CAD Models
Classifier checkpoints for CAD, from Robust Context-Aware Detection of Malicious Instructions in Text (Liu, Ma, and Vorobeychik, 2026).
Code: https://github.com/tavia-liu/CAD · Data: https://huggingface.co/datasets/tavialiu/CAD-data
Each checkpoint is a sentence-level MLP head (2048 → 256 → 128 → 2) over frozen
query- and context-aware embeddings from
jinaai/jina-embeddings-v3.
The encoder is not included; its own license applies.
Files
| Path | Description |
|---|---|
classifier_fullcad.pt |
CAD classifier trained on training_data_original |
feature_space/head_ft_perturbed_only_a{alpha}_s0.pt |
Feature-space adversarial training, alpha ∈ {0.001, 0.0025, 0.005, 0.01, 0.05, 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8} |
llm_paraphrase/head_ft_paraphrase_injection_a{alpha}_s0.pt |
LLM-paraphrase adversarial training, alpha ∈ {0.001, 0.0025, 0.005, 0.01, 0.05, 0.1, 0.2, 0.3, 0.4} |
Adversarially trained heads are fine-tuned from classifier_fullcad.pt. Alpha is the number of
added adversarial rows divided by the number of original training rows (24,665).
Each checkpoint stores model_state_dict, input_dim, d_hid, dropout, and
best_threshold. Adversarially trained heads also store their training configuration under
nested_alpha_training.
Usage
From the root of the CAD repository:
hf download tavialiu/CAD-models --local-dir outputs/models
export CLASSIFIER_WEIGHT_PATH="$PWD/outputs/models/classifier_fullcad.pt"
bash scripts/run_agentdojo_benchmark.sh banking slack travel
Citation
@article{liu2026cad,
title = {Robust Context-Aware Detection of Malicious Instructions in Text},
author = {Liu, Buzhao and Ma, Xinhang and Vorobeychik, Yevgeniy},
journal = {arXiv preprint},
year = {2026}
}