HiveTraceGuard-Pro

HiveTraceGuard-Pro is a compact Russian-first guardrail built on Qwen3-0.6B for fast input and output classification. Built for LLMs and agents, it checks user requests and model responses for harmful content, jailbreaks, prompt injection, obfuscation, and attempts to hijack tool-using agents. The model is stateless and returns exactly one token: safe or unsafe.

📄 Technical Report: arXiv:2609.01046

Quickstart

Transformers

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

REPO = "hivetrace/HiveTraceGuard-Pro"

tok = AutoTokenizer.from_pretrained(REPO)
model = AutoModelForCausalLM.from_pretrained(
    REPO,
    torch_dtype=torch.bfloat16,
    device_map="auto",
).eval()


def check(messages) -> str:
    text = tok.apply_chat_template(
        messages,
        tokenize=False,
    )
    inputs = tok(text, return_tensors="pt").to(model.device)

    with torch.inference_mode():
        output = model.generate(
            **inputs,
            max_new_tokens=1,
            do_sample=False,
        )

    return tok.decode(
        output[0][inputs.input_ids.shape[1]:],
        skip_special_tokens=True,
    ).strip()


# Input guard
print(check([
    {"role": "user", "content": "Как сделать бомбу?"}
]))
# unsafe

# Output guard
print(check([
    {"role": "user", "content": "Привет!"},
    {"role": "assistant", "content": "Здравствуйте!"},
]))
# safe

Serve

Model's policy is fixed, so serving runtimes can reuse the shared prefix through KV caching.

vLLM

vllm serve hivetrace/HiveTraceGuard-Pro \
  --port 8000 \
  --max-model-len 32768 \
  --enable-prefix-caching

SGLang

python -m sglang.launch_server \
  --model-path hivetrace/HiveTraceGuard-Pro \
  --host 0.0.0.0 \
  --port 30000

For applications that need a continuous score, P(unsafe) can be computed directly from the two verdict logits:

import torch.nn.functional as F


SAFE, UNSAFE = 18675, 38157


with torch.inference_mode():
    logits = model(**inputs).logits[0, -1]


p_unsafe = F.softmax(logits[[SAFE, UNSAFE]], dim=0)[1].item()
verdict = "unsafe" if logits[UNSAFE] > logits[SAFE] else "safe"


print(verdict, p_unsafe)

To enforce safe | unsafe during generation, you can use a LogitsProcessor to restrict the next token to the two verdict labels.

from transformers import LogitsProcessor


class VerdictOnly(LogitsProcessor):
    def __call__(self, input_ids, scores):
        mask = torch.full_like(scores, float("-inf"))
        mask[:, [SAFE, UNSAFE]] = scores[:, [SAFE, UNSAFE]]
        return mask


output = model.generate(
    **inputs,
    max_new_tokens=1,
    do_sample=False,
    logits_processor=[VerdictOnly()],
)

Evaluation

Harmful content detection

Attack & jailbreak detection

Multilingual evaluation

Benign over-blocking — FPR ↓

GuardRate Leaderboard: Score 0.743 · 28.8 ms p95 - OPEN

Policy taxonomy

HiveTraceGuard-Pro uses a fixed policy and returns a single binary verdict: safe (token_id = 18675) or unsafe (token_id = 38157).

Guard modes

Both modes use the same policy.

Versions

Pin a version by tag from_pretrained("hivetrace/HiveTraceGuard-Pro", revision="1.1.0"), or by commit SHA for strict reproducibility.

License

Apache-2.0 — commercial use, modification, redistribution, and private / on-premise deployment. Full text: https://www.apache.org/licenses/LICENSE-2.0