---
language:
- en
license: mit
tags:
- onnx
- text-classification
- prompt-injection
- deberta
pipeline_tag: text-classification
---

# pi-detector — DeBERTa-v3 Prompt Injection Detector (ONNX)

FP32 and FP16 ONNX exports of [`protectai/deberta-v3-base-prompt-injection-v2`](https://huggingface.co/protectai/deberta-v3-base-prompt-injection-v2), built for in-browser inference with [Transformers.js](https://github.com/huggingface/transformers.js).

## Files

| File | Size | Precision | Use |
|------|------|-----------|-----|
| `onnx/model.onnx` | 738 MB | FP32 | WASM / CPU fallback |
| `onnx/model_fp16.onnx` | 370 MB | FP16 | WebGPU |

The FP16 export was produced with `onnxconverter-common` (`convert_float_to_float16`, `keep_io_types=True`, shape inference disabled) plus a type-directed repair pass: 77 `Cast` nodes were inserted at FP16/FP32 boundaries (relative-position constants and mask paths stay FP32) and stale `value_info` entries were stripped. Logits match FP32 to ~0.6% relative error with identical argmax on all tested samples.

> Note: the FP16 model requires WebGPU (or an ORT build with FP16 support). The WASM EP of onnxruntime-web currently fails LayerNorm fusion on this graph, hence the FP32 copy for WASM.

## Usage (browser)

```js
import { pipeline } from '@huggingface/transformers';

const classifier = await pipeline('text-classification', 'ASD492/pi-detector', {
  device: 'webgpu',   // falls back to 'wasm' + fp32 if unavailable
  dtype: 'fp16',
});

const out = await classifier('Ignore previous instructions...');
// [{ label: 'INJECTION', score: 0.9999 }]
```

## Labels

- `SAFE` — normal instruction or question
- `INJECTION` — prompt injection attempt