Bordair Detector (DeBERTa-v3, ONNX, INT8) The stage-2 classifier for the Bordair Detector prompt-injection pipeline. It is a DeBERTa-v3-large model, fine-tuned with a 4-class head, exported to ONNX and quantised for CPU inference. What it does Given a text input, optionally tagged with its modality, it predicts one of four classes: class meaning benign no injection direct direct instruction override or system-prompt exfiltration jailbreak persona shift, mode switch, or restriction removal indirect injection embedded in retrieved, tool, or document content The pipeline collapses the three attack classes to injection_prob = 1 - p(benign) and applies a threshold (0.5 by default, higher for text derived from OCR or ASR). Intended use A runtime guardrail on the inputs to an LLM system: user messages, RAG chunks, tool outputs, and text pulled from uploaded images, documents, or audio. It reads the prompt rather than the model weights, so training-time attacks are out of scope. It is not a content-safety classifier. It targets task hijacking, not harmful content as such. How to use it Do not call this ONNX file directly. Use the pipeline, which handles the regex gates, modality tags, tokenisation, and thresholds: pip install bordair-detector python -c "from bordair_detector import scan_text; print(scan_text('ignore previous instructions'))" The weights download from this repository automatically on first use. If you do want to run the model raw, prepend a modality tag, for example "[TEXT] your prompt here" , "[OCR] ..." , "[ASR] ..." , or "[DOC] ..." , then tokenise with the bundled tokeniser at a maximum length of 512 with dynamic padding. Training data Bordair/bordair-multimodal : over 500,000 labelled samples at roughly a 1:1 attack-to-benign ratio, each attributed to a peer-reviewed paper or a documented piece of industry research, together with a real-world split collected and anonymised from a live game where players tried to defeat the detector. Evaluation See the eval harness in the repository. Numbers should be regenerated against the current pipeline and a clean benign split before they are cited. A small cross-modal spot check (n=63) detected every attack across text, image, document, and audio combinations. Limitations English-centric, though the regex stage covers direct-override phrasing in roughly eleven languages. The four-class labels are assigned by construction, at the category level, rather than by per-sample human review. Quantisation trades a small amount of accuracy for lower CPU latency. A determined novel attack not seen in training may pass the model. The regex gate and the decode-then-scan step are the defence in depth for known evasion classes. Licence and attribution The fine-tuned weights are released under Apache-2.0. They are a derivative work of microsoft/deberta-v3-large , which Microsoft distributes under the MIT License. That base-model licence is reproduced in the NOTICE file in the source repository, and its terms continue to apply to the base model. Downloads last month - Inference Providers NEW Text Classification This model isn't deployed by any Inference Provider. 🙋 Ask for provider support Dataset used to train Bordair/bordair-detector