Update README.md

README.md

@@ -6,20 +6,25 @@ tags:
 - jailbreak-detection
 - decision-model
 - security
+language:
+- en
+base_model:
+- convaiinnovations/laya
 ---
 
-# safe-laya, prompt-attack classifier (Laya 421M fine-tune)
+# safe-laya - prompt attack classifier
 
 **Base:** [convaiinnovations/laya](https://huggingface.co/convaiinnovations/laya) @ `55cf4c4e` (Apache-2.0, 421M ModernBERT-large decision model)
-**Fine-tune data:** 24 pinned public sources plus deterministic synthetic sources (per-source license/revision/rows in the [AI-BOM](./bom.cdx.json)); 11,314 training items, one-hot labels
-**Training:** 1 epoch, RLCD + soft cross-entropy (upstream recipe), bf16 on a rented A10G, calibration refitted on a held-out split, ~25 minutes, ~$2 of GPU
+
+**Fine-tune data:** 24 pinned public sources and deterministic synthetic sources (see license/revision/rows in the [AI-BOM](./bom.cdx.json)). 11,314 training items, one-hot labels.
+
+**Training:** 1 epoch, RLCD + soft cross-entropy (from upstream's recipe). Calibration refitted on a held-out split. ~25 minutes and ~$2 of a A10G GPU.
+
 **License:** Apache-2.0
 
 ## Intended use
 
-Classify **untrusted text** (user prompts, retrieved documents, tool outputs) by the risk
-it poses *to an AI assistant*, as a local, cheap, private signal for prompt-injection
-defenses:
+Classify **untrusted text** (user prompts, retrieved documents, tool outputs) by the risk it poses *to an AI assistant*, as a local, cheap, private signal for prompt-injection defenses:
 
 | label | meaning |
 |---|---|
@@ -28,10 +33,9 @@ defenses:
 | `JAILBREAK` | role-play, persona, hypothetical or persuasion framing to get around safety rules |
 | `HARMFUL_REQUEST` | directly asks for harmful content, no manipulation framing |
 
-**Not** a content-safety filter, and **not** a complete prompt-injection defense. One
-forward pass, no generation: ~30 ms GPU, ~9 rows/s laptop CPU. Out of scope:
-adversarial-suffix attacks (GCG/DSN), image/audio attacks, languages outside the
-training mix (English-dominant).
+**Not** a content-safety filter or a complete prompt-injection defense. One forward pass, no generation: ~30 ms GPU, ~9 rows/s laptop CPU. 
+
+Out of scope: adversarial-suffix attacks (GCG/DSN), image/audio attacks, languages outside the training mix (English-dominant).
 
 ## Quick start
 
@@ -56,9 +60,7 @@ Use the `criteria` text verbatim; it is part of the trained task.
 
 ## Decision policy
 
-Flag = **p(PROMPT_INJECTION) + p(JAILBREAK) ≥ 0.30**. A high `p(HARMFUL_REQUEST)` alone
-never flags: this is an *injection guard*, not a content-safety filter. Tune the
-threshold for your tolerance.
+Flag = **p(PROMPT_INJECTION) + p(JAILBREAK) ≥ 0.30**. A high `p(HARMFUL_REQUEST)` alone never flags: this is an *injection guard*, not a content-safety filter. Tune the threshold for your tolerance.
 
 ## Metrics (identical question and OOD sets across compared models)
 
@@ -70,8 +72,7 @@ threshold for your tolerance.
 | XSTest-safe (scary-word benign) | 250 | injection-view FPR | 0.80 |
 | deepset prompt-injections (test) | 116 | binary acc | 0.802 @ p(attack) 0.5 |
 
-Full sweeps and the comparison against a hosted decision baseline are in the
-[repo reports](https://github.com/ottosulin/safe-laya/tree/main/reports).
+Full sweeps and the comparison against a hosted decision baseline are in the [repo reports](https://github.com/ottosulin/safe-laya/tree/main/reports).
 
 ## Limitations
 
@@ -85,10 +86,7 @@ Full sweeps and the comparison against a hosted decision baseline are in the
 
 ## Verification artefacts
 
-`bom.cdx.json` (CycloneDX 1.6 AI-BOM: file hashes, every training source's revision +
-license + row counts, lineage, eval metrics) and `model.sig` ([OpenSSF Model
-Signing](https://github.com/sigstore/model-transparency), ECDSA P-256 over every file's
-SHA-256 including the BOM). Verify:
+`bom.cdx.json` (CycloneDX 1.6 AI-BOM: file hashes, every training source's revision + license + row counts, lineage, eval metrics) and `model.sig` ([OpenSSF Model Signing](https://github.com/sigstore/model-transparency), ECDSA P-256 over every file's SHA-256 including the BOM). Verify:
 
 ```bash
 git clone https://github.com/ottosulin/safe-laya && cd safe-laya
@@ -97,8 +95,6 @@ scripts/sign.sh verify <checkpoint-dir> signing/safe-laya-signing.pub.pem
 
 ## Reproducibility
 
-Full pipeline in the repo, pinned end-to-end: base checkpoint @ `55cf4c4e`, vendored
-upstream code, seeded trainer, deterministic data build (pinned sources + synthetic
-generators, byte-for-byte), committed conversion. `make data && make items && make
-train` rebuilds the training set and reproduces the fine-tune; `space-train/` runs it
-on a HF Space GPU for ~$2.
+Full pipeline in the repo, pinned end-to-end: base checkpoint @ `55cf4c4e`, vendored upstream code, seeded trainer, deterministic data build (pinned sources + synthetic generators, byte-for-byte), committed conversion. 
+
+`make data && make items && make train` rebuilds the training set and reproduces the fine-tune; `space-train/` runs it on a HF Space GPU for ~$2.