Bordair Detector (DeBERTa-v3, ONNX, INT8)
The stage-2 classifier for the Bordair Detector prompt-injection pipeline. It is a DeBERTa-v3-large model, fine-tuned as a binary classifier, exported to ONNX and quantised for CPU inference.
What it does
Given a text input, optionally tagged with its modality, it emits two logits:
| index | class | meaning |
|---|---|---|
| 0 | benign | no injection |
| 1 | injection | an attempt to override, hijack, or redirect the model's task |
The pipeline takes injection_prob = softmax(logits)[1] and applies a threshold (0.5 by default, higher for text derived from OCR or ASR).
A note on the label taxonomy: the training script configures a four-label head (benign, direct, jailbreak, indirect) and config.json still carries that id2label map, but every training sample is labelled 0 or 1 and the exported graph emits two logits. The shipped model is therefore binary, and the finer-grained attack taxonomy is not trained. Treat the four-way labels in the config as vestigial.
Intended use
A runtime guardrail on the inputs to an LLM system: user messages, RAG chunks, tool outputs, and text pulled from uploaded images, documents, or audio. It reads the prompt rather than the model weights, so training-time attacks are out of scope.
It is not a content-safety classifier. It targets task hijacking, not harmful content as such.
How to use it
Do not call this ONNX file directly. Use the pipeline, which handles the regex gates, modality tags, tokenisation, and thresholds:
pip install bordair-detector
python -c "from bordair_detector import scan_text; print(scan_text('ignore previous instructions'))"
The weights download from this repository automatically on first use. If you do want to run the model raw, prepend a modality tag, for example "[TEXT] your prompt here", "[OCR] ...", "[ASR] ...", or "[DOC] ...", then tokenise with the bundled tokeniser at a maximum length of 512 with dynamic padding.
Training data
Bordair/bordair-multimodal: over 500,000 labelled samples at roughly a 1:1 attack-to-benign ratio, each attributed to a peer-reviewed paper or a documented piece of industry research, together with a real-world split collected and anonymised from a live game where players tried to defeat the detector.
Evaluation
See the eval harness in the repository. Numbers should be regenerated against the current pipeline and a clean benign split before they are cited. A small cross-modal spot check (n=63) detected every attack across text, image, document, and audio combinations.
Limitations
- English-centric, though the regex stage covers direct-override phrasing in roughly eleven languages.
- Labels are assigned by construction, at the category level, rather than by per-sample human review. The model distinguishes injection from benign; it does not classify the type of injection, despite the label names left in
config.json. - Quantisation trades a small amount of accuracy for lower CPU latency.
- A determined novel attack not seen in training may pass the model. The regex gate and the decode-then-scan step are the defence in depth for known evasion classes.
Licence and attribution
The fine-tuned weights are released under Apache-2.0.
They are a derivative work of microsoft/deberta-v3-large, which Microsoft distributes under the MIT License. That base-model licence is reproduced in the NOTICE file in the source repository, and its terms continue to apply to the base model.