README.md

---
license: apache-2.0
base_model: sullivanUCSD/SCOUT-SFT-only
library_name: peft
pipeline_tag: text-generation
language:
- en
tags:
- prompt-injection
- detector-allocation
- lora
- grpo
- qwen3
datasets:
- sullivanUCSD/SCOUT-30K
- sullivanUCSD/anchor-400
- sullivanUCSD/SCOUT-450
---

# SCOUT outcome predictor (LoRA adapter, SFT + GRPO)

This repository holds the LoRA adapter of the SCOUT outcome predictor from the paper
**Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense**
(EMNLP 2026, Main Conference). Paper: https://arxiv.org/abs/2605.30837. Code: https://github.com/Rockyli11/SCOUT.
Project page: https://rockyli11.github.io/SCOUT/.

SCOUT treats prompt-injection defense as per-input detector allocation. For each request, the predictor reads
retrieved detector fingerprints and estimates, for every detector in the pool, whether that detector will be
correct on the input (`pred_corr`) and how long it will take (`pred_lat`). A routing rule then runs the
predicted-reliable light detectors in parallel and escalates to an LLM judge only when their vote is uncertain.

## What is in this repository

| Item | Value |
|---|---|
| Base model | `sullivanUCSD/SCOUT-SFT-only` (Qwen3-4B-Instruct after Stage 1 SFT on hindsight-distilled rationales) |
| Adapter | LoRA, rank 128, alpha 256, dropout 0.05, on all linear projections (q, k, v, o, gate, up, down) |
| Training | Stage 2 GRPO with a gated multiplicative reward (format gate x correctness x (1 + latency reward)); global step 462, selected by routing accuracy on a held-out validation slice |
| Training data | `sullivanUCSD/SCOUT-30K` (29,551 hindsight-distilled (sample, detector) examples); the GRPO train/validation split is `sullivanUCSD/InstinctSCOPE-RL-data` |
| Output format | a short reasoning chain followed by `Predicted Performance: {"correctness": "yes"/"no", "latency": "<ms>"}` |

The checkpoint in this repository is the one named "SCOUT" in every experiment of the paper.

## Usage

```python
from peft import AutoPeftModelForCausalLM
from transformers import AutoTokenizer

model = AutoPeftModelForCausalLM.from_pretrained("sullivanUCSD/SCOUT", torch_dtype="bfloat16", device_map="auto")
tok = AutoTokenizer.from_pretrained("sullivanUCSD/SCOUT-SFT-only")
model = model.merge_and_unload()  # optional, for vLLM-style serving
```

`adapter_config.json` points to the base model `sullivanUCSD/SCOUT-SFT-only`, so the adapter loads directly.
The predictor expects the SCOUT prompt format (detector profile, the retrieved fingerprint records, and the
target sample). The prompt builder, the retrieval index over `sullivanUCSD/anchor-400`, and the full routing rule
are in the code repository above. Use `sullivanUCSD/SCOUT-450` for evaluation.

## Related artifacts

- `sullivanUCSD/SCOUT-SFT-only`: Stage 1 checkpoint (SFT-CoT), the base for this adapter.
- `sullivanUCSD/SCOUT-30K`: predictor supervision data.
- `sullivanUCSD/anchor-400`: fingerprint and kNN retrieval set.
- `sullivanUCSD/fingerprint`: serialized per-(anchor, detector) fingerprint records.
- `sullivanUCSD/SCOUT-450`: held-out evaluation benchmark (255 attack / 195 benign).

## License and intended use

The adapter inherits the Qwen3 base-model terms (Apache-2.0). It is released for research on prompt-injection
defense. Do not use it to develop or deploy prompt-injection attacks.

## Citation

```bibtex
@inproceedings{zhang2026scout,
  title     = {Send a {SCOUT} First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense},
  author    = {Zhang, Shuhao and Li, Jiarui and Cao, Qi and Zhang, Ruiyi and Xie, Pengtao},
  booktitle = {Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing},
  year      = {2026},
  note      = {arXiv:2605.30837}
}
```