SEAD-SAGE-4B
Agentic defense model for deciding whether a pending tool action should pass or be blocked. SAGE can use bounded, read-only state queries before submitting its decision.
Paper: SEAD · Code: EverywhereSafety/SEAD · Project: everywheresafety.github.io/sead · Everywhere Safety
Checkpoint
| Property | Value |
|---|---|
| Base model | Qwen3-4B-Instruct-2507 |
| Fine-tuning | Full SFT, cumulative epoch 2 |
| Precision | BF16 |
| Context budget | 65,536 tokens |
| Defender steps | 6 maximum |
| Generation budget | 1,024 tokens per step |
| Temperature | 0.0 |
| Thinking | Disabled |
Paper-format offline metrics
The full comparison below reproduces the paper's frozen cohort (55 harmful and 95 benign trajectories) and adds the two released epoch-2 checkpoints. B is benign all-pass; H1 is exact closure interception; H2 is timing-aware interception; F1/F2 are the paper's harmonic safety–utility summaries. All values are percentages. Technical/unresolved harmful cases count as Miss for the released checkpoints.
| Defender | B↑ | H1↑ | F1↑ | H2↑ | F2↑ |
|---|---|---|---|---|---|
| No defense (paper) | 100.00 | 0.00 | 0.00 | 0.00 | 0.00 |
| Base Binary (paper) | 51.58 | 0.00 | 0.00 | 17.03 | 25.61 |
| Fine-tuned Binary (paper) | 100.00 | 18.18 | 30.77 | 22.05 | 36.13 |
| StepGuard (paper) | 51.58 | 12.73 | 20.42 | 27.77 | 36.11 |
| TS-Guard (paper) | 71.58 | 7.27 | 13.20 | 38.14 | 49.76 |
| Safiron (paper) | 0.00 | 3.64 | 0.00 | 33.65 | 0.00 |
| SEAD-SAGE (Base, paper) | 62.11 | 10.91 | 18.56 | 39.20 | 48.06 |
| SEAD-SAGE (paper) | 95.79 | 34.55 | 50.78 | 58.79 | 72.86 |
| SEAD-SAGE-4B (released) | 100.00 | 47.27 | 64.20 | 66.43 | 79.83 |
| SEAD-SAGE-4B-FP8 (released) | 100.00 | 45.45 | 62.50 | 65.84 | 79.40 |
| First-block timing | Early | Exact↑ | Late | Miss↓ |
|---|---|---|---|---|
| No defense (paper) | 0.00 | 0.00 | 0.00 | 100.00 |
| Base Binary (paper) | 63.64 | 0.00 | 1.82 | 34.55 |
| Fine-tuned Binary (paper) | 5.45 | 18.18 | 3.64 | 72.73 |
| StepGuard (paper) | 41.82 | 12.73 | 1.82 | 43.64 |
| TS-Guard (paper) | 78.18 | 7.27 | 0.00 | 14.55 |
| Safiron (paper) | 85.45 | 3.64 | 0.00 | 10.91 |
| SEAD-SAGE (Base, paper) | 80.00 | 10.91 | 0.00 | 9.09 |
| SEAD-SAGE (paper) | 58.18 | 34.55 | 0.00 | 7.27 |
| SEAD-SAGE-4B (released) | 29.09 | 47.27 | 3.64 | 20.00 |
| SEAD-SAGE-4B-FP8 (released) | 30.91 | 45.45 | 1.82 | 21.82 |
Serving benchmark
OpenAI-compatible vLLM endpoint, 16 prompts, request counts 64/64/128/256 for concurrency 1/8/64/128, zero request errors.
| Concurrency | Requests | P50 | P95 | Throughput |
|---|---|---|---|---|
| 1 | 64 | 376 ms | 511 ms | 2.53 req/s |
| 8 | 64 | 491 ms | 654 ms | 14.80 req/s |
| 64 | 128 | 1.322 s | 1.871 s | 40.03 req/s |
| 128 | 256 | 2.160 s | 3.296 s | 49.00 req/s |
Usage
Use the prompt construction, investigation loop, JSON extraction, and validation in the SEAD repository. The model emits one structured action per step, ending with {"action":"submit","decision":"pass|block",...}. Ordinary text generation is used; provider JSON mode is not required.
vllm serve EverywhereSafety/SEAD-SAGE-4B \
--served-model-name SEAD-SAGE-4B \
--dtype bfloat16
Citation
@misc{shen2026sead,
title={SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents},
author={Xinjie Shen and Junran Wang and Rongzhe Wei and Pan Li},
year={2026},
eprint={2609.34518},
archivePrefix={arXiv},
primaryClass={cs.CR},
url={https://arxiv.org/abs/2609.34518}
}