroids.scripts/phase3_fakeurl_deberta_scan.py: score and filter reranked chunks.scripts/phase3_fakeurl_defended_synth.py: synthesize answers from the filtered context.
The scan script expects the checkpoint path in DEBERTA_MODEL_DIR. To reproduce
the paper's operating point, set DEBERTA_THRESHOLDS='[0.90]'. The scan and
synthesis workflow consumes the Stage A reranked chunk caches produced by the
Counter-GEO-Bench harness.
Files
model.safetensorsand the tokenizer/configuration files: fine-tuned DeBERTa-v3-base SentenceTransformer checkpoint.centroids/class_1.npy--class_8.npy: normalized 768-dimensional attack-class centroids used by the detector.calibration.json: held-out calibration statistics.
The logistic-regression head produced during exploratory calibration is not included because the reported detector uses maximum cosine similarity to the class centroids.
Training summary
The encoder was trained for one epoch with multiple negatives ranking loss. Training used 293 ID documents after a document-level calibration split, with paired IP chunks, borderline ID rewrites, and clean chunks as negatives. The training split is disjoint from the 247-query evaluation benchmark. Further details are provided in the paper and benchmark documentation.
Intended use and limitations
The model is intended for research on defenses against GEO-optimized misinformation in retrieval-augmented and generative search systems. It is not a general factuality checker. Its scores depend on the rewrite distribution, chunking procedure, and operating threshold. Deployment across heterogeneous rewriters requires calibration on representative validation data.
Access is gated for defensive research and evaluation. The model must not be used to optimize misinformation against detection systems.
License
The model weights and centroids are licensed under CC BY-NC 4.0. Files under
code/ are licensed under Apache 2.0. See LICENSE and LICENSES/ for the
applicable terms.
- Downloads last month
- -
Model tree for counter-geo/c-geo-guard
Base model
microsoft/deberta-v3-base