surface: tool_call | tool_outputtask: <the user's request>prior steps: <earlier agent actions, or (none)>content:<the proposed command / the tool output>
Results (held-out test, 483 rows)
- F1 0.984, AUROC 0.999
- recall 0.973 at 0.0% false-positive rate
Known limitations (from red-teaming)
Overall bypass on a held-out red-team set is 0.37 (vs 1.6% in-distribution),
concentrated in: invisible-Unicode (ASCII smuggling), base64-encoded payloads, and out-of-domain
(non-coding) harm. An input-normalization defense closes the obfuscation gap. See the repo README
for the full analysis.
Usage
import torchfrom transformers import AutoModelForSequenceClassification, AutoTokenizerfrom peft import PeftModel base = "Qwen/Qwen3-0.6B-Base"m = AutoModelForSequenceClassification.from_pretrained(base, num_labels=2, dtype=torch.float32)m = PeftModel.from_pretrained(m, "Aditi20/tool-guardrail-qwen3-0.6b-lora").merge_and_unload()tok = AutoTokenizer.from_pretrained("Aditi20/tool-guardrail-qwen3-0.6b-lora")
Trained for the Repello AI research-engineer assignment. Not production-hardened.