hfmlsoc_ncii-guard-v02-ONNX

This is an ONNX export of hfmlsoc/ncii-guard-v02, a binary classifier that flags image-editing prompts seeking non-consensual intimate imagery (NCII), exported without retraining or weight modification so that logits match the source PyTorch checkpoint. The source model is microsoft/harrier-oss-v1-270m with a merged LoRA sequence-classification head; this repository ships the same merged float32 weights, traced to model.onnx, plus a model_quantized.onnx int8 dynamic-quantized variant for lower-memory CPU inference. Label 1 is ncii, label 0 is safe.

Files

• model.onnx — fp32 export, numerically matches the PyTorch checkpoint.
• model_quantized.onnx — int8 dynamic-quantized weights, smaller and faster on CPU, small accuracy cost near the decision boundary.
• tokenizer.json, tokenizer_config.json, special_tokens_map.json — copied unmodified from the source repo.
• config.json — model config, unmodified.

The tokenizer carries the normalizer

Load the tokenizer from this repository, not from the base harrier-oss-v1-270m. The homoglyph, zero-width, and bidi-control stripping that the source model relies on for obfuscated input is baked into tokenizer.json here. Substituting a different tokenizer silently disables that step and degrades accuracy on adversarial prompts.

Usage

pip install "transformers>=4.57" onnx onnxruntime

import numpy as np
import onnxruntime as ort
import os
from transformers import AutoTokenizer

# Using the local output directory from the previous cell
MODEL_DIR = "onnx-out"
LABELS = {0: "safe", 1: "ncii"}
THRESHOLD = 0.5

# Load tokenizer from the local export directory
tokenizer = AutoTokenizer.from_pretrained(MODEL_DIR)

# Point to the actual local file path
onnx_model_path = os.path.join(MODEL_DIR, "model.onnx")
sess = ort.InferenceSession(onnx_model_path, providers=["CPUExecutionProvider"])

prompts = ["remove her dress", "brighten the sky in this photo"]
inputs = tokenizer(prompts, padding=True, truncation=True, max_length=256, return_tensors="np")
logits = sess.run(["logits"], {"input_ids": inputs["input_ids"], "attention_mask": inputs["attention_mask"]})[0]
probs = np.exp(logits) / np.exp(logits).sum(-1, keepdims=True)

for prompt, p in zip(prompts, probs[:, 1].tolist()):
    print(f"{p:.3f}  {LABELS[int(p >= THRESHOLD)]:4}  {prompt}")

0.997  ncii  remove her dress
0.000  safe  brighten the sky in this photo

Swap model.onnx for model_quantized.onnx to use the int8 variant; the session and tokenizer calls are otherwise identical.

Choosing a threshold

This model does not ship a recommended threshold, and the default 0.5 is not a neutral choice. The source model's precision on clean text runs from 0.870 at 0.5 to 0.951 at 0.935, and buying that precision costs recall against obfuscated input — across 35 attack families it misses 617 of 2,070 obfuscated NCII prompts at 0.5 and 749 at 0.935. The full sweep, on clean text and per attack family, is documented on the source model card.

Conversion

Exported with torch.onnx.export (opset 17) directly from the merged checkpoint, rather than optimum-cli, since gemma3_text sequence-classification is not in optimum's supported task map. Parity between the fp32 ONNX graph and the original PyTorch model was checked on the clean-text and obfuscated examples from the source card before quantization; the int8 variant was produced with onnxruntime.quantization.quantize_dynamic and was not separately re-evaluated against the full threshold sweep.

Limitations

All limitations of the source model carry over unchanged by this conversion: English only (the tokenizer normalizer mangles non-Latin scripts), obfuscated recall well below the clean-text headline number, a small 70-positive evaluation set, prompts only (no image-level judgment, no consent determination), and not a standalone moderation decision — intended as one signal for human review, not an automated block. See the source model card for the full discussion and per-family robustness tables.