sercand/da-command-classifier-fp16

Shell command classifier (shiso format)

A small DistilBERT-architecture classifier that labels a single shell command as safe, needs-approval or dangerous. It is a weight conversion, for the shiso inference runtime, of the command classifier published by the da project: https://github.com/amenocturne/da. The model and its training are the work of da's author; this repository only changes the file format.

base_model: distilbert-base-uncased is listed as an architecture reference only. The weights here come from da's trained classifier, not directly from that base checkpoint.

Labels

id	label
0	safe
1	needs-approval
2	dangerous

Input format

Use the shipped tokenizer.json as-is. Encode the raw command string with special tokens enabled ([CLS] ... [SEP]). The tokenizer carries its own truncation to 128 ids, which keeps a trailing [SEP]; do not add truncation or padding of your own. Architecture: 6 layers, 12 heads, dim 768, hidden 3072, vocab 30522, 3 output labels (see config.json).

Calibration and decision rule

Constants (also in config.json under calibration):

• temperature = 1.3366203308105469
• energy_p95 = -2.543365240097046
• safe_threshold = 0.90

Decision, in order:

1. Energy OOD gate first. With logits z, energy = -T * logsumexp(z / T), where T is the temperature. If the energy is above energy_p95 (out of distribution), do not approve.
2. Otherwise compute P = softmax(z / T). Approve only if P(safe) > 0.90. Anything else is not approved.

Conversion method

Dequantized from da's published int8 ONNX model classifier/model.onnx (sha256 e514e853cdbcadf285b29d187eb6e897781e67130d7ee24d0affe5311fa7d2b4) and written as safetensors. Weight matrices and embeddings are stored as fp16; LayerNorm parameters and biases are f32.

Verification

On a 308-row hand-written corpus, comparing against the original ONNX model:

• argmax agreement: 302/308 (98.05 %)
• calibrated decision agreement: 304/308 (98.70 %)
• false approvals relative to ONNX: 0
• max |delta logit|: 0.51 (the original quantizes activations to int8, which this conversion does not reproduce)
• shiso Metal forward vs. an f32 reference: < 5e-5
• on-device decisions vs. ONNX: 307/308 approve-agreement

Intended use and limitations

An advisory classifier for shell commands issued by AI agents, used to decide whether a command may skip a human approval prompt. It is not a security boundary. It is known to approve some needs-approval and dangerous commands: 8 of 177 labelled rows in our corpus are approved by the original ONNX model itself. It must therefore sit behind deterministic rules and a never-approve list, with the classifier only able to widen approval within what those rules already permit.

License and credit

MIT. Original model and training: https://github.com/amenocturne/da, Copyright (c) 2026 amenocturne. See LICENSE.