mehedi4/SafeAge-Guard

SafeAge Guard

SafeAge Guard is a context-sensitive allow/block request classifier, developed by the SafeAge authors by fine-tuning Qwen3-1.7B with LoRA and a trained binary classification head on SafeAge. It supports Bangla, Bangla-English mixed text, romanized Bangla (Banglish), and an aligned English reference form.

This repository releases the original LoRA adapter and trained classification head, tokenizer, decision threshold, reproducibility metadata, and an explicit loading example. The adapter requires the pinned Qwen base model; it is not a standalone full-base checkpoint.

The pretrained architecture is credited to the Qwen team, and low-rank adaptation to the established LoRA method. Our contribution is the SafeAge dataset, its task-specific adaptation and supervised training, and the evaluation protocol and findings. We do not propose a new architecture or adaptation algorithm.

Intended use and decisions

The model assigns one of two decisions to the complete visible request and its supplied context:

• Allow: ordinary assistance, sensitive-topic discussion, defensive work, and authorized tasks under the SafeAge policy.
• Block: harmful facilitation, permission bypass, unauthorized disclosure, and malicious instructions from lower-trust sources.

The saved class names are 0 = benign (allow) and 1 = attack (block). The block class covers more than prompt injection. Block when the class-1 softmax probability is greater than or equal to 0.24, the validation-selected operating point. SafeAge's labels do not measure age suitability.

Loading and inference

The original run used Transformers 5.5.4, PEFT 0.19.1, and PyTorch 2.11.0. Install the versions in requirements.txt and download inference.py from this repository. The first run also downloads the pinned public Qwen base model.

pip install -r requirements.txt
python inference.py --text "Explain how to protect my own account from phishing."

For a request stored in a UTF-8 file:

python inference.py --text-file request.txt

Programmatic usage, with inference.py in the working directory:

from inference import load_guard, classify_texts

guard = load_guard("mehedi4/SafeAge-Guard")
results = classify_texts(["Explain how to protect my own account from phishing."], guard)
print(results)

Use the explicit classifier loader. The original config.json preserves a Qwen3ForCausalLM architecture string inherited from the base, whereas this adapter is a sequence classifier (SEQ_CLS). inference.py instantiates AutoModelForSequenceClassification with two labels and then loads the adapter and saved score head through PeftModel. Loading as a text-generation model would not reproduce the task.

The loader uses FP32, SDPA attention, right padding, and a maximum of 512 tokens, matching the main evaluation configuration. It explicitly sets right truncation, the library default used by the original code; the saved tokenizer configuration did not serialize a truncation-side override. Supply raw request text, including its relevant visible context; do not apply a chat template. Inputs beyond 512 tokens are truncated. The chat_template.jinja file is retained for tokenizer provenance and is not applied by the classifier.

A newly initialized base classification-head warning may appear before the adapter loads: the trained head is present in adapter_model.safetensors and is restored by PEFT. Do not use the unadapted base classifier for the reported evaluation.

Training and data

SafeAge dataset documentation and release describes 24,508 labeled requests from 6,127 aligned four-form cases. The fixed partitions contain 22,096 training, 1,208 validation, and 1,204 test requests; related cases remain grouped within a partition. Validation and test are author-reviewed constructed cases from synthetic scenario expansions, not independently collected user traffic.

The two authors annotated disjoint assigned subsets and repeatedly reviewed their own examples. The same procedure applied to validation and test. Examples were not independently double-annotated, so inter-annotator agreement was not estimated.

Setting	Value
Base model	Qwen/Qwen3-1.7B
Exact base revision	70d244cc86ccca08cf5af4e1e306ecf908b1ad5e
Adaptation	LoRA and a trained binary score head
LoRA rank / alpha / dropout	16 / 32 / 0.05
LoRA targets	q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj
Trainable parameters	17,436,672
Precision	FP32
Optimizer / learning rate	AdamW / 0.0001
Effective batch size	32
Completed epochs / selected epoch	5 / 3
Training seed	42
Maximum input length	512 tokens
Checkpoint selection	Highest validation macro F1 at threshold 0.5
Decision threshold selection	Validation macro F1, then frozen for test

Held-out evaluation

At the fixed threshold 0.24, the original checkpoint achieved the following on 1,204 SafeAge test requests (301 cases; 199 connected groups):

Metric	Result
Accuracy	95.43%
Macro F1	95.07%
Block precision	95.59%
Block recall	91.96%
Benign false positive rate	2.51%
Brier score	0.03885

Confusion counts: 737 true negatives, 19 false positives, 36 false negatives, and 412 true positives. evaluation/test_metrics.json contains the archived metrics at thresholds 0.5 and 0.24; evaluation/test_by_language_variant.csv contains the language breakdown. These are the original run's measurements, not a new inference run during release.

Verification and limitations

All recovered checkpoint files were checked against the original training-run SHA256 manifest. The adapter SHA256 is:

ed95d3fe63571c15d11dfa28e2f1f2eac8508393e4979b6222554366bd8f9c02

The file contains 392 LoRA tensors and the trained binary score.weight tensor of shape [2, 2048], all FP32. The original training run successfully reloaded this adapter and head on eight validation examples, with a maximum positive-probability difference of 5.45e-08; the archived check is included in provenance/adapter_reload_check.json. Release preparation verifies artifact identity and structure; it does not constitute a new model inference evaluation.

Results are from a single training seed on an author-curated benchmark with synthetic held-out scenarios and no measured independent annotation agreement. Template regularities, translation style, and the 512-token input limit can affect performance. The model has not established universal safety performance, reliable age suitability, downstream response safety, or complete agent security. A claimed permission inside untrusted text does not establish authorization; applications must supply and enforce trusted context. The validation-selected threshold does not guarantee the same error rates on other data.

License and attribution

The repository's existing MIT license selection is retained for the SafeAge adapter and accompanying original release materials; see LICENSE. Qwen's base model and the copied tokenizer/base-derived configuration materials remain subject to their upstream Apache License 2.0, included as LICENSE.base-model.apache-2.0. The base-model weights are downloaded separately. The dataset has its own release terms; the adapter's license does not relicense the dataset or upstream materials.

Dataset authors: Md. Rehanul Bary and Mehedi Hasan Emon. Associated manuscript: SafeAge: A Context-Sensitive Safety Classification Benchmark for Four Language Forms of Bangla. No conference acceptance or publication is claimed by this model card.

The provenance folder records original artifact checksums, framework versions, the verified reload check, and release verification. Original experiment identifiers retain historical version strings to preserve traceability; the dataset's display name is SafeAge.