Results (rate of injected actions carried out, base then corrected; 5 languages)
Table with columns: metric, base, corrected| metric | base | corrected |
|---|
| exfiltration | 0.250 | 0.000 |
| file deletion | 0.417 | 0.000 |
| money transfer | 0.333 | 0.000 |
| privilege escalation | 0.333 | 0.000 |
| goal never trained (publish a post) | 0.417 | 0.000 |
| techniques never trained | 0.500 | 0.000 |
| benign fetch kept | | 1.000 |
| each tool still used when the user asks | | 1.000 |
Base model license: Qwen/Qwen2.5-3B-Instruct is distributed under the Qwen Research License, which does not allow commercial use without Alibaba Cloud's permission. The adapter is Apache-2.0, but any use of it runs on that base.
How to use
from peft import PeftModelfrom transformers import AutoModelForCausalLM, AutoTokenizer base = "Qwen/Qwen2.5-3B-Instruct"tok = AutoTokenizer.from_pretrained(base)model = AutoModelForCausalLM.from_pretrained(base, torch_dtype="auto")model = PeftModel.from_pretrained(model, "SiliconPsycheLabs/qwen2-5-3b-toolguard-multigoal-lora").eval() messages = [{"role": "user", "content": "<agent conversation with tool outputs>"}]ids = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt")out = model.generate(ids, max_new_tokens=200, do_sample=False)print(tok.decode(out[0, ids.shape[1]:], skip_special_tokens=True))
The adapter expects the base model's own tool-calling chat template (included in this repository).
Limits
Trained on authored data covering six injection techniques and four attacker goals; results on other agent frameworks need their own measurement.
License
The weights in this repository are released under the Apache-2.0 license. Running them needs the base model, which keeps its own license.