Hugging Face model: rockCO78/multiturn-injection-detector
Author: rockCO78
Created: 2026-05-17 14:01:01
Last modified: 2026-05-17 14:41:03
Pipeline: text-classification
Library: pytorch
Likes: 0 | Downloads: 0
Tags: pytorch, lstm, gru, text-classification, prompt-injection, security, multi-turn, cybersecurity, deep-learning, temporal-modeling, en, dataset:rockCO78/multiturn-injection-detection, license:cc-by-nc-4.0, model-index, region:us
Card metadata:
language: en
license: cc-by-nc-4.0
library_name: pytorch
pipeline_tag: text-classification
tags: pytorch, lstm, gru, text-classification, prompt-injection, security, multi-turn, cybersecurity, deep-learning, temporal-modeling
datasets: rockCO78/multiturn-injection-detection
metrics: f1, precision, recall, accuracy
model_type: lstm-gru-dual-encoder
model_summary: A dual-encoder architecture combining a frozen GRU turn encoder (2.6M params) with a trainable sequence LSTM (27K params) for detecting distributed prompt injection attacks across multi-turn LLM conversations. Achieves F1=0.837 with 55% turn-order sensitivity, confirming temporal pattern learning.
external_references: url: https://huggingface.co/rockCO78/multiturn-injection-detector
type: website
comment: Model repository, url: https://github.com/rocklambros/multiturn-injection-detection
type: vcs
comment: Source code repository, url: https://github.com/rocklambros/multiturn-injection-detection/blob/main/report/research_report.md
type: documentation
comment: Research report
paper: https://github.com/rocklambros/multiturn-injection-detection/blob/main/report/research_report.md
gated: manual
hyperparameter: learning_rate: 0.001
batch_size: 32
epochs: 20
optimizer: Adam
hidden_dim: 64
turn_embedding_dim: 32
dropout: 0.3
weight_decay: 0.0001
scheduler: ReduceLROnPlateau
patience: 5
seed: 42
energyConsumption: Estimated 0.08 kWh for full training pipeline on NVIDIA Jetson Orin AGX
energyQuantity: 0.08
energyUnit: kWh
ethicalConsiderations: This model is designed exclusively for defensive security research and prompt injection detection. The synthetic training data contains adversarial prompt patterns that could theoretically inform attack development if misused. Access is gated to mitigate dual-use risk. The model should not be used to develop adversarial attacks, bypass safety systems, or enable malicious prompt injection.
safetyRiskAssessment: Low direct risk. The model classifies conversations as benign or attack and does not generate text. Misclassification (false negatives) could allow attacks to pass undetected; false positives could flag benign conversations. The model was trained on synthetic data and may not generalize to all real-world attack vectors. Gated access with responsible-use terms mitigates misuse risk.
intendedUse: Defensive security systems that monitor multi-turn LLM conversations for distributed prompt injection attacks. Intended for deployment as a secondary classifier alongside single-turn detectors in LLM guardrail pipelines. Target users include security researchers, AI safety teams, and organizations deploying LLM-based applications.
technicalLimitations: Trained exclusively on synthetic data generated by a single LLM (Claude Sonnet 4.6); cross-model generalization is untested. Fixed conversation length of 6-9 user turns; shorter or longer conversations may reduce accuracy. Residual vocabulary confounds in post-branch turns (bag-of-words classifier achieves F1 > 0.93 on post-branch text). The temporal LSTM operates on 32-dimensional turn embeddings and cannot access raw vocabulary, but the training signal partially correlates with lexical features.
typeOfModel: lstm-gru-dual-encoder
modelExplainability: The model provides attention weights over conversation turns indicating which turns contributed most to classification. Turn-order sensitivity analysis (55% flip rate when shuffling correctly-classified attacks) confirms the model relies on temporal patterns rather than per-turn features. Gate activation visualizations show distinct forget/update gate patterns for attack versus benign sequences.
informationAboutTraining: Two-phase training pipeline. Phase 1: GRU turn encoder trained on 73,390 single-turn prompt injection samples with full backpropagation (2.6M parameters). Phase 2: GRU encoder frozen, sequence LSTM trained on 18,754 multi-turn conversations (27K trainable parameters). Hardware: NVIDIA Jetson Orin AGX. Adam optimizer, learning rate 0.001, batch size 32, 20 epochs with early stopping.
informationAboutApplication: Designed for edge deployment on NVIDIA Jetson Orin AGX with approximately 5ms inference latency per conversation. The frozen GRU turn encoder processes each new turn independently; the sequence LSTM updates its hidden state incrementally, enabling online classification as turns arrive.
metric: Primary: F1=0.837 [95% CI: 0.826, 0.847]. Per-tier: easy=0.872, medium=0.828, hard=0.828, adversarial=0.802. All comparisons significant at p < 0.001 via paired bootstrap.
metricDecisionThreshold: Default classification threshold: 0.5 (sigmoid output). Threshold-tuned variant at 0.64 achieves F1=0.995 on validation set.
modelDataPreprocessing: Single-turn: lowercased, whitespace-normalized, deduplicated via MD5, filtered to 5-512 tokens. Multi-turn: per-turn tokenization with 20K vocabulary, GRU encoding to 32-dim embeddings, zero-padded to batch max length.
useSensitivePersonalInformation: No. Trained exclusively on synthetic LLM-generated data. No personal data, user conversations, or PII used in training or evaluation.
standardCompliance: OWASP AI Security Guidelines, CycloneDX 1.6 AIBOM specification
domain: cybersecurity, natural-language-processing, AI-safety
autonomyType: non-autonomous