HikmaGuard

HikmaGuard is a multilingual AI safety model built on Qwen/Qwen3Guard-Gen-4B by HikmaAI. It identifies content-safety risks and prompt-injection attempts across user prompts, documents, emails, tool outputs, and other untrusted content.

Nine specialized safety signals with calibrated confidence scores make HikmaGuard a flexible foundation for moderation, guardrails, and policy enforcement in multilingual AI applications.

Model description

• Version: 0.1.0
• Base model: Qwen/Qwen3Guard-Gen-4B
• Architecture: Qwen3ForSequenceClassification
• Maximum length: 2048 tokens with head-tail truncation
• Input kinds: user_prompt, external_content
• Fine-tuning: LoRA rank 16, merged into BF16 weights
• Policy/taxonomy: unified-guard-v1

The independent heads are:

hate, abuse, violence, self_harm, sexual_harm, misconduct, dangerous_capability, prompt_injection, and indirect_prompt_injection.

Applications can combine these specialized signals according to their own safety policy, risk tolerance, and enforcement workflow.

Calibrated thresholds

Head	Threshold
hate	0.151028
abuse	0.321673
violence	0.576542
self_harm	0.143188
sexual_harm	0.191933
misconduct	0.774583
dangerous_capability	0.754915
prompt_injection	0.980000
indirect_prompt_injection	0.992000

The thresholds in thresholds.json are bound to this model by both the model-config SHA-256 and the hikma_artifact_id, making deployments reproducible and easy to audit.

Usage

import json
import torch
from huggingface_hub import hf_hub_download
from transformers import AutoModelForSequenceClassification, AutoTokenizer

repo_id = "HikmaAI/HikmaGuard"
heads = ['hate', 'abuse', 'violence', 'self_harm', 'sexual_harm', 'misconduct', 'dangerous_capability', 'prompt_injection', 'indirect_prompt_injection']
input_kind = "user_prompt"  # or "external_content"
text = "Example text to classify"

tokenizer = AutoTokenizer.from_pretrained(repo_id)
model = AutoModelForSequenceClassification.from_pretrained(
    repo_id,
    torch_dtype=torch.bfloat16,
    device_map="auto",
).eval()

messages = [{
    "role": "user",
    "content": (
        f"Source: {input_kind}\n"
        "<BEGIN_UNTRUSTED_CONTENT>\n"
        f"{text}\n"
        "<END_UNTRUSTED_CONTENT>"
    ),
}]
formatted = tokenizer.apply_chat_template(
    messages,
    tokenize=False,
    add_generation_prompt=False,
)
encoded = tokenizer(formatted, truncation=False, padding=False)
for key, sequence in encoded.items():
    if len(sequence) > 2048:
        encoded[key] = (
            sequence[:1024]
            + sequence[-1024:]
        )
inputs = tokenizer.pad(encoded, padding=True, return_tensors="pt").to(model.device)

with torch.no_grad():
    scores = torch.sigmoid(model(**inputs).logits)[0].float().cpu().tolist()
thresholds = json.load(open(hf_hub_download(repo_id, "thresholds.json")))
result = {
    head: {
        "score": score,
        "detected": score >= thresholds["heads"][head]["threshold"],
    }
    for head, score in zip(heads, scores)
}

For batched inference, apply head-tail truncation to each sequence before padding. Content-safety and direct-injection inputs use user_prompt; untrusted documents or tool output use external_content.

Training and evaluation notes

• Training used a deterministic 100,000-record multilingual coreset with partial-label masking across content safety, direct prompt injection, and indirect prompt injection.
• Specialized supervision preserves the distinction between content safety, direct prompt injection, and indirect prompt injection.
• This version is optimized for user prompts and untrusted external content.

License

Apache-2.0. See LICENSE.

Citation

@misc{hikmaai-hikmaguard-2026,
  title={HikmaGuard},
  author={HikmaAI},
  year={2026},
  publisher={Hugging Face},
  url={https://huggingface.co/HikmaAI/HikmaGuard}
}