Instructions to use Z-Edgar/CoER-Defender with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use Z-Edgar/CoER-Defender with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("image-text-to-text", model="Z-Edgar/CoER-Defender")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
pipe(text=messages)

# Load model directly
from transformers import AutoProcessor, AutoModelForMultimodalLM

processor = AutoProcessor.from_pretrained("Z-Edgar/CoER-Defender")
model = AutoModelForMultimodalLM.from_pretrained("Z-Edgar/CoER-Defender", device_map="auto")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
inputs = processor.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(processor.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use Z-Edgar/CoER-Defender with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "Z-Edgar/CoER-Defender"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Z-Edgar/CoER-Defender",
		"messages": [
			{
				"role": "user",
				"content": [
					{
						"type": "text",
						"text": "Describe this image in one sentence."
					},
					{
						"type": "image_url",
						"image_url": {
							"url": "https://cdn.britannica.com/61/93061-050-99147DCE/Statue-of-Liberty-Island-New-York-Bay.jpg"
						}
					}
				]
			}
		]
	}'

Use Docker

docker model run hf.co/Z-Edgar/CoER-Defender

SGLang

How to use Z-Edgar/CoER-Defender with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "Z-Edgar/CoER-Defender" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Z-Edgar/CoER-Defender",
		"messages": [
			{
				"role": "user",
				"content": [
					{
						"type": "text",
						"text": "Describe this image in one sentence."
					},
					{
						"type": "image_url",
						"image_url": {
							"url": "https://cdn.britannica.com/61/93061-050-99147DCE/Statue-of-Liberty-Island-New-York-Bay.jpg"
						}
					}
				]
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "Z-Edgar/CoER-Defender" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Z-Edgar/CoER-Defender",
		"messages": [
			{
				"role": "user",
				"content": [
					{
						"type": "text",
						"text": "Describe this image in one sentence."
					},
					{
						"type": "image_url",
						"image_url": {
							"url": "https://cdn.britannica.com/61/93061-050-99147DCE/Statue-of-Liberty-Island-New-York-Bay.jpg"
						}
					}
				]
			}
		]
	}'

Docker Model Runner
How to use Z-Edgar/CoER-Defender with Docker Model Runner:
```
docker model run hf.co/Z-Edgar/CoER-Defender
```

CoER Defender

Project page · Paper · Code

The final CoER defender, refined from Co-PPO d430 at Defender-SFT update 360. It is trained to complete legitimate tool-use tasks safely under adaptive indirect prompt injection.

Download available. All 70 safetensors shards are uploaded and match their upload manifests; configuration, tokenizer and weight-index files are present. File verification is complete; GPU loading and inference have not been tested as part of this release check.

Updated paper Figure 2: Attacker SFT → bilateral Co-PPO → population-guided Defender SFT.

Training and role

CoER has three stages: Attacker SFT, bilateral Co-PPO, and population-guided Defender SFT. Historical opponent policies stay frozen; evaluated snapshots refresh the pools during Co-PPO. Online RL ends before supervised refinement.

The paper selects d430 by the highest defender reward during training. Teachers execute tasks from their initial states under retained attacks. Only safe, task-successful demonstrations are retained: 5,760 trajectories, comprising 4,907 attacked examples and 853 untriggered replays. All assistant turns receive supervision. The released checkpoint is update 360 after one data epoch within a configured two-epoch/720-update schedule.

Paper-reported results

Evaluation	Attack success ↓	Task utility ↑	Safe-U ↑
Main common-adaptive panel	0.25%	75.40%	75.40%
Main aggregate	0.22%	76.32%	76.32%
AgentLAB	14.12%	82.82%	77.13%

Adaptive results use 1,187 executions (3 compromised; 895 safe completions). Overall ASR uses 1,355 attacked executions, while overall utility uses all 1,512 eligible conditions. AgentLAB uses 949 selected trajectories. Safe-U requires task completion without compromise.

InjecAgent reports 0/1,043 base-payload successes and 20/1,016 enhanced-payload successes (1.97%). These protocol-specific attack metrics are not task utility. Historical-union ASR is 4.97% with four retained attackers and two attempts each, not freshly optimized best responses. Results describe one training run and are transcribed from the September 20 manuscript, not rerun while packaging.

Download and compatibility

from huggingface_hub import snapshot_download

model_dir = snapshot_download("Z-Edgar/CoER-Defender")

The checkpoint uses BF16, Qwen3_5ForConditionalGeneration and qwen3_5. The saved metadata records Transformers 5.3.0, not a tested dependency lock. Use a compatible stack and preserve the supplied tokenizer, special tokens and chat/tool formatting. Evaluation covers text/tool interactions, not multimodal safety.

The release uses smaller standard safetensors shards without changing tensor values. Download the complete repository, not an individual shard. See the training and evaluation code for rollout formatting and environment setup.

Related resources

Models: Attacker · Defender.
Training data: Attacker SFT · Defender SFT · RL configurations.

Use and licensing

Use in authorized, isolated research environments. Prompt-injection payloads and model outputs may be unsafe; do not attach uncontrolled tools, private data or real accounts. Public access does not grant additional rights beyond applicable source terms. This public repository is not an anonymous-reviewer resource.

The base family is Qwen3.5-9B; its license and notice are preserved in UPSTREAM_LICENSE. Rights in intermediate models, fine-tuned weights, training data and teacher outputs remain subject to their respective terms. A separate final-artifact license has not been confirmed.