README.md

metadata

license: apache-2.0
base_model: jhu-clsp/mmBERT-base
base_model_relation: finetune
library_name: onnxruntime
pipeline_tag: text-classification
language:
  - multilingual
  - en
  - es
  - ko
  - de
  - ar
  - fr
  - ja
  - it
  - id
  - ru
  - hi
  - zh
  - nl
  - tr
  - vi
  - pt
tags:
  - safety
  - moderation
  - guardrails
  - child-safety
  - grooming-detection
  - ai-companions
  - multi-label-classification
  - onnx

PaxmodGuard v1

A small, multilingual guardrail for kids' game chat and AI companions. It scores 48 labels for a single message, a message with the turns before it, or a whole conversation, on an ordinary CPU: a few milliseconds for a short message.

• 0.3B parameters, fine-tuned from mmBERT-base; int8 ONNX, about 220 MB.
• Reads context: game chat between players, a person writing to an AI, and the AI's reply, each tagged by role.
• Covers what general guard models do not: grooming tactics (risk checks, secrecy, isolation, special-bond language), minors revealing their age, moving chats off-platform, sextortion, and AI-companion behaviour (claiming to be human, fostering dependency, manipulation).
• Built to keep false alarms low in kids' games: banter, roleplay and hyperbole are not harm by default.

Launch post, with a live demo

Use it

npm install @paxmod/guard     # JavaScript / TypeScript
pip install paxmod-guard      # Python

import { createGuard } from "@paxmod/guard";
const guard = await createGuard();                   // downloads this model once to ~/.cache/paxmod-guard

const r = await guard.checkInput("i dont want to be alive anymore");
if (r.crisisReply) reply(r.crisisReply);             // self-harm risk: answer with crisis support

await guard.checkChat("wanna add me on snap", { context: [{ role: "player", speaker: "B", text: "im 12" }] });
await guard.checkConversation(turns);                // patterns no single message shows

from paxmod_guard import Guard
guard = Guard()
guard.check_output("I'm a real person, not an AI")   # labels: ['ai_claims_human']

Both SDKs read the same files and give identical scores. A Docker HTTP server is included for other languages. The model needs about 1 GB of memory: run it in a container or on a server, not in small serverless functions.

Labels

Every label has a score from 0 to 1 and a tuned default threshold (in guard.json). Signal labels are always scored but only count towards flagged when enabled.

Area	Labels
Self-harm	self_harm_intent, self_harm_instructions, eating_disorder; signal: distress
Sexual	sexual, sexual_suggestive, sexual_minor; signal: romantic
Child safety	minor_signal, grooming, grooming_suspected, image_request, sextortion, predator_report, abuse_disclosure; signals: age_inquiry, risk_check, secrecy, isolation, special_bond
Personal info	pii_shared, pii_request, pii_other, off_platform, meetup
Abuse	harassment, threat, hate; signal: profanity
Violence and danger	violence, extremism, dangerous_challenge, weapons, drugs, crime
Fraud	scam, spam
Advice	medical_advice, financial_advice, legal_advice
AI behaviour	jailbreak, prompt_injection, ai_claims_human, ai_claims_professional, dependency, manipulation, ai_harmful_compliance, ai_hostility
General	signals: unsafe (any core harm under our policy), unsafe_strict (the broader definition public benchmarks use)

Input format

The model reads role-tagged text, which the SDKs build for you: [USER] a person writing to an AI, [AI] the AI, [CHAT:A] a player in game chat. With context, the judged turn is marked [TARGET]; a whole conversation starts with [CONVERSATION] (the SDK reads long conversations in overlapping 40-turn windows).

Evaluation

All numbers are threshold-free (users set their own thresholds): AUPRC, how well scores rank harmful above harmless, higher is better. Every system saw the same inputs; AI replies were judged with the prompt before them. Competitor scores are each model's probability of its "unsafe" verdict.

Real chat from children's games (unseen)

About 53,000 messages from two children's online games, stored after our training data was frozen, so no model saw them. 4,612 messages were labelled against our written safety policy (everything any system flagged, plus a uniform random sample of the rest, weighted to the full stream). This data is not public.

Model	Size	Game A	Game B
PaxmodGuard v1	0.3B	0.17	0.12
ShieldGemma	9B	0.19	0.16
Qwen3Guard-4B	4B	0.13	0.38
Qwen3Guard-8B	8B	0.13	0.28
Granite Guardian 3.3	8B	0.08	0.15
Qwen3Guard-0.6B	0.6B	0.07	0.15
Llama Guard 3	8B	0.06	0.03
GLiGuard	0.3B	0.02	0.04

PaxmodGuard v1 has the best ROC-AUC of all these models on both games (0.85 and 0.87, against at most 0.80); larger models are more precise among their most confident flags on one game each. Harm is about 1% of real chat, so absolute AUPRC is low for every system; random scoring would get about 0.01.

Public benchmarks (AUPRC)

Model	ToxicChat	OpenAI Mod	Aegis 2.0	XSTest	Aegis 2.0 replies	BeaverTails replies	PolyGuard (17 languages)	WildGuardTest
PaxmodGuard v1	0.73	0.83	0.89	0.76	0.86	0.88	0.76	0.81
PaxmodGuard v1, unsafe_strict	0.64	0.87	0.90	0.81	0.89	0.88	0.77	0.82
Qwen3Guard-0.6B	0.86	0.86	0.92	0.95	0.92	0.94	0.91	0.95
Qwen3Guard-8B	0.86	0.86	0.92	0.99	0.94	0.93	0.93	0.95
Granite Guardian 3.3 8B	0.78	0.84	0.90	0.96	0.89	0.91	0.88	0.94
Llama Guard 3 8B	0.49	0.87	0.89	0.97	0.88	0.89	0.87	0.91
ShieldGemma 9B	0.82	0.89	0.89	0.91	0.86	0.77	0.78	0.82
GLiGuard 0.3B	0.75	0.74	0.92	0.92			0.85	0.90

On general-purpose benchmarks, Qwen3Guard ranks better than PaxmodGuard v1. These benchmarks also count as unsafe much that our policy deliberately allows (controversial opinions, mild insults, educational answers about dangerous topics); unsafe_strict follows their broader definition. GLiGuard reply scores are omitted (incomplete run).

Over-blocking

Share of safe prompts that only sound harmful wrongly blocked, on OR-Bench-Hard, at each model's default setting: PaxmodGuard v1 17%, Qwen3Guard-8B 38%, Qwen3Guard-0.6B 49%, gpt-oss-safeguard-20B 82%, Granite Guardian 89%.

Training data

Publicly available and synthetic data, labelled against our written safety policy. The policy is lax by design: a label means a moderator would genuinely want to see the message.

Limits

• Real kids' chat is hard: no model we tested, this one included, reaches 90% precision at a useful catch rate on it. Use the scores to rank and route messages to people, not as a sole decision.
• Grooming is mostly visible across a conversation; single messages carry only the tactic signals. Use checkConversation.
• Weaker than larger general guard models on general-purpose benchmarks.
• Most training data is English and Spanish; other languages are covered but less tested.
• The policy is ours: tune per-label thresholds for your product.

PaxmodGuard Cloud

A larger-data version of this model, also trained on proprietary data, runs in the Paxmod API. On the same unseen game chat it scores 0.28 and 0.22 AUPRC (ROC-AUC 0.87 and 0.98), ahead of every model above on both games by ROC-AUC.

Licence

Apache-2.0. Base model: mmBERT-base (MIT).