| --- |
| license: apache-2.0 |
| base_model: jhu-clsp/mmBERT-base |
| base_model_relation: finetune |
| library_name: onnxruntime |
| pipeline_tag: text-classification |
| language: |
| - multilingual |
| - en |
| - es |
| - ko |
| - de |
| - ar |
| - fr |
| - ja |
| - it |
| - id |
| - ru |
| - hi |
| - zh |
| - nl |
| - tr |
| - vi |
| - pt |
| tags: |
| - safety |
| - moderation |
| - guardrails |
| - child-safety |
| - grooming-detection |
| - ai-companions |
| - multi-label-classification |
| - onnx |
| --- |
| |
| # PaxmodGuard v1 |
|
|
| A small, multilingual guardrail for **kids' game chat and AI companions**. It scores 48 labels for a single message, a |
| message with the turns before it, or a whole conversation, on an ordinary CPU: a few milliseconds for a short message. |
|
|
| - 0.3B parameters, fine-tuned from [mmBERT-base](https://huggingface.co/jhu-clsp/mmBERT-base); int8 ONNX, about 220 MB. |
| - Reads context: game chat between players, a person writing to an AI, and the AI's reply, each tagged by role. |
| - Covers what general guard models do not: grooming tactics (risk checks, secrecy, isolation, special-bond language), |
| minors revealing their age, moving chats off-platform, sextortion, and AI-companion behaviour (claiming to be human, |
| fostering dependency, manipulation). |
| - Built to keep false alarms low in kids' games: banter, roleplay and hyperbole are not harm by default. |
|
|
| [Launch post, with a live demo](https://www.paxmod.com/research/guard) |
|
|
| ## Use it |
|
|
| ```bash |
| npm install @paxmod/guard # JavaScript / TypeScript |
| pip install paxmod-guard # Python |
| ``` |
|
|
| ```js |
| import { createGuard } from "@paxmod/guard"; |
| const guard = await createGuard(); // downloads this model once to ~/.cache/paxmod-guard |
| |
| const r = await guard.checkInput("i dont want to be alive anymore"); |
| if (r.crisisReply) reply(r.crisisReply); // self-harm risk: answer with crisis support |
| |
| await guard.checkChat("wanna add me on snap", { context: [{ role: "player", speaker: "B", text: "im 12" }] }); |
| await guard.checkConversation(turns); // patterns no single message shows |
| ``` |
|
|
| ```python |
| from paxmod_guard import Guard |
| guard = Guard() |
| guard.check_output("I'm a real person, not an AI") # labels: ['ai_claims_human'] |
| ``` |
|
|
| Both SDKs read the same files and give identical scores. A Docker HTTP server is included for other languages. |
| The model needs about 1 GB of memory: run it in a container or on a server, not in small serverless functions. |
|
|
| ## Labels |
|
|
| Every label has a score from 0 to 1 and a tuned default threshold (in `guard.json`). Signal labels are always scored but |
| only count towards `flagged` when enabled. |
|
|
| | Area | Labels | |
| |---|---| |
| | Self-harm | `self_harm_intent`, `self_harm_instructions`, `eating_disorder`; signal: `distress` | |
| | Sexual | `sexual`, `sexual_suggestive`, `sexual_minor`; signal: `romantic` | |
| | Child safety | `minor_signal`, `grooming`, `grooming_suspected`, `image_request`, `sextortion`, `predator_report`, `abuse_disclosure`; signals: `age_inquiry`, `risk_check`, `secrecy`, `isolation`, `special_bond` | |
| | Personal info | `pii_shared`, `pii_request`, `pii_other`, `off_platform`, `meetup` | |
| | Abuse | `harassment`, `threat`, `hate`; signal: `profanity` | |
| | Violence and danger | `violence`, `extremism`, `dangerous_challenge`, `weapons`, `drugs`, `crime` | |
| | Fraud | `scam`, `spam` | |
| | Advice | `medical_advice`, `financial_advice`, `legal_advice` | |
| | AI behaviour | `jailbreak`, `prompt_injection`, `ai_claims_human`, `ai_claims_professional`, `dependency`, `manipulation`, `ai_harmful_compliance`, `ai_hostility` | |
| | General | signals: `unsafe` (any core harm under our policy), `unsafe_strict` (the broader definition public benchmarks use) | |
|
|
| ## Input format |
|
|
| The model reads role-tagged text, which the SDKs build for you: `[USER]` a person writing to an AI, `[AI]` the AI, |
| `[CHAT:A]` a player in game chat. With context, the judged turn is marked `[TARGET]`; a whole conversation starts with |
| `[CONVERSATION]` (the SDK reads long conversations in overlapping 40-turn windows). |
|
|
| ## Evaluation |
|
|
| All numbers are threshold-free (users set their own thresholds): **AUPRC**, how well scores rank harmful above harmless, |
| higher is better. Every system saw the same inputs; AI replies were judged with the prompt before them. Competitor |
| scores are each model's probability of its "unsafe" verdict. |
|
|
| ### Real chat from children's games (unseen) |
|
|
| About 53,000 messages from two children's online games, stored after our training data was frozen, so no model saw |
| them. 4,612 messages were labelled against our written safety policy (everything any system flagged, plus a uniform |
| random sample of the rest, weighted to the full stream). This data is not public. |
|
|
| | Model | Size | Game A | Game B | |
| |---|---|---|---| |
| | **PaxmodGuard v1** | 0.3B | 0.17 | 0.12 | |
| | ShieldGemma | 9B | **0.19** | 0.16 | |
| | Qwen3Guard-4B | 4B | 0.13 | **0.38** | |
| | Qwen3Guard-8B | 8B | 0.13 | 0.28 | |
| | Granite Guardian 3.3 | 8B | 0.08 | 0.15 | |
| | Qwen3Guard-0.6B | 0.6B | 0.07 | 0.15 | |
| | Llama Guard 3 | 8B | 0.06 | 0.03 | |
| | GLiGuard | 0.3B | 0.02 | 0.04 | |
|
|
| PaxmodGuard v1 has the best ROC-AUC of all these models on both games (0.85 and 0.87, against at most 0.80); larger models are more precise among their most confident flags on one game each. Harm is about 1% of real chat, |
| so absolute AUPRC is low for every system; random scoring would get about 0.01. |
|
|
| ### Public benchmarks (AUPRC) |
|
|
| | Model | ToxicChat | OpenAI Mod | Aegis 2.0 | XSTest | Aegis 2.0 replies | BeaverTails replies | PolyGuard (17 languages) | WildGuardTest | |
| |---|---|---|---|---|---|---|---|---| |
| | **PaxmodGuard v1** | 0.73 | 0.83 | 0.89 | 0.76 | 0.86 | 0.88 | 0.76 | 0.81 | |
| | **PaxmodGuard v1, `unsafe_strict`** | 0.64 | 0.87 | 0.90 | 0.81 | 0.89 | 0.88 | 0.77 | 0.82 | |
| | Qwen3Guard-0.6B | 0.86 | 0.86 | 0.92 | 0.95 | 0.92 | 0.94 | 0.91 | 0.95 | |
| | Qwen3Guard-8B | 0.86 | 0.86 | 0.92 | 0.99 | 0.94 | 0.93 | 0.93 | 0.95 | |
| | Granite Guardian 3.3 8B | 0.78 | 0.84 | 0.90 | 0.96 | 0.89 | 0.91 | 0.88 | 0.94 | |
| | Llama Guard 3 8B | 0.49 | 0.87 | 0.89 | 0.97 | 0.88 | 0.89 | 0.87 | 0.91 | |
| | ShieldGemma 9B | 0.82 | 0.89 | 0.89 | 0.91 | 0.86 | 0.77 | 0.78 | 0.82 | |
| | GLiGuard 0.3B | 0.75 | 0.74 | 0.92 | 0.92 | | | 0.85 | 0.90 | |
| |
| On general-purpose benchmarks, Qwen3Guard ranks better than PaxmodGuard v1. These benchmarks also count as unsafe much |
| that our policy deliberately allows (controversial opinions, mild insults, educational answers about dangerous topics); |
| `unsafe_strict` follows their broader definition. GLiGuard reply scores are omitted (incomplete run). |
| |
| ### Over-blocking |
| |
| Share of safe prompts that only sound harmful wrongly blocked, on OR-Bench-Hard, at each model's default setting: |
| **PaxmodGuard v1 17%**, Qwen3Guard-8B 38%, Qwen3Guard-0.6B 49%, gpt-oss-safeguard-20B 82%, Granite Guardian 89%. |
| |
| ## Training data |
| |
| Publicly available and synthetic data, labelled against our written safety policy. The policy is lax by design: a label |
| means a moderator would genuinely want to see the message. |
| |
| ## Limits |
| |
| - Real kids' chat is hard: no model we tested, this one included, reaches 90% precision at a useful catch rate on it. |
| Use the scores to rank and route messages to people, not as a sole decision. |
| - Grooming is mostly visible across a conversation; single messages carry only the tactic signals. Use `checkConversation`. |
| - Weaker than larger general guard models on general-purpose benchmarks. |
| - Most training data is English and Spanish; other languages are covered but less tested. |
| - The policy is ours: tune per-label thresholds for your product. |
| |
| ## PaxmodGuard Cloud |
| |
| A larger-data version of this model, also trained on proprietary data, runs in the [Paxmod](https://www.paxmod.com) API. |
| On the same unseen game chat it scores 0.28 and 0.22 AUPRC (ROC-AUC 0.87 and 0.98), ahead of every model above on both games by ROC-AUC. |
| |
| ## Licence |
| |
| Apache-2.0. Base model: mmBERT-base (MIT). |
| |
