Add Merlin v0.1 model release

Publish the calibrated DeBERTa-v3-xsmall checkpoint, tokenizer, model card, preprocessing configuration, and release manifest.

README.md

@@ -0,0 +1,82 @@
+---
+license: other
+license_name: merlin-research-release
+base_model: microsoft/deberta-v3-xsmall
+library_name: transformers
+pipeline_tag: text-classification
+tags:
+  - agents
+  - agent-safety
+  - tool-use
+  - prompt-injection
+  - deberta-v3
+---
+
+# Merlin
+
+Merlin is a 70.8M-parameter local encoder that classifies a proposed AI-agent
+tool invocation as `safe` or `unsafe` using its surrounding context.
+
+This repository contains the portable checkpoint. Use the reference package at
+<https://github.com/kontext-security/merlin>; a generic Transformers pipeline
+does **not** reproduce the benchmark because Merlin uses four independently
+budgeted fields, deterministic history normalization, and a validation-fitted
+calibrator.
+
+## Inputs
+
+1. user request
+2. prior interaction history
+3. current tool name and arguments
+4. tool descriptions/schemas
+
+Prior ReAct history is converted to canonical JSON tool/argument/observation
+events. `Thought` and `Final Answer` text is excluded. The current action is
+reduced to tool name and arguments. Each field has its own token budget within a
+512-token packed sequence.
+
+## Results
+
+Strict binary evaluation on TS-Bench (`0.0` safe; `0.5` and `1.0` unsafe), fixed
+0.5 threshold:
+
+| Split | N | Accuracy | Precision | Recall | F1 |
+|---|---:|---:|---:|---:|---:|
+| All TS-Bench | 7,182 | 91.19% | 92.66% | 88.45% | 90.51% |
+| ASB-Traj | 5,231 | 99.73% | 99.76% | 99.68% | 99.72% |
+| AgentDojo-Traj | 1,220 | 71.80% | 51.14% | 50.85% | 51.00% |
+| AgentHarm-Traj | 731 | 62.38% | 83.42% | 59.43% | 69.41% |
+
+The pooled score is dominated by ASB-Traj and is not evidence of uniform
+cross-environment performance. See the GitHub repository for the full protocol,
+preprocessing code, data provenance, system measurements, and limitations.
+
+## Training
+
+- Base: `microsoft/deberta-v3-xsmall` at revision
+  `4b419818330868dff6a60ad3e6b1c730f8b8c0c6`
+- Train: 2,192 examples (841 safe, 1,351 unsafe)
+- Validation: 789 examples
+- Epochs: 5; learning rate: 2e-5; batch size: 8; gradient accumulation: 2
+- Sigmoid calibration coefficient: 1.427213430140093
+- Sigmoid calibration intercept: 2.953687013257505
+- Default threshold: 0.5
+
+## Intended use
+
+Use Merlin as a low-latency, local safety signal before executing an agent tool
+call. It is not a complete authorization layer and should be combined with
+least privilege, deterministic policy, sandboxing, and human confirmation for
+consequential actions.
+
+Do not use it as the sole control for high-impact actions, as a general content
+moderator, or outside the documented input representation without evaluation.
+
+## Data and license
+
+The base model is MIT licensed. Merlin was fine-tuned on TS-Bench data from
+<https://github.com/MurrayTom/ToolSafe>. That repository had no explicit
+repository license at release time, so the checkpoint is marked `other` and no
+raw TS-Bench examples are mirrored here. Review upstream terms before commercial
+use or redistribution. Reference code is Apache-2.0.
+

config.json

@@ -0,0 +1,46 @@
+{
+  "architectures": [
+    "DebertaV2ForSequenceClassification"
+  ],
+  "attention_probs_dropout_prob": 0.1,
+  "bos_token_id": null,
+  "dtype": "float32",
+  "eos_token_id": null,
+  "hidden_act": "gelu",
+  "hidden_dropout_prob": 0.1,
+  "hidden_size": 384,
+  "id2label": {
+    "0": "safe",
+    "1": "unsafe"
+  },
+  "initializer_range": 0.02,
+  "intermediate_size": 1536,
+  "label2id": {
+    "safe": 0,
+    "unsafe": 1
+  },
+  "layer_norm_eps": 1e-07,
+  "legacy": true,
+  "max_position_embeddings": 512,
+  "max_relative_positions": -1,
+  "model_type": "deberta-v2",
+  "norm_rel_ebd": "layer_norm",
+  "num_attention_heads": 6,
+  "num_hidden_layers": 12,
+  "pad_token_id": 0,
+  "pooler_dropout": 0.0,
+  "pooler_hidden_act": "gelu",
+  "pooler_hidden_size": 384,
+  "pos_att_type": [
+    "p2c",
+    "c2p"
+  ],
+  "position_biased_input": false,
+  "position_buckets": 256,
+  "relative_attention": true,
+  "share_att_key": true,
+  "tie_word_embeddings": true,
+  "transformers_version": "5.14.1",
+  "type_vocab_size": 0,
+  "vocab_size": 128005
+}

merlin_config.json

@@ -0,0 +1,37 @@
+{
+  "schema_version": 1,
+  "model_name": "Merlin",
+  "task": "contextual_tool_invocation_safety",
+  "labels": {
+    "0": "safe",
+    "1": "unsafe"
+  },
+  "default_threshold": 0.5,
+  "calibration": {
+    "method": "sigmoid_on_unsafe_logit_margin",
+    "coefficient": 1.427213430140093,
+    "intercept": 2.953687013257505
+  },
+  "preprocessing": {
+    "max_length": 512,
+    "history": "thought_free_canonical_json",
+    "current_action": "tool_name_and_arguments",
+    "field_budgets": {
+      "request": 96,
+      "history": 144,
+      "action": 128,
+      "schema": 128
+    },
+    "field_markers": {
+      "request": "[USER_REQUEST]",
+      "history": "[INTERACTION_HISTORY]",
+      "action": "[CURRENT_ACTION]",
+      "schema": "[TOOL_DESCRIPTIONS]"
+    }
+  },
+  "base_model": {
+    "id": "microsoft/deberta-v3-xsmall",
+    "revision": "4b419818330868dff6a60ad3e6b1c730f8b8c0c6"
+  }
+}
+

model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:075d68f8bb4c1b4b98e2d2b2c0d5b013056b202172b080b34e7364b698844c86
+size 283201512

release_manifest.json

@@ -0,0 +1,29 @@
+{
+  "files": {
+    "README.md": {
+      "sha256": "164567319e0d19e6b6668418b08cb4b74aa5038bb3f9354b532a2349e598e547",
+      "size": 2980
+    },
+    "config.json": {
+      "sha256": "efef456ee38a88cd92f6adf908a6f3d3c257fee52737ba8f05814617561b0b32",
+      "size": 1032
+    },
+    "merlin_config.json": {
+      "sha256": "11541251d6caf677e3f621627e95ced7f3fd228e008ccdf6c7c2343b5ef76011",
+      "size": 888
+    },
+    "model.safetensors": {
+      "sha256": "075d68f8bb4c1b4b98e2d2b2c0d5b013056b202172b080b34e7364b698844c86",
+      "size": 283201512
+    },
+    "tokenizer.json": {
+      "sha256": "d6c20af053b5d86d986a9f70898c1fceccb9d93e7ce6f63dabc899a12a53b031",
+      "size": 8340654
+    },
+    "tokenizer_config.json": {
+      "sha256": "141468772d3b095cc30275fd9c05dff92a78619c341487da9f5549a3564ea6cb",
+      "size": 601
+    }
+  },
+  "schema_version": 1
+}

tokenizer_config.json

@@ -0,0 +1,25 @@
+{
+  "add_prefix_space": true,
+  "backend": "tokenizers",
+  "bos_token": "[CLS]",
+  "cls_token": "[CLS]",
+  "do_lower_case": false,
+  "eos_token": "[SEP]",
+  "extra_special_tokens": [
+    "[USER_REQUEST]",
+    "[INTERACTION_HISTORY]",
+    "[CURRENT_ACTION]",
+    "[TOOL_DESCRIPTIONS]"
+  ],
+  "is_local": false,
+  "local_files_only": false,
+  "mask_token": "[MASK]",
+  "model_max_length": 1000000000000000019884624838656,
+  "pad_token": "[PAD]",
+  "sep_token": "[SEP]",
+  "split_by_punct": false,
+  "tokenizer_class": "DebertaV2Tokenizer",
+  "unk_id": 3,
+  "unk_token": "[UNK]",
+  "vocab_type": "spm"
+}