Merlin
Merlin is a 70.8M-parameter local encoder that classifies a proposed AI-agent
tool invocation as safe or unsafe using its surrounding context.
This repository contains the portable checkpoint. Use the reference package at https://github.com/kontext-security/merlin; a generic Transformers pipeline does not reproduce the benchmark because Merlin uses four independently budgeted fields, deterministic history normalization, and a validation-fitted calibrator.
Inputs
- user request
- prior interaction history
- current tool name and arguments
- tool descriptions/schemas
Prior ReAct history is converted to canonical JSON tool/argument/observation
events. Thought and Final Answer text is excluded. The current action is
reduced to tool name and arguments. Each field has its own token budget within a
512-token packed sequence.
Results
Strict binary evaluation on TS-Bench (0.0 safe; 0.5 and 1.0 unsafe), fixed
0.5 threshold:
| Split | N | Accuracy | Precision | Recall | F1 |
|---|---|---|---|---|---|
| All TS-Bench | 7,182 | 91.19% | 92.66% | 88.45% | 90.51% |
| ASB-Traj | 5,231 | 99.73% | 99.76% | 99.68% | 99.72% |
| AgentDojo-Traj | 1,220 | 71.80% | 51.14% | 50.85% | 51.00% |
| AgentHarm-Traj | 731 | 62.38% | 83.42% | 59.43% | 69.41% |
The pooled score is dominated by ASB-Traj and is not evidence of uniform cross-environment performance. See the GitHub repository for the full protocol, preprocessing code, data provenance, system measurements, and limitations.
Training
- Base:
microsoft/deberta-v3-xsmallat revision4b419818330868dff6a60ad3e6b1c730f8b8c0c6 - Train: 2,192 examples (841 safe, 1,351 unsafe)
- Validation: 789 examples
- Epochs: 5; learning rate: 2e-5; batch size: 8; gradient accumulation: 2
- Sigmoid calibration coefficient: 1.427213430140093
- Sigmoid calibration intercept: 2.953687013257505
- Default threshold: 0.5
Intended use
Use Merlin as a low-latency, local safety signal before executing an agent tool call. It is not a complete authorization layer and should be combined with least privilege, deterministic policy, sandboxing, and human confirmation for consequential actions.
Do not use it as the sole control for high-impact actions, as a general content moderator, or outside the documented input representation without evaluation.
Data and license
The base model is MIT licensed. Merlin was fine-tuned on TS-Bench data from
https://github.com/MurrayTom/ToolSafe. That repository had no explicit
repository license at release time, so the checkpoint is marked other and no
raw TS-Bench examples are mirrored here. Review upstream terms before commercial
use or redistribution. Reference code is Apache-2.0.