Add model card (EMNLP 2026 SCOUT predictor adapter)

README.md

@@ -0,0 +1,86 @@
+---
+license: apache-2.0
+base_model: sullivanUCSD/SCOUT-SFT-only
+library_name: peft
+pipeline_tag: text-generation
+language:
+- en
+tags:
+- prompt-injection
+- detector-allocation
+- lora
+- grpo
+- qwen3
+datasets:
+- sullivanUCSD/SCOUT-30K
+- sullivanUCSD/anchor-400
+- sullivanUCSD/SCOUT-450
+---
+
+# SCOUT outcome predictor (LoRA adapter, SFT + GRPO)
+
+This repository holds the LoRA adapter of the SCOUT outcome predictor from the paper
+**Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense**
+(EMNLP 2026, Main Conference). Paper: https://arxiv.org/abs/2605.30837. Code: https://github.com/Rockyli11/SCOUT.
+Project page: https://rockyli11.github.io/SCOUT/.
+
+SCOUT treats prompt-injection defense as per-input detector allocation. For each request, the predictor reads
+retrieved detector fingerprints and estimates, for every detector in the pool, whether that detector will be
+correct on the input (`pred_corr`) and how long it will take (`pred_lat`). A routing rule then runs the
+predicted-reliable light detectors in parallel and escalates to an LLM judge only when their vote is uncertain.
+
+## What is in this repository
+
+| Item | Value |
+|---|---|
+| Base model | `sullivanUCSD/SCOUT-SFT-only` (Qwen3-4B-Instruct after Stage 1 SFT on hindsight-distilled rationales) |
+| Adapter | LoRA, rank 128, alpha 256, dropout 0.05, on all linear projections (q, k, v, o, gate, up, down) |
+| Training | Stage 2 GRPO with a gated multiplicative reward (format gate x correctness x (1 + latency reward)); global step 462, selected by routing accuracy on a held-out validation slice |
+| Training data | `sullivanUCSD/SCOUT-30K` (29,551 hindsight-distilled (sample, detector) examples); the GRPO train/validation split is `sullivanUCSD/InstinctSCOPE-RL-data` |
+| Output format | a short reasoning chain followed by `Predicted Performance: {"correctness": "yes"/"no", "latency": "<ms>"}` |
+
+The checkpoint in this repository is the one named "SCOUT" in every experiment of the paper.
+
+## Usage
+
+The adapter was saved with a local base path, so pass the base model explicitly:
+
+```python
+from transformers import AutoModelForCausalLM, AutoTokenizer
+from peft import PeftModel
+
+base = "sullivanUCSD/SCOUT-SFT-only"
+tok = AutoTokenizer.from_pretrained(base)
+model = AutoModelForCausalLM.from_pretrained(base, torch_dtype="bfloat16", device_map="auto")
+model = PeftModel.from_pretrained(model, "sullivanUCSD/SCOUT")
+model = model.merge_and_unload()  # optional, for vLLM-style serving
+```
+
+The predictor expects the SCOUT prompt format (detector profile, the retrieved fingerprint records, and the
+target sample). The prompt builder, the retrieval index over `sullivanUCSD/anchor-400`, and the full routing rule
+are in the code repository above. Use `sullivanUCSD/SCOUT-450` for evaluation.
+
+## Related artifacts
+
+- `sullivanUCSD/SCOUT-SFT-only`: Stage 1 checkpoint (SFT-CoT), the base for this adapter.
+- `sullivanUCSD/SCOUT-30K`: predictor supervision data.
+- `sullivanUCSD/anchor-400`: fingerprint and kNN retrieval set.
+- `sullivanUCSD/fingerprint`: serialized per-(anchor, detector) fingerprint records.
+- `sullivanUCSD/SCOUT-450`: held-out evaluation benchmark (255 attack / 195 benign).
+
+## License and intended use
+
+The adapter inherits the Qwen3 base-model terms (Apache-2.0). It is released for research on prompt-injection
+defense. Do not use it to develop or deploy prompt-injection attacks.
+
+## Citation
+
+```bibtex
+@inproceedings{zhang2026scout,
+  title     = {Send a {SCOUT} First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense},
+  author    = {Zhang, Shuhao and Li, Jiarui and Cao, Qi and Zhang, Ruiyi and Xie, Pengtao},
+  booktitle = {Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing},
+  year      = {2026},
+  note      = {arXiv:2605.30837}
+}
+```