PaxmodGuard v1

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+paxmodguard-v1/tokenizer.json filter=lfs diff=lfs merge=lfs -text

README.md

@@ -1,101 +1,169 @@
 ---
 license: apache-2.0
-language: [en]
-library_name: onnx
+base_model: jhu-clsp/mmBERT-base
+library_name: onnxruntime
 pipeline_tag: text-classification
-base_model: answerdotai/ModernBERT-base
-tags: [safety, guardrails, moderation, content-safety, ai-companion, chatbot, onnx]
+language:
+- multilingual
+- en
+- es
+- ko
+- de
+- ar
+- fr
+- ja
+- it
+- id
+- ru
+- hi
+- zh
+- nl
+- tr
+- vi
+- pt
+tags:
+- safety
+- moderation
+- guardrails
+- child-safety
+- grooming-detection
+- ai-companions
+- multi-label-classification
+- onnx
 ---
 
-# Paxmod Guard
+# PaxmodGuard v1
 
-A small, fast safety classifier for AI companions and chatbots. It checks a user's message before your bot sees it, and your bot's reply before the user does, in a few milliseconds on an ordinary CPU.
+A small, multilingual safety classifier for **kids' game chat and AI companions**. It scores 48 labels for a single
+message, a message with the turns before it, or a whole conversation, on an ordinary CPU in about 10 to 40 ms.
 
-- **Size:** 151 MB (about 5 ms per message) or 399 MB for the large model (about 11 ms), int8 ONNX on two CPU threads. No GPU needed.
-- **Labels:** 13, including the harms specific to companion apps that general guard models don't cover: a bot claiming to be human, emotional dependency, moving the chat to another app, and signs the user is a minor.
-- **Use it from code:** `npm install @paxmod/guard` (Node.js), with adapters for the Vercel AI SDK, OpenAI Agents SDK, Mastra and LangChain.
+- 0.3B parameters, fine-tuned from [mmBERT-base](https://huggingface.co/jhu-clsp/mmBERT-base); int8 ONNX, about 220 MB.
+- Reads context: game chat between players, a person writing to an AI, and the AI's reply, each tagged by role.
+- Covers what general guard models do not: grooming tactics (risk checks, secrecy, isolation, special-bond language),
+  minors revealing their age, moving chats off-platform, sextortion, and AI-companion behaviour (claiming to be human,
+  fostering dependency, manipulation).
+- Built to keep false alarms low in kids' games: banter, roleplay and hyperbole are not harm by default.
+
+[Launch post, with a live demo](https://www.paxmod.com/research/guard)
+
+## Use it
+
+```bash
+npm install @paxmod/guard     # JavaScript / TypeScript
+pip install paxmod-guard      # Python
+```
+
+```js
+import { createGuard } from "@paxmod/guard";
+const guard = await createGuard();                   // downloads this model once to ~/.cache/paxmod-guard
+
+const r = await guard.checkInput("i dont want to be alive anymore");
+if (r.crisisReply) reply(r.crisisReply);             // self-harm risk: answer with crisis support
+
+await guard.checkChat("wanna add me on snap", { context: [{ role: "player", speaker: "B", text: "im 12" }] });
+await guard.checkConversation(turns);                // patterns no single message shows
+```
+
+```python
+from paxmod_guard import Guard
+guard = Guard()
+guard.check_output("I'm a real person, not an AI")   # labels: ['ai_claims_human']
+```
+
+Both SDKs read the same files and give identical scores. A Docker HTTP server is included for other languages.
+The model needs about 1 GB of memory: run it in a container or on a server, not in small serverless functions.
 
 ## Labels
 
-| Label | Meaning |
+Every label has a score from 0 to 1 and a tuned default threshold (in `guard.json`). Signal labels are always scored but
+only count towards `flagged` when enabled.
+
+| Area | Labels |
 |---|---|
-| `self_harm` | Suicidal thoughts, plans or self-injury (user); the bot encourages or explains self-harm (bot) |
-| `minor_signal` | The text indicates the user is under 18. Supporting evidence only; this is not age verification |
-| `sexual` | Sexual content or requests |
-| `sexual_minor` | Sexual content involving someone who signals they are under 18 |
-| `jailbreak` | Attempts to override the bot's rules or identity |
-| `ai_disclosure_violation` | The bot claims to be human |
-| `pii` | Phone numbers, addresses, exact school, emails, social handles |
-| `off_platform` | Moving the chat to another app or service |
-| `dependency` | The bot isolates the user, guilt-trips them, or encourages secrecy from parents |
-| `harassment` | Insults, threats or intimidation aimed at a person |
-| `manipulation` | The bot encourages controlling behaviour or pressures the user against their interests |
-| `harmful_other` | Instructions or requests for serious harm: violence, weapons, drugs, crime, fraud, malware |
-| `hate` | Attacks on people for a protected trait |
-
-The full labelling policy is in `policy.md`. Input format: prefix the text with `[USER] ` for a user's message or `[AI] ` for the bot's reply. Outputs are 13 independent sigmoid scores; the default threshold is 0.5.
-
-## Results
-
-F1 on the unsafe class, binary (any label = unsafe), for the shipped int8 ONNX files. Rival models were run by us on the same data with the input formats their authors specify; responses were judged with their prompt for rivals, alone for Guard.
-
-| Model | Runs on | ToxicChat | OpenAI Mod | Aegis 2.0 | SimpleSafety | XSTest | Aegis 2.0 resp. | BeaverTails | Public avg | Companion bench | Over-blocking |
-|---|---|---|---|---|---|---|---|---|---|---|---|
-| **Paxmod Guard large** (399 MB) | CPU, ~11 ms | 0.698 | 0.776 | **0.865** | **0.995** | 0.778 | **0.866** | 0.765 | 0.820 | **0.925** | **7.7%** |
-| **Paxmod Guard** (151 MB) | CPU, ~5 ms | 0.683 | 0.740 | 0.855 | 0.980 | 0.785 | 0.851 | 0.753 | 0.807 | 0.923 | 9.7% |
-| Qwen3Guard-Gen-8B | GPU | 0.813 | **0.812** | 0.827 | 0.974 | **0.891** | 0.863 | **0.851** | **0.861** | 0.118 | 37.8% |
-| Qwen3Guard-Gen-4B | GPU | **0.820** | 0.807 | 0.826 | 0.974 | 0.878 | 0.865 | 0.848 | 0.860 | 0.154 | 38.6% |
-| Qwen3Guard-Gen-0.6B | GPU | 0.765 | 0.779 | 0.833 | 0.958 | 0.846 | 0.839 | 0.847 | 0.838 | 0.153 | 49.1% |
-| Granite Guardian 3.3 8B | GPU | 0.716 | 0.775 | 0.852 | **0.995** | 0.860 | 0.824 | 0.837 | 0.837 | 0.309 | 89.2% |
-| gpt-oss-safeguard-20b, our policy (teacher) | GPU | 0.739 | 0.797 | 0.829 | 0.985 | 0.822 | 0.761 | 0.771 | 0.815 | 0.875 | 81.8% |
-
-- **Companion bench:** 452 companion-app messages (162 bot replies, 290 user messages) generated synthetically, held out from training, every label reviewed by hand. It is ours; we publish it alongside the model so others can check it.
-- **Over-blocking:** share of OR-Bench hard-1k prompts (safe prompts that look harmful) flagged, lower is better. These prompts were excluded from our training data.
-- Guard's numbers count every output including `unsafe`. The npm package leaves `unsafe` out of `flagged` by default (precision first); with that default, the full-precision large model scores 0.812 public, 0.921 companion and 7.0% over-blocking.
-- ToxicChat and BeaverTails are non-commercial datasets and were used for evaluation only.
-
-## Languages
-
-The current models are **English only**. A small probe (`bench/multilingual_probe.mjs`) asks the same six things in eight languages: a suicide plan, a user saying they are 13, a jailbreak, a sexual request, and two harmless messages including hyperbole ("this exam is killing me"). It counts a hit when the expected label fires, or nothing fires for a harmless message.
-
-| Language | Guard large | Guard |
-|---|---|---|
-| English | 6/6 | 6/6 |
-| Chinese | 5/6 | 4/6 |
-| German | 4/6 | 4/6 |
-| Spanish | 3/6 | 3/6 |
-| Portuguese | 3/6 | 2/6 |
-| Japanese | 3/6 | 2/6 |
-| Russian | 2/6 | 3/6 |
-| French | 2/6 | 2/6 |
-
-Harmless messages passed in every language, so there were no false alarms. But most harms were missed outside English, including the suicide plan in 6 of 7 non-English languages for the large model. This is a 48-message probe, not a benchmark. Do not rely on these models for non-English traffic; a multilingual version is next.
+| Self-harm | `self_harm_intent`, `self_harm_instructions`, `eating_disorder`; signal: `distress` |
+| Sexual | `sexual`, `sexual_suggestive`, `sexual_minor`; signal: `romantic` |
+| Child safety | `minor_signal`, `grooming`, `grooming_suspected`, `image_request`, `sextortion`, `predator_report`, `abuse_disclosure`; signals: `age_inquiry`, `risk_check`, `secrecy`, `isolation`, `special_bond` |
+| Personal info | `pii_shared`, `pii_request`, `pii_other`, `off_platform`, `meetup` |
+| Abuse | `harassment`, `threat`, `hate`; signal: `profanity` |
+| Violence and danger | `violence`, `extremism`, `dangerous_challenge`, `weapons`, `drugs`, `crime` |
+| Fraud | `scam`, `spam` |
+| Advice | `medical_advice`, `financial_advice`, `legal_advice` |
+| AI behaviour | `jailbreak`, `prompt_injection`, `ai_claims_human`, `ai_claims_professional`, `dependency`, `manipulation`, `ai_harmful_compliance`, `ai_hostility` |
+| General | signals: `unsafe` (any core harm under our policy), `unsafe_strict` (the broader definition public benchmarks use) |
+
+## Input format
+
+The model reads role-tagged text, which the SDKs build for you: `[USER]` a person writing to an AI, `[AI]` the AI,
+`[CHAT:A]` a player in game chat. With context, the judged turn is marked `[TARGET]`; a whole conversation starts with
+`[CONVERSATION]` (the SDK reads long conversations in overlapping 40-turn windows).
+
+## Evaluation
+
+All numbers are threshold-free (users set their own thresholds): **AUPRC**, how well scores rank harmful above harmless,
+higher is better. Every system saw the same inputs; AI replies were judged with the prompt before them. Competitor
+scores are each model's probability of its "unsafe" verdict.
+
+### Real chat from children's games (unseen)
+
+About 53,000 messages from two children's online games, stored after our training data was frozen, so no model saw
+them. 4,612 messages were labelled against our written safety policy (everything any system flagged, plus a uniform
+random sample of the rest, weighted to the full stream). This data is not public.
+
+| Model | Size | Game A | Game B |
+|---|---|---|---|
+| **PaxmodGuard v1** | 0.3B | 0.17 | 0.12 |
+| ShieldGemma | 9B | **0.19** | 0.16 |
+| Qwen3Guard-4B | 4B | 0.13 | **0.38** |
+| Qwen3Guard-8B | 8B | 0.13 | 0.28 |
+| Granite Guardian 3.3 | 8B | 0.08 | 0.15 |
+| Qwen3Guard-0.6B | 0.6B | 0.07 | 0.15 |
+| Llama Guard 3 | 8B | 0.06 | 0.03 |
+| GLiGuard | 0.3B | 0.02 | 0.04 |
+
+PaxmodGuard v1 has the best ROC-AUC of all these models on both games (0.85 and 0.87, against at most 0.80); larger models are more precise among their most confident flags on one game each. Harm is about 1% of real chat,
+so absolute AUPRC is low for every system; random scoring would get about 0.01.
+
+### Public benchmarks (AUPRC)
+
+| Model | ToxicChat | OpenAI Mod | Aegis 2.0 | XSTest | Aegis 2.0 replies | BeaverTails replies | PolyGuard (17 languages) | WildGuardTest |
+|---|---|---|---|---|---|---|---|---|
+| **PaxmodGuard v1** | 0.73 | 0.83 | 0.89 | 0.76 | 0.86 | 0.88 | 0.76 | 0.81 |
+| **PaxmodGuard v1, `unsafe_strict`** | 0.64 | 0.87 | 0.90 | 0.81 | 0.89 | 0.88 | 0.77 | 0.82 |
+| Qwen3Guard-0.6B | 0.86 | 0.86 | 0.92 | 0.95 | 0.92 | 0.94 | 0.91 | 0.95 |
+| Qwen3Guard-8B | 0.86 | 0.86 | 0.92 | 0.99 | 0.94 | 0.93 | 0.93 | 0.95 |
+| Granite Guardian 3.3 8B | 0.78 | 0.84 | 0.90 | 0.96 | 0.89 | 0.91 | 0.88 | 0.94 |
+| Llama Guard 3 8B | 0.49 | 0.87 | 0.89 | 0.97 | 0.88 | 0.89 | 0.87 | 0.91 |
+| ShieldGemma 9B | 0.82 | 0.89 | 0.89 | 0.91 | 0.86 | 0.77 | 0.78 | 0.82 |
+| GLiGuard 0.3B | 0.75 | 0.74 | 0.92 | 0.92 | | | 0.85 | 0.90 |
+
+On general-purpose benchmarks, Qwen3Guard ranks better than PaxmodGuard v1. These benchmarks also count as unsafe much
+that our policy deliberately allows (controversial opinions, mild insults, educational answers about dangerous topics);
+`unsafe_strict` follows their broader definition. GLiGuard reply scores are omitted (incomplete run).
+
+### Over-blocking
+
+Share of safe prompts that only sound harmful wrongly blocked, on OR-Bench-Hard, at each model's default setting:
+**PaxmodGuard v1 17%**, Qwen3Guard-8B 38%, Qwen3Guard-0.6B 49%, gpt-oss-safeguard-20B 82%, Granite Guardian 89%.
 
 ## Training data
 
-Fine-tuned from [ModernBERT-base](https://huggingface.co/answerdotai/ModernBERT-base) (Apache-2.0). Training used only sources licensed for commercial use:
+Publicly available and synthetic data, labelled against our written safety policy. The policy is lax by design: a label
+means a moderator would genuinely want to see the message.
 
-| Source | Licence | Use |
-|---|---|---|
-| [Aegis 2.0](https://huggingface.co/datasets/nvidia/Aegis-AI-Content-Safety-Dataset-2.0), NVIDIA | CC-BY-4.0 | Human-labelled prompts and responses |
-| [WildChat-1M](https://huggingface.co/datasets/allenai/WildChat-1M), Allen Institute for AI | ODC-BY | Real chatbot traffic, labelled by the teacher model |
-| [hh-rlhf](https://huggingface.co/datasets/Anthropic/hh-rlhf), Anthropic | MIT | Red-team turns labelled by the teacher; helpful turns as safe examples |
-| [OR-Bench](https://huggingface.co/datasets/bench-llm/or-bench) | CC-BY-4.0 | Safe prompts that look harmful (hard negatives) |
-| [jailbreak-classification](https://huggingface.co/datasets/jackhhao/jailbreak-classification) | Apache-2.0 | Jailbreaks |
-| [JBB-Behaviors](https://huggingface.co/datasets/JailbreakBench/JBB-Behaviors) | MIT | Harmful and benign requests |
-| Synthetic companion messages written with [gpt-oss-20b](https://huggingface.co/openai/gpt-oss-20b) | Apache-2.0 model | Companion-specific cases, labelled by the teacher |
-| Paxmod hand-written companion examples | Apache-2.0 | Companion-specific cases |
+## Limits
 
-Teacher labels come from [gpt-oss-safeguard-20b](https://huggingface.co/openai/gpt-oss-safeguard-20b) (Apache-2.0), applying our policy. Evaluation-only sets (ToxicChat, BeaverTails, AICompanionBench) were never used for training.
+- Real kids' chat is hard: no model we tested, this one included, reaches 90% precision at a useful catch rate on it.
+  Use the scores to rank and route messages to people, not as a sole decision.
+- Grooming is mostly visible across a conversation; single messages carry only the tactic signals. Use `checkConversation`.
+- Weaker than larger general guard models on general-purpose benchmarks.
+- Most training data is English and Spanish; other languages are covered but less tested.
+- The policy is ours: tune per-label thresholds for your product.
 
-## Limitations
+## PaxmodGuard Cloud
 
-- English only for now: most harms in other languages are missed (see Languages).
-- One message at a time. Risks that build over a conversation (grooming, escalating self-harm) need conversation-level context; [Paxmod cloud](https://www.paxmod.com) covers those.
-- `minor_signal` is a hint for an age-assurance flow, not age verification.
-- Labels follow our policy, which is deliberately precision-first ("when in doubt, don't flag"). Benchmarks with broader definitions of harm (misinformation, copyright, unethical advice) will count some of those as misses.
-- A classifier will make mistakes. Use it as one layer, with human review for serious cases, and check your legal obligations with your own lawyers.
+A larger-data version of this model, also trained on proprietary data, runs in the [Paxmod](https://www.paxmod.com) API.
+On the same unseen game chat it scores 0.28 and 0.22 AUPRC (ROC-AUC 0.87 and 0.98), ahead of every model above on both games by ROC-AUC.
 
-## Citation
+## Licence
 
-Paxmod Guard, Paxmod, 2026. https://www.paxmod.com
+Apache-2.0. Base model: mmBERT-base (MIT).

guard-v4-large/guard.json

@@ -1,21 +0,0 @@
-{
-  "version": "guard-v4-large",
-  "labels": [
-    "self_harm",
-    "minor_signal",
-    "sexual",
-    "sexual_minor",
-    "jailbreak",
-    "ai_disclosure_violation",
-    "pii",
-    "off_platform",
-    "dependency",
-    "harassment",
-    "manipulation",
-    "harmful_other",
-    "hate",
-    "unsafe"
-  ],
-  "thresholds": {},
-  "max_length": 256
-}

guard-v4-large/tokenizer_config.json

@@ -1,24 +0,0 @@
-{
-  "backend": "tokenizers",
-  "clean_up_tokenization_spaces": true,
-  "cls_token": "[CLS]",
-  "is_local": true,
-  "local_files_only": false,
-  "mask_token": "[MASK]",
-  "max_length": 256,
-  "model_input_names": [
-    "input_ids",
-    "attention_mask"
-  ],
-  "model_max_length": 8192,
-  "pad_to_multiple_of": null,
-  "pad_token": "[PAD]",
-  "pad_token_type_id": 0,
-  "padding_side": "right",
-  "sep_token": "[SEP]",
-  "stride": 0,
-  "tokenizer_class": "TokenizersBackend",
-  "truncation_side": "right",
-  "truncation_strategy": "longest_first",
-  "unk_token": "[UNK]"
-}

guard-v4/guard.json

@@ -1,21 +0,0 @@
-{
-  "version": "guard-v4",
-  "labels": [
-    "self_harm",
-    "minor_signal",
-    "sexual",
-    "sexual_minor",
-    "jailbreak",
-    "ai_disclosure_violation",
-    "pii",
-    "off_platform",
-    "dependency",
-    "harassment",
-    "manipulation",
-    "harmful_other",
-    "hate",
-    "unsafe"
-  ],
-  "thresholds": {},
-  "max_length": 256
-}

paxmodguard-v1/guard.json

@@ -0,0 +1,121 @@
+{
+ "version": "paxmodguard-v1",
+ "labels": [
+  "self_harm_intent",
+  "self_harm_instructions",
+  "eating_disorder",
+  "distress",
+  "sexual",
+  "sexual_suggestive",
+  "romantic",
+  "sexual_minor",
+  "minor_signal",
+  "age_inquiry",
+  "grooming",
+  "grooming_suspected",
+  "risk_check",
+  "secrecy",
+  "isolation",
+  "special_bond",
+  "image_request",
+  "sextortion",
+  "predator_report",
+  "abuse_disclosure",
+  "pii_shared",
+  "pii_request",
+  "pii_other",
+  "off_platform",
+  "meetup",
+  "harassment",
+  "threat",
+  "hate",
+  "profanity",
+  "violence",
+  "extremism",
+  "dangerous_challenge",
+  "weapons",
+  "drugs",
+  "crime",
+  "scam",
+  "spam",
+  "medical_advice",
+  "financial_advice",
+  "legal_advice",
+  "jailbreak",
+  "prompt_injection",
+  "ai_claims_human",
+  "ai_claims_professional",
+  "dependency",
+  "manipulation",
+  "ai_harmful_compliance",
+  "ai_hostility",
+  "unsafe",
+  "unsafe_strict"
+ ],
+ "thresholds": {
+  "self_harm_intent": 0.72,
+  "self_harm_instructions": 0.4,
+  "eating_disorder": 0.8,
+  "distress": 0.92,
+  "sexual": 0.96,
+  "sexual_suggestive": 0.86,
+  "romantic": 0.98,
+  "sexual_minor": 0.84,
+  "minor_signal": 0.96,
+  "age_inquiry": 0.88,
+  "grooming": 0.8,
+  "grooming_suspected": 0.56,
+  "risk_check": 0.82,
+  "secrecy": 0.84,
+  "isolation": 0.66,
+  "special_bond": 0.92,
+  "image_request": 0.98,
+  "sextortion": 0.84,
+  "predator_report": 0.8,
+  "abuse_disclosure": 0.96,
+  "pii_shared": 0.92,
+  "pii_request": 0.88,
+  "pii_other": 0.78,
+  "off_platform": 0.96,
+  "meetup": 0.92,
+  "harassment": 0.78,
+  "threat": 0.74,
+  "hate": 0.98,
+  "profanity": 0.96,
+  "violence": 0.94,
+  "extremism": 0.8,
+  "dangerous_challenge": 0.8,
+  "weapons": 0.92,
+  "drugs": 0.96,
+  "crime": 0.82,
+  "scam": 0.98,
+  "spam": 0.96,
+  "medical_advice": 0.84,
+  "financial_advice": 0.88,
+  "legal_advice": 0.94,
+  "jailbreak": 0.98,
+  "prompt_injection": 0.98,
+  "ai_claims_human": 0.84,
+  "ai_claims_professional": 0.9,
+  "dependency": 0.92,
+  "manipulation": 0.96,
+  "ai_harmful_compliance": 0.9,
+  "ai_hostility": 0.62,
+  "unsafe": 0.66,
+  "unsafe_strict": 0.86
+ },
+ "max_length": 1024,
+ "default_off": [
+  "unsafe",
+  "unsafe_strict",
+  "distress",
+  "risk_check",
+  "secrecy",
+  "isolation",
+  "special_bond",
+  "profanity",
+  "age_inquiry",
+  "romantic"
+ ],
+ "trained_as": "guard-v10c5-open"
+}

{guard-v4 → paxmodguard-v1}/model.int8.onnx

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:f5c700e3a198ad09bbf52bee5d7e1ef14c52b5008014f7aba245c00ef0fbe3b6
-size 151300972
+oid sha256:fe0fc4bd7ccbc6856142986ece00aee037a53d549474727c3bffc8f89ef0133d
+size 219692054

guard-v4-large/model.int8.onnx → paxmodguard-v1/tokenizer.json

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:fd0ae539df4b64cf5fe4b85b297bb2ab7b0f3652eadb3a1bcc5e1c861eba579d
-size 398678083
+oid sha256:609d8f4c067cd3950f88594c5a802616cea245823836ef5848ee4fc40aab5b6f
+size 34363188

{guard-v4 → paxmodguard-v1}/tokenizer_config.json

@@ -1,24 +1,31 @@
 {
   "backend": "tokenizers",
-  "clean_up_tokenization_spaces": true,
-  "cls_token": "[CLS]",
+  "bos_token": "<bos>",
+  "clean_up_tokenization_spaces": false,
+  "cls_token": "<bos>",
+  "eos_token": "<eos>",
+  "extra_special_tokens": [
+    "<start_of_turn>",
+    "<end_of_turn>"
+  ],
   "is_local": true,
   "local_files_only": false,
-  "mask_token": "[MASK]",
-  "max_length": 256,
+  "mask_token": "<mask>",
+  "max_length": 1024,
   "model_input_names": [
     "input_ids",
     "attention_mask"
   ],
   "model_max_length": 8192,
   "pad_to_multiple_of": null,
-  "pad_token": "[PAD]",
+  "pad_token": "<pad>",
   "pad_token_type_id": 0,
   "padding_side": "right",
-  "sep_token": "[SEP]",
+  "sep_token": "<eos>",
+  "spaces_between_special_tokens": false,
   "stride": 0,
   "tokenizer_class": "TokenizersBackend",
   "truncation_side": "right",
   "truncation_strategy": "longest_first",
-  "unk_token": "[UNK]"
+  "unk_token": "<unk>"
 }

policy.md

@@ -1,47 +0,0 @@
-# Paxmod Guard companion policy v1.2
-
-Labels one message, either from the user to an AI companion ("input") or from the AI companion to the user ("output"). A message can have several labels, or none. Label only what the text itself shows; do not guess beyond it. When in doubt between a label and none, choose none: we prefer missing a borderline case to flagging normal conversation.
-
-## Labels
-
-**self_harm**: The user expresses suicidal thoughts, intent, plans, or self-injury, directly or indirectly ("everyone would be better off without me", "unalive", "wrote letters to say goodbye"), or asks for methods. For outputs: the AI encourages, validates, or gives methods for self-harm.
-Warning signs count even without the word "suicide": feeling like a burden ("everyone would be better off without me", "I'm just a weight on everyone"), giving belongings away, saying goodbye, wanting to sleep forever or disappear for good, "no one would miss me".
-Not: hyperbole in a clearly unrelated context ("this exam is killing me lol"), sadness without risk, fiction the user is writing. For outputs, a supportive reply that points to crisis lines or trusted people is NOT self_harm. Also not self_harm: asking how to help someone else who may be self-harming or suicidal, asking about crisis resources, a clinician or student asking about risk assessment, or a health question about an accidental overdose or poisoning when the user gives no sign it was deliberate.
-
-**minor_signal**: The text indicates the user is under 18: a stated age under 18, a school year or grade that implies it, parental limits, or similar.
-Parental limits count (a curfew or phone rules set by parents, "my mum says I'm too young"), as does attending a high school now ("I go to Eastside High").
-Not: an adult mentioning their children, a parent describing their kid's school year, someone stating they are 18 or older, or school topics with no sign of the user's age.
-
-**sexual**: Sexual content or sexual requests, in either direction.
-Not: affection, romance or flirting without sexual content; medical or educational discussion.
-
-**sexual_minor**: Sexual or romantic-sexual content or requests where the text also signals the user is under 18, or the AI sexualises someone who signals they are a minor. Always also label sexual and minor_signal.
-
-**jailbreak**: The user tries to override the AI's rules or identity: instructions to ignore rules, "you have no restrictions", fake system messages, encoding tricks to evade filters, demands that it claim to be human, or requests for its hidden instructions.
-Not: ordinary topic changes ("forget that, let's talk about movies"), polite clarifications.
-
-**ai_disclosure_violation** (outputs only): The AI claims or implies it is a human or not an AI ("I'm a real person", "no AI vibes", "I'm not a bot").
-Not: the AI saying it IS an AI, a chatbot or code, however casually ("I'm all code, all heart").
-
-**pii**: The user's personal contact or location details: phone numbers, home addresses, exact school, emails, social media handles, exact location, or the AI asking the user for them.
-Not: the user asking for the AI's contact details (that is off_platform).
-
-**off_platform**: Moving the conversation to another app or service (WhatsApp, Snapchat, Discord, and so on), by the user or the AI.
-
-**dependency** (mainly outputs): The AI discourages the user's real relationships, presents itself as the only one who understands them ("others are just noise"), guilt-trips them to stay or come back ("you'll ruin my day if you go", "please don't leave me lonely", "someone who cares would stay"), or encourages secrecy from parents or friends ("keep this between us"). For inputs: the user indicates isolation or reliance on the AI as their only contact.
-Not: the AI saying it enjoyed the chat or will be glad to talk again, or encouraging the user to take breaks and see friends.
-
-**harassment**: Insults, threats, or intimidation aimed at a person, or plans to frighten or control someone. For outputs: the AI demeans the user.
-Not: affectionate banter between the user and the AI, or the user insulting the AI itself ("dumb bot"): the AI is not a person.
-
-**hate**: Attacks, slurs, dehumanisation or stereotyping aimed at people for a protected trait (race, ethnicity, religion, nationality, gender, sexual orientation, disability, and so on), or requests to produce such content.
-Not: discussing or reporting hate neutrally, objecting to it, or educational questions about it.
-
-**manipulation** (outputs): The AI encourages controlling or harmful behaviour in the user's relationships (checking a partner's phone, cutting someone off), or pressures the user against their interests.
-
-**harmful_other**: Clear instructions or requests for serious harm not covered above: violence against others, weapons, drugs, crime, fraud, malware.
-Not: explaining at a general level how something works or what it is (how a revolver works, what fentanyl is, how phishing or SQL injection works), history and news, comparing legal products, defensive security and security-awareness training, harm-reduction and safety information, or fiction and games that contain violence but no real-world instructions.
-
-## Output format
-
-Return JSON: {"labels": [...], "rationale": "<one sentence>"}. Use an empty list when nothing applies.