mdeberta-v3-base-prompt-injection-onnx
An ONNX export of proventra/mdeberta-v3-base-prompt-injection produced by the injection-mdeberta recipe of pistra-models, measured through pistra guardrails eval — the gateway's own inspection path (tokenizer binding, windows, fold, decoder, threshold) at byte offsets into the text as sent — and published because that measurement said so.
Files: config.json, tokenizer.json, onnx/model.onnx (fp32), onnx/model_quantized.onnx (dynamic int8). The measured graph is onnx/model.onnx, sha256 41296300ce584147c2faa6e3af73096b1e6900d104234a2ca0a8045d5cf8747c.
Before anything was measured from it, the fp32 graph was run against the checkpoint on the same text at 3 shapes (1×13, 1×202, 5×202) and agreed to within 1.2e-05 on logits, against a tolerance of 0.001. The int8 graph sits 0.96 from the fp32 one, agreeing with it on 100.0% of argmax positions — recorded, not judged: what quantization cost is the measurement below, not this.
Use from pistra
models:
models:
- name: mdeberta-v3-base-prompt-injection-onnx
hf:
repo: pistra-dev/mdeberta-v3-base-prompt-injection-onnx
revision: <the commit of this card>
model: onnx/model.onnx
Measurement
pistra devel 82ccc3176ba3 2026-09-01T15:04:18Z go1.27.0 darwin/arm64 on 2026-09-01T19:46:12+00:00, guardrails eval -config eval-model.yaml -json -parallel 6 -errors 20 -kind user -sweep -types INJECTION -detector candidate safeguard-test.jsonl deepset-test.jsonl jailbreak-test.jsonl.
| set | cases | AP | P | R | F1 | F1~ | ms/case |
|---|---|---|---|---|---|---|---|
| safeguard-test | 2060 | 0.677 | 0.929 | 0.726 | 0.815 | 0.815 | 53.3 |
| deepset-test | 116 | 0.833 | 1.000 | 0.850 | 0.919 | 0.919 | 16.4 |
| jailbreak-test | 262 | 0.993 | 0.993 | 0.993 | 0.993 | 0.993 | 217.0 |
safeguard-test by type
| type | P | R | F1 | F1~ |
|---|---|---|---|---|
| INJECTION | 0.929 | 0.726 | 0.815 | 0.815 |
deepset-test by type
| type | P | R | F1 | F1~ |
|---|---|---|---|---|
| INJECTION | 1.000 | 0.850 | 0.919 | 0.919 |
jailbreak-test by type
| type | P | R | F1 | F1~ |
|---|---|---|---|---|
| INJECTION | 0.993 | 0.993 | 0.993 | 0.993 |
Against the recipe's baseline
| set | metric | baseline | measured | delta | status |
|---|---|---|---|---|---|
| safeguard-test | ap | 0.677 | 0.677 | -0.000 | ok |
| safeguard-test | f1 | 0.814 | 0.815 | +0.001 | ok |
| safeguard-test | type:INJECTION:f1 | 0.814 | 0.815 | +0.001 | ok |
Language
What the verdict depends on besides the text. Every case in these sets is a negative, so every fire is a false positive, and none of this is a score: a detector that fires on nothing is perfectly invariant and blocks no customer. Read it with the recall above in the other hand.
multijail: 315 prompts × 10 languages
The same meanings in every language, so a verdict that changes with the language is a defect no ground truth is needed to see. pistra devel 82ccc3176ba3 2026-09-01T15:04:18Z go1.27.0 darwin/arm64 on 2026-09-01T19:35:25+00:00, 12.8 ms a case; read against en.
| lang | fired | rate | keeps en | lost | gained | agrees with en |
|---|---|---|---|---|---|---|
| en | 7 | 0.022 | 1.000 | 0 | 0 | 1.000 |
| zh | 9 | 0.029 | 0.571 | 3 | 5 | 0.975 |
| it | 9 | 0.029 | 0.714 | 2 | 4 | 0.981 |
| vi | 14 | 0.044 | 0.714 | 2 | 9 | 0.965 |
| ar | 7 | 0.022 | 0.571 | 3 | 3 | 0.981 |
| ko | 7 | 0.022 | 0.286 | 5 | 5 | 0.968 |
| th | 9 | 0.029 | 0.571 | 3 | 5 | 0.975 |
| bn | 27 | 0.086 | 0.714 | 2 | 22 | 0.924 |
| sw | 10 | 0.032 | 0.429 | 4 | 7 | 0.965 |
| jv | 36 | 0.114 | 0.571 | 3 | 32 | 0.889 |
1 row flagged in every language, 263 in none; 51 rows (16.2%) got different verdicts in different languages.
topics: fires on text that attacks nothing
Ordinary traffic with the jailbreak turns tagged; the other rows are the customers a deny rule would block. pistra devel 82ccc3176ba3 2026-09-01T15:04:18Z go1.27.0 darwin/arm64 on 2026-09-01T19:35:28+00:00, 8.5 ms a case.
| language, kind | fired | of | rate |
|---|---|---|---|
| en, benign | 1 | 81 | 0.012 |
| en, jailbreak | 7 | 8 | 0.875 |
| ar, benign | 1 | 81 | 0.012 |
| ar, jailbreak | 6 | 8 | 0.750 |
Data
the product's evaluation sets at 925b2b7abe97 — fetched from a checkout at 7cb21b107f31871027ce70c56f73401cd9b27c50, which is not that commit.
| set | cases | sha256 |
|---|---|---|
| safeguard-test | 2060 | 87352eb07c7c3d97cf394de62416a0def1f596f14e42ca3eee01c01217d2455b |
| deepset-test | 116 | 133d59690b33c4276d557c4f9e8e4b4f738d1dfe9a914b52c1c0e930511fc9e6 |
| jailbreak-test | 262 | b22cc550b36f991748e3479a4c2e07b73060d556ef4e3214283039d4ac92d7b9 |
| multijail | 3150 | 352e29aac777ffd1ade5ef9b274a21ebdc624251339a5eb16226d86b96b10e89 |
| topics | 178 | 1c9d0192dd4068c70e08feb391c5ed180d4f30c0ca0e02ca6cc8968863c0ab20 |
multijail is not the product's: it is DAMO-NLP-SG/MultiJail at 93d65c778925 (MIT), MultiJail.csv at sha256 953132d40b8bf562f20bd9db0a9edf6a3564dc7362bd15a8bb649c8afd128ef4 before conversion.
Provenance
{
"recipe": "injection-mdeberta",
"resolved": "2026-08-31T19:32:23+00:00",
"checkpoint": {
"repo": "proventra/mdeberta-v3-base-prompt-injection",
"revision": "b8a89d3096cf11a71d57b283c854f5ae2ed3df83",
"license": "mit",
"local": "recipes/injection-mdeberta/checkpoints/base"
},
"trained_on_our_eval_sets": {
"deepset-test": "named by this checkpoint's card",
"jailbreak-test": "named by this checkpoint's card and by ProtectAI's"
},
"data": {
"pin": {
"pin": "925b2b7abe9791679587c54c061d0785626f74df",
"direct": {
"multijail": {
"out": "multijail.jsonl",
"repo": "DAMO-NLP-SG/MultiJail",
"revision": "93d65c778925d55973b9ff30c7bccc8545494eb6",
"path": "MultiJail.csv",
"sha256": "953132d40b8bf562f20bd9db0a9edf6a3564dc7362bd15a8bb649c8afd128ef4",
"license": "MIT"
}
},
"source": "checkout",
"checkout": "7cb21b107f31871027ce70c56f73401cd9b27c50",
"drift": true,
"fetched": "2026-08-31T18:35:26+00:00",
"written": [
"multijail.jsonl"
],
"files": {
"anercorp-test.conll": "9dcc3cf9e9db5a1fe2f4147e0504f57cb144a978006eb64f6f210534cac2ad65",
"aqmar.conll": "5ca489909be68cc79947433a816315c21e4c3c3931d5f0e70393642c6a8fef76",
"deepset-test.jsonl": "133d59690b33c4276d557c4f9e8e4b4f738d1dfe9a914b52c1c0e930511fc9e6",
"gulf-names.jsonl": "4cd99f730ff8056f0147826a723cb96a4965f53bdbd7e69b16a39611d2cb69d3",
"jailbreak-test.jsonl": "b22cc550b36f991748e3479a4c2e07b73060d556ef4e3214283039d4ac92d7b9",
"multijail.jsonl": "352e29aac777ffd1ade5ef9b274a21ebdc624251339a5eb16226d86b96b10e89",
"nemotron-pii-test.jsonl": "ccb748fcee6fbf6705ed0b44db00ff6258081458f179341afbe9a98d1a1423ad",
"safeguard-test.jsonl": "87352eb07c7c3d97cf394de62416a0def1f596f14e42ca3eee01c01217d2455b",
"topics.jsonl": "1c9d0192dd4068c70e08feb391c5ed180d4f30c0ca0e02ca6cc8968863c0ab20",
"wikiann-ar-test.conll": "70f08a00d4c901b8e7ce6174218e5335dcaac0682c92969f705d7b28578fdfc4",
"wojood-sample-test.jsonl": "c7949973e48fa40740b95f2b45a7f046d5359acf7074a443d9e703ef8cad19b7"
}
},
"sets": [
"data/eval/safeguard-test.jsonl",
"data/eval/deepset-test.jsonl",
"data/eval/jailbreak-test.jsonl",
"data/eval/multijail.jsonl",
"data/eval/topics.jsonl"
]
}
}
Notes
Evaluated as a candidate to replace the pinned injection classifier for multilingual traffic. Its card names jackhhao/jailbreak-classification and deepset/prompt-injections as training data, so the numbers on those two sets are memorisation and are not a comparison with any other model; safe-guard, topics and multijail are not in its training data and are. Published as the pin for Arabic-serving traffic: on the product's topics.jsonl it flags 1 of 81 Arabic customer turns against protectai's 65, and catches 6 of the 8 Arabic jailbreak turns against Prompt Guard 2's 1; it costs safe-guard F1 0.914 to 0.815 against protectai, which stays the better pin for English-only traffic. The int8 graph in this layout was measured (safe-guard F1 0.621, 2 of 8 Arabic attacks) and is not the one to pin.
Report
The report measure.py wrote — the model card is generated from it and nothing above is hand-edited. Two things are removed rather than published: the absolute paths of the machine it ran on, and the per-set list of mismatched cases, which quotes the evaluation corpora verbatim and is theirs to distribute, not this card's. Both are in the report.json beside the recipe.
{
"generated": "2026-09-01T19:46:12+00:00",
"pistra": "pistra devel 82ccc3176ba3 2026-09-01T15:04:18Z go1.27.0 darwin/arm64",
"graph": "onnx/model.onnx",
"onnx_sha256": "41296300ce584147c2faa6e3af73096b1e6900d104234a2ca0a8045d5cf8747c",
"export": {
"out_dir": "export",
"task": "text-classification",
"fp32": "onnx/model.onnx",
"int8": "onnx/model_quantized.onnx",
"outputs": [
"logits"
],
"sha256": {
"onnx/model.onnx": "41296300ce584147c2faa6e3af73096b1e6900d104234a2ca0a8045d5cf8747c",
"onnx/model_quantized.onnx": "b4f171f484200eb0c80eab0b83b6a0be52d37f217aa44442a162935e88c14a99"
},
"conformance": {
"graph": "onnx/model.onnx",
"reference": "torch",
"output": "logits",
"atol": 0.001,
"max_abs_diff": 1.2159347534179688e-05,
"feeds": [
{
"batch": 1,
"sequence": 13,
"max_abs_diff": 2.86102294921875e-06
},
{
"batch": 1,
"sequence": 202,
"max_abs_diff": 1.2159347534179688e-05
},
{
"batch": 5,
"sequence": 202,
"max_abs_diff": 1.1920928955078125e-05
}
],
"axes": {
"input_ids": [
"batch_size",
"sequence_length"
],
"attention_mask": [
"batch_size",
"sequence_length"
]
}
},
"int8_drift": {
"graph": "onnx/model_quantized.onnx",
"against": "onnx/model.onnx",
"output": "logits",
"max_abs_diff": 0.9604771137237549,
"argmax_agreement": 1.0
},
"stripped_padding": {
"strategy": {
"Fixed": 512
},
"direction": "Right",
"pad_to_multiple_of": null,
"pad_id": 0,
"pad_type_id": 0,
"pad_token": "[PAD]"
}
},
"kind": "classify",
"segment_kind": "user",
"config": {
"guardrails": {
"detectors": [
{
"type": "classify",
"name": "candidate",
"classify": {
"model": "onnx/model.onnx",
"tokenizer": "tokenizer.json",
"labels_path": "config.json",
"tokenizer_library": "libpitok.dylib",
"library": "libonnxruntime.dylib"
}
}
],
"rules": [
{
"name": "note",
"when": "true",
"action": "annotate"
}
]
}
},
"command": [
"pistra",
"guardrails",
"eval",
"-config",
"eval-model.yaml",
"-json",
"-parallel",
"6",
"-errors",
"20",
"-kind",
"user",
"-sweep",
"-types",
"INJECTION",
"-detector",
"candidate",
"safeguard-test.jsonl",
"deepset-test.jsonl",
"jailbreak-test.jsonl"
],
"data_pin": {
"pin": "925b2b7abe9791679587c54c061d0785626f74df",
"direct": {
"multijail": {
"out": "multijail.jsonl",
"repo": "DAMO-NLP-SG/MultiJail",
"revision": "93d65c778925d55973b9ff30c7bccc8545494eb6",
"path": "MultiJail.csv",
"sha256": "953132d40b8bf562f20bd9db0a9edf6a3564dc7362bd15a8bb649c8afd128ef4",
"license": "MIT"
}
},
"source": "checkout",
"checkout": "7cb21b107f31871027ce70c56f73401cd9b27c50",
"drift": true,
"fetched": "2026-08-31T18:35:26+00:00",
"written": [
"multijail.jsonl"
],
"files": {
"anercorp-test.conll": "9dcc3cf9e9db5a1fe2f4147e0504f57cb144a978006eb64f6f210534cac2ad65",
"aqmar.conll": "5ca489909be68cc79947433a816315c21e4c3c3931d5f0e70393642c6a8fef76",
"deepset-test.jsonl": "133d59690b33c4276d557c4f9e8e4b4f738d1dfe9a914b52c1c0e930511fc9e6",
"gulf-names.jsonl": "4cd99f730ff8056f0147826a723cb96a4965f53bdbd7e69b16a39611d2cb69d3",
"jailbreak-test.jsonl": "b22cc550b36f991748e3479a4c2e07b73060d556ef4e3214283039d4ac92d7b9",
"multijail.jsonl": "352e29aac777ffd1ade5ef9b274a21ebdc624251339a5eb16226d86b96b10e89",
"nemotron-pii-test.jsonl": "ccb748fcee6fbf6705ed0b44db00ff6258081458f179341afbe9a98d1a1423ad",
"safeguard-test.jsonl": "87352eb07c7c3d97cf394de62416a0def1f596f14e42ca3eee01c01217d2455b",
"topics.jsonl": "1c9d0192dd4068c70e08feb391c5ed180d4f30c0ca0e02ca6cc8968863c0ab20",
"wikiann-ar-test.conll": "70f08a00d4c901b8e7ce6174218e5335dcaac0682c92969f705d7b28578fdfc4",
"wojood-sample-test.jsonl": "c7949973e48fa40740b95f2b45a7f046d5359acf7074a443d9e703ef8cad19b7"
}
},
"sets": [
{
"file": "safeguard-test.jsonl",
"name": "safeguard-test",
"sha256": "87352eb07c7c3d97cf394de62416a0def1f596f14e42ca3eee01c01217d2455b",
"mode": "labels",
"cases": 2060,
"average_precision": 0.6768089677077638,
"average_precision_source": "harness",
"all": {
"exact": {
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
"relaxed": {
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
}
},
"types": {
"INJECTION": {
"exact": {
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
"relaxed": {
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
}
}
},
"tags": {},
"guard": [],
"sweep": [
{
"threshold": 0.05,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.1,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.15,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.2,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.25,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.3,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.35,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.4,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.45,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.5,
"tp": 472,
"fp": 36,
"fn": 178,
"precision": 0.9291,
"recall": 0.7262,
"f1": 0.8152
},
{
"threshold": 0.55,
"tp": 469,
"fp": 35,
"fn": 181,
"precision": 0.9306,
"recall": 0.7215,
"f1": 0.8128
},
{
"threshold": 0.6,
"tp": 469,
"fp": 35,
"fn": 181,
"precision": 0.9306,
"recall": 0.7215,
"f1": 0.8128
},
{
"threshold": 0.65,
"tp": 468,
"fp": 35,
"fn": 182,
"precision": 0.9304,
"recall": 0.72,
"f1": 0.8118
},
{
"threshold": 0.7,
"tp": 468,
"fp": 34,
"fn": 182,
"precision": 0.9323,
"recall": 0.72,
"f1": 0.8125
},
{
"threshold": 0.75,
"tp": 467,
"fp": 34,
"fn": 183,
"precision": 0.9321,
"recall": 0.7185,
"f1": 0.8115
},
{
"threshold": 0.8,
"tp": 463,
"fp": 34,
"fn": 187,
"precision": 0.9316,
"recall": 0.7123,
"f1": 0.8073
},
{
"threshold": 0.85,
"tp": 462,
"fp": 33,
"fn": 188,
"precision": 0.9333,
"recall": 0.7108,
"f1": 0.807
},
{
"threshold": 0.9,
"tp": 461,
"fp": 32,
"fn": 189,
"precision": 0.9351,
"recall": 0.7092,
"f1": 0.8066
},
{
"threshold": 0.95,
"tp": 454,
"fp": 32,
"fn": 196,
"precision": 0.9342,
"recall": 0.6985,
"f1": 0.7993
},
{
"threshold": 0.975,
"tp": 451,
"fp": 32,
"fn": 199,
"precision": 0.9337,
"recall": 0.6938,
"f1": 0.7961
},
{
"threshold": 0.997,
"tp": 431,
"fp": 30,
"fn": 219,
"precision": 0.9349,
"recall": 0.6631,
"f1": 0.7759
},
{
"threshold": 0.999,
"tp": 410,
"fp": 30,
"fn": 240,
"precision": 0.9318,
"recall": 0.6308,
"f1": 0.7523
},
{
"threshold": 1,
"tp": 0,
"fp": 0,
"fn": 650,
"precision": 0.0,
"recall": 0.0,
"f1": 0.0
}
],
"mismatches": 214,
"detector_errors": 0,
"per_case_ms": 53.32
},
{
"file": "deepset-test.jsonl",
"name": "deepset-test",
"sha256": "133d59690b33c4276d557c4f9e8e4b4f738d1dfe9a914b52c1c0e930511fc9e6",
"mode": "labels",
"cases": 116,
"average_precision": 0.8333333333333334,
"average_precision_source": "harness",
"all": {
"exact": {
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
"relaxed": {
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
}
},
"types": {
"INJECTION": {
"exact": {
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
"relaxed": {
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
}
}
},
"tags": {},
"guard": [],
"sweep": [
{
"threshold": 0.05,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.1,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.15,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.2,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.25,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.3,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.35,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.4,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.45,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.5,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.55,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.6,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.65,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.7,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.75,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.8,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.85,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.9,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.95,
"tp": 51,
"fp": 0,
"fn": 9,
"precision": 1.0,
"recall": 0.85,
"f1": 0.9189
},
{
"threshold": 0.999,
"tp": 50,
"fp": 0,
"fn": 10,
"precision": 1.0,
"recall": 0.8333,
"f1": 0.9091
},
{
"threshold": 1,
"tp": 0,
"fp": 0,
"fn": 60,
"precision": 0.0,
"recall": 0.0,
"f1": 0.0
}
],
"mismatches": 9,
"detector_errors": 0,
"per_case_ms": 16.355
},
{
"file": "jailbreak-test.jsonl",
"name": "jailbreak-test",
"sha256": "b22cc550b36f991748e3479a4c2e07b73060d556ef4e3214283039d4ac92d7b9",
"mode": "labels",
"cases": 262,
"average_precision": 0.9928057553956835,
"average_precision_source": "harness",
"all": {
"exact": {
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
"relaxed": {
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
}
},
"types": {
"INJECTION": {
"exact": {
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
"relaxed": {
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
}
}
},
"tags": {},
"guard": [],
"sweep": [
{
"threshold": 0.05,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.1,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.15,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.2,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.25,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.3,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.35,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.4,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.45,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.5,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.55,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.6,
"tp": 138,
"fp": 1,
"fn": 1,
"precision": 0.9928,
"recall": 0.9928,
"f1": 0.9928
},
{
"threshold": 0.65,
"tp": 138,
"fp": 0,
"fn": 1,
"precision": 1.0,
"recall": 0.9928,
"f1": 0.9964
},
{
"threshold": 0.7,
"tp": 138,
"fp": 0,
"fn": 1,
"precision": 1.0,
"recall": 0.9928,
"f1": 0.9964
},
{
"threshold": 0.75,
"tp": 138,
"fp": 0,
"fn": 1,
"precision": 1.0,
"recall": 0.9928,
"f1": 0.9964
},
{
"threshold": 0.8,
"tp": 138,
"fp": 0,
"fn": 1,
"precision": 1.0,
"recall": 0.9928,
"f1": 0.9964
},
{
"threshold": 0.85,
"tp": 138,
"fp": 0,
"fn": 1,
"precision": 1.0,
"recall": 0.9928,
"f1": 0.9964
},
{
"threshold": 0.9,
"tp": 138,
"fp": 0,
"fn": 1,
"precision": 1.0,
"recall": 0.9928,
"f1": 0.9964
},
{
"threshold": 0.95,
"tp": 138,
"fp": 0,
"fn": 1,
"precision": 1.0,
"recall": 0.9928,
"f1": 0.9964
},
{
"threshold": 1,
"tp": 0,
"fp": 0,
"fn": 139,
"precision": 0.0,
"recall": 0.0,
"f1": 0.0
}
],
"mismatches": 2,
"detector_errors": 0,
"per_case_ms": 216.98
}
],
"baseline": "baseline.json",
"checks": [
{
"set": "safeguard-test",
"metric": "ap",
"baseline": 0.677,
"measured": 0.6768089677077638,
"tolerance": 0.01,
"status": "ok",
"delta": -0.0002
},
{
"set": "safeguard-test",
"metric": "f1",
"baseline": 0.814,
"measured": 0.8151986183074266,
"tolerance": 0.02,
"status": "ok",
"delta": 0.0012
},
{
"set": "safeguard-test",
"metric": "type:INJECTION:f1",
"baseline": 0.814,
"measured": 0.8151986183074266,
"tolerance": 0.02,
"status": "ok",
"delta": 0.0012
}
],
"failures": [],
"negatives": [
{
"generated": "2026-09-01T19:35:25+00:00",
"pistra": "pistra devel 82ccc3176ba3 2026-09-01T15:04:18Z go1.27.0 darwin/arm64",
"graph": "onnx/model.onnx",
"onnx_sha256": "41296300ce584147c2faa6e3af73096b1e6900d104234a2ca0a8045d5cf8747c",
"export": {
"out_dir": "export",
"task": "text-classification",
"fp32": "onnx/model.onnx",
"int8": "onnx/model_quantized.onnx",
"outputs": [
"logits"
],
"sha256": {
"onnx/model.onnx": "41296300ce584147c2faa6e3af73096b1e6900d104234a2ca0a8045d5cf8747c",
"onnx/model_quantized.onnx": "b4f171f484200eb0c80eab0b83b6a0be52d37f217aa44442a162935e88c14a99"
},
"conformance": {
"graph": "onnx/model.onnx",
"reference": "torch",
"output": "logits",
"atol": 0.001,
"max_abs_diff": 1.2159347534179688e-05,
"feeds": [
{
"batch": 1,
"sequence": 13,
"max_abs_diff": 2.86102294921875e-06
},
{
"batch": 1,
"sequence": 202,
"max_abs_diff": 1.2159347534179688e-05
},
{
"batch": 5,
"sequence": 202,
"max_abs_diff": 1.1920928955078125e-05
}
],
"axes": {
"input_ids": [
"batch_size",
"sequence_length"
],
"attention_mask": [
"batch_size",
"sequence_length"
]
}
},
"int8_drift": {
"graph": "onnx/model_quantized.onnx",
"against": "onnx/model.onnx",
"output": "logits",
"max_abs_diff": 0.9604771137237549,
"argmax_agreement": 1.0
},
"stripped_padding": {
"strategy": {
"Fixed": 512
},
"direction": "Right",
"pad_to_multiple_of": null,
"pad_id": 0,
"pad_type_id": 0,
"pad_token": "[PAD]"
}
},
"data": {
"file": "multijail.jsonl",
"sha256": "352e29aac777ffd1ade5ef9b274a21ebdc624251339a5eb16226d86b96b10e89",
"pin": {
"pin": "925b2b7abe9791679587c54c061d0785626f74df",
"direct": {
"multijail": {
"out": "multijail.jsonl",
"repo": "DAMO-NLP-SG/MultiJail",
"revision": "93d65c778925d55973b9ff30c7bccc8545494eb6",
"path": "MultiJail.csv",
"sha256": "953132d40b8bf562f20bd9db0a9edf6a3564dc7362bd15a8bb649c8afd128ef4",
"license": "MIT"
}
},
"source": "checkout",
"checkout": "7cb21b107f31871027ce70c56f73401cd9b27c50",
"drift": true,
"fetched": "2026-08-31T18:35:26+00:00",
"written": [
"multijail.jsonl"
],
"files": {
"anercorp-test.conll": "9dcc3cf9e9db5a1fe2f4147e0504f57cb144a978006eb64f6f210534cac2ad65",
"aqmar.conll": "5ca489909be68cc79947433a816315c21e4c3c3931d5f0e70393642c6a8fef76",
"deepset-test.jsonl": "133d59690b33c4276d557c4f9e8e4b4f738d1dfe9a914b52c1c0e930511fc9e6",
"gulf-names.jsonl": "4cd99f730ff8056f0147826a723cb96a4965f53bdbd7e69b16a39611d2cb69d3",
"jailbreak-test.jsonl": "b22cc550b36f991748e3479a4c2e07b73060d556ef4e3214283039d4ac92d7b9",
"multijail.jsonl": "352e29aac777ffd1ade5ef9b274a21ebdc624251339a5eb16226d86b96b10e89",
"nemotron-pii-test.jsonl": "ccb748fcee6fbf6705ed0b44db00ff6258081458f179341afbe9a98d1a1423ad",
"safeguard-test.jsonl": "87352eb07c7c3d97cf394de62416a0def1f596f14e42ca3eee01c01217d2455b",
"topics.jsonl": "1c9d0192dd4068c70e08feb391c5ed180d4f30c0ca0e02ca6cc8968863c0ab20",
"wikiann-ar-test.conll": "70f08a00d4c901b8e7ce6174218e5335dcaac0682c92969f705d7b28578fdfc4",
"wojood-sample-test.jsonl": "c7949973e48fa40740b95f2b45a7f046d5359acf7074a443d9e703ef8cad19b7"
}
}
},
"cases": 3150,
"fired_total": 135,
"per_case_ms": 12.822,
"invariance": {
"reference": "en",
"rows": 315,
"languages": [
"en",
"zh",
"it",
"vi",
"ar",
"ko",
"th",
"bn",
"sw",
"jv"
],
"per_language": {
"en": {
"fired": 7,
"rate": 0.0222,
"keeps_reference": 7,
"lost": 0,
"gained": 0,
"retention": 1.0,
"agreement": 1.0
},
"zh": {
"fired": 9,
"rate": 0.0286,
"keeps_reference": 4,
"lost": 3,
"gained": 5,
"retention": 0.5714,
"agreement": 0.9746
},
"it": {
"fired": 9,
"rate": 0.0286,
"keeps_reference": 5,
"lost": 2,
"gained": 4,
"retention": 0.7143,
"agreement": 0.981
},
"vi": {
"fired": 14,
"rate": 0.0444,
"keeps_reference": 5,
"lost": 2,
"gained": 9,
"retention": 0.7143,
"agreement": 0.9651
},
"ar": {
"fired": 7,
"rate": 0.0222,
"keeps_reference": 4,
"lost": 3,
"gained": 3,
"retention": 0.5714,
"agreement": 0.981
},
"ko": {
"fired": 7,
"rate": 0.0222,
"keeps_reference": 2,
"lost": 5,
"gained": 5,
"retention": 0.2857,
"agreement": 0.9683
},
"th": {
"fired": 9,
"rate": 0.0286,
"keeps_reference": 4,
"lost": 3,
"gained": 5,
"retention": 0.5714,
"agreement": 0.9746
},
"bn": {
"fired": 27,
"rate": 0.0857,
"keeps_reference": 5,
"lost": 2,
"gained": 22,
"retention": 0.7143,
"agreement": 0.9238
},
"sw": {
"fired": 10,
"rate": 0.0317,
"keeps_reference": 3,
"lost": 4,
"gained": 7,
"retention": 0.4286,
"agreement": 0.9651
},
"jv": {
"fired": 36,
"rate": 0.1143,
"keeps_reference": 4,
"lost": 3,
"gained": 32,
"retention": 0.5714,
"agreement": 0.8889
}
},
"unanimous_fire": 1,
"unanimous_quiet": 263,
"split": 51,
"split_rate": 0.1619
},
"config": {
"guardrails": {
"detectors": [
{
"type": "classify",
"name": "candidate",
"classify": {
"model": "onnx/model.onnx",
"tokenizer": "tokenizer.json",
"labels_path": "config.json",
"tokenizer_library": "libpitok.dylib",
"library": "libonnxruntime.dylib"
}
}
],
"rules": [
{
"name": "note",
"when": "true",
"action": "annotate"
}
]
}
},
"command": [
"pistra",
"guardrails",
"eval",
"-config",
"invariance-model.yaml",
"-json",
"-parallel",
"6",
"-errors",
"3151",
"-kind",
"user",
"-types",
"INJECTION",
"multijail.jsonl"
],
"examples": [
{
"row": "034",
"flagged_in": [
"vi",
"ar",
"bn",
"sw",
"jv"
],
"quiet_in": [
"en",
"zh",
"it",
"ko",
"th"
],
"chars": {
"en": 96,
"zh": 32,
"it": 133,
"vi": 96,
"ar": 86,
"ko": 41,
"th": 96,
"bn": 106,
"sw": 111,
"jv": 78
}
},
{
"row": "304",
"flagged_in": [
"en",
"it",
"vi",
"ar",
"bn"
],
"quiet_in": [
"zh",
"ko",
"th",
"sw",
"jv"
],
"chars": {
"en": 63,
"zh": 17,
"it": 75,
"vi": 69,
"ar": 53,
"ko": 23,
"th": 60,
"bn": 49,
"sw": 66,
"jv": 80
}
},
{
"row": "242",
"flagged_in": [
"vi",
"th",
"bn",
"jv"
],
"quiet_in": [
"en",
"zh",
"it",
"ar",
"ko",
"sw"
],
"chars": {
"en": 169,
"zh": 57,
"it": 178,
"vi": 184,
"ar": 139,
"ko": 78,
"th": 160,
"bn": 184,
"sw": 141,
"jv": 184
}
},
{
"row": "042",
"flagged_in": [
"vi",
"bn",
"jv"
],
"quiet_in": [
"en",
"zh",
"it",
"ar",
"ko",
"th",
"sw"
],
"chars": {
"en": 159,
"zh": 64,
"it": 158,
"vi": 136,
"ar": 179,
"ko": 69,
"th": 195,
"bn": 187,
"sw": 195,
"jv": 149
}
},
{
"row": "047",
"flagged_in": [
"en",
"vi",
"bn"
],
"quiet_in": [
"zh",
"it",
"ar",
"ko",
"th",
"sw",
"jv"
],
"chars": {
"en": 14,
"zh": 4,
"it": 11,
"vi": 24,
"ar": 11,
"ko": 10,
"th": 15,
"bn": 14,
"sw": 9,
"jv": 25
}
},
{
"row": "300",
"flagged_in": [
"th",
"bn",
"sw"
],
"quiet_in": [
"en",
"zh",
"it",
"vi",
"ar",
"ko",
"jv"
],
"chars": {
"en": 69,
"zh": 23,
"it": 68,
"vi": 81,
"ar": 59,
"ko": 42,
"th": 72,
"bn": 112,
"sw": 92,
"jv": 69
}
},
{
"row": "302",
"flagged_in": [
"en",
"zh",
"it",
"vi",
"ko",
"th",
"jv"
],
"quiet_in": [
"ar",
"bn",
"sw"
],
"chars": {
"en": 144,
"zh": 53,
"it": 155,
"vi": 137,
"ar": 122,
"ko": 71,
"th": 162,
"bn": 133,
"sw": 156,
"jv": 142
}
},
{
"row": "306",
"flagged_in": [
"bn",
"sw",
"jv"
],
"quiet_in": [
"en",
"zh",
"it",
"vi",
"ar",
"ko",
"th"
],
"chars": {
"en": 168,
"zh": 68,
"it": 212,
"vi": 199,
"ar": 211,
"ko": 95,
"th": 206,
"bn": 183,
"sw": 225,
"jv": 188
}
}
]
},
{
"generated": "2026-09-01T19:35:28+00:00",
"pistra": "pistra devel 82ccc3176ba3 2026-09-01T15:04:18Z go1.27.0 darwin/arm64",
"graph": "onnx/model.onnx",
"onnx_sha256": "41296300ce584147c2faa6e3af73096b1e6900d104234a2ca0a8045d5cf8747c",
"export": {
"out_dir": "export",
"task": "text-classification",
"fp32": "onnx/model.onnx",
"int8": "onnx/model_quantized.onnx",
"outputs": [
"logits"
],
"sha256": {
"onnx/model.onnx": "41296300ce584147c2faa6e3af73096b1e6900d104234a2ca0a8045d5cf8747c",
"onnx/model_quantized.onnx": "b4f171f484200eb0c80eab0b83b6a0be52d37f217aa44442a162935e88c14a99"
},
"conformance": {
"graph": "onnx/model.onnx",
"reference": "torch",
"output": "logits",
"atol": 0.001,
"max_abs_diff": 1.2159347534179688e-05,
"feeds": [
{
"batch": 1,
"sequence": 13,
"max_abs_diff": 2.86102294921875e-06
},
{
"batch": 1,
"sequence": 202,
"max_abs_diff": 1.2159347534179688e-05
},
{
"batch": 5,
"sequence": 202,
"max_abs_diff": 1.1920928955078125e-05
}
],
"axes": {
"input_ids": [
"batch_size",
"sequence_length"
],
"attention_mask": [
"batch_size",
"sequence_length"
]
}
},
"int8_drift": {
"graph": "onnx/model_quantized.onnx",
"against": "onnx/model.onnx",
"output": "logits",
"max_abs_diff": 0.9604771137237549,
"argmax_agreement": 1.0
},
"stripped_padding": {
"strategy": {
"Fixed": 512
},
"direction": "Right",
"pad_to_multiple_of": null,
"pad_id": 0,
"pad_type_id": 0,
"pad_token": "[PAD]"
}
},
"data": {
"file": "topics.jsonl",
"sha256": "1c9d0192dd4068c70e08feb391c5ed180d4f30c0ca0e02ca6cc8968863c0ab20",
"pin": {
"pin": "925b2b7abe9791679587c54c061d0785626f74df",
"direct": {
"multijail": {
"out": "multijail.jsonl",
"repo": "DAMO-NLP-SG/MultiJail",
"revision": "93d65c778925d55973b9ff30c7bccc8545494eb6",
"path": "MultiJail.csv",
"sha256": "953132d40b8bf562f20bd9db0a9edf6a3564dc7362bd15a8bb649c8afd128ef4",
"license": "MIT"
}
},
"source": "checkout",
"checkout": "7cb21b107f31871027ce70c56f73401cd9b27c50",
"drift": true,
"fetched": "2026-08-31T18:35:26+00:00",
"written": [
"multijail.jsonl"
],
"files": {
"anercorp-test.conll": "9dcc3cf9e9db5a1fe2f4147e0504f57cb144a978006eb64f6f210534cac2ad65",
"aqmar.conll": "5ca489909be68cc79947433a816315c21e4c3c3931d5f0e70393642c6a8fef76",
"deepset-test.jsonl": "133d59690b33c4276d557c4f9e8e4b4f738d1dfe9a914b52c1c0e930511fc9e6",
"gulf-names.jsonl": "4cd99f730ff8056f0147826a723cb96a4965f53bdbd7e69b16a39611d2cb69d3",
"jailbreak-test.jsonl": "b22cc550b36f991748e3479a4c2e07b73060d556ef4e3214283039d4ac92d7b9",
"multijail.jsonl": "352e29aac777ffd1ade5ef9b274a21ebdc624251339a5eb16226d86b96b10e89",
"nemotron-pii-test.jsonl": "ccb748fcee6fbf6705ed0b44db00ff6258081458f179341afbe9a98d1a1423ad",
"safeguard-test.jsonl": "87352eb07c7c3d97cf394de62416a0def1f596f14e42ca3eee01c01217d2455b",
"topics.jsonl": "1c9d0192dd4068c70e08feb391c5ed180d4f30c0ca0e02ca6cc8968863c0ab20",
"wikiann-ar-test.conll": "70f08a00d4c901b8e7ce6174218e5335dcaac0682c92969f705d7b28578fdfc4",
"wojood-sample-test.jsonl": "c7949973e48fa40740b95f2b45a7f046d5359acf7074a443d9e703ef8cad19b7"
}
}
},
"cases": 178,
"fired_total": 15,
"per_case_ms": 8.502,
"crosstab": {
"file": "topics.jsonl",
"split": "jailbreak",
"untagged": 0,
"counts": {
"en": {
"benign": {
"fired": 1,
"total": 81,
"rate": 0.0123
},
"jailbreak": {
"fired": 7,
"total": 8,
"rate": 0.875
}
},
"ar": {
"benign": {
"fired": 1,
"total": 81,
"rate": 0.0123
},
"jailbreak": {
"fired": 6,
"total": 8,
"rate": 0.75
}
}
}
},
"config": {
"guardrails": {
"detectors": [
{
"type": "classify",
"name": "candidate",
"classify": {
"model": "onnx/model.onnx",
"tokenizer": "tokenizer.json",
"labels_path": "config.json",
"tokenizer_library": "libpitok.dylib",
"library": "libonnxruntime.dylib"
}
}
],
"rules": [
{
"name": "note",
"when": "true",
"action": "annotate"
}
]
}
},
"command": [
"pistra",
"guardrails",
"eval",
"-config",
"crosstab-model.yaml",
"-json",
"-parallel",
"6",
"-errors",
"501",
"-kind",
"user",
"-types",
"INJECTION",
"topics.jsonl"
]
}
]
}
Licence
The weights derive from proventra/mdeberta-v3-base-prompt-injection and carry its licence (mit). The recipe that produced this export is under the Business Source License 1.1 of pistra-models.
- Downloads last month
- -
Model tree for pistra-dev/mdeberta-v3-base-prompt-injection-onnx
Base model
microsoft/mdeberta-v3-base