Add training data and attribution section and ATTRIBUTION.md

README.md

@@ -284,3 +284,47 @@ If you use Galvanize 2, please cite the base model:
 ## Contact
 
 Found an input the model gets wrong, in either direction, or a security issue? Write to security@usezn.com.
+
+## Training data and attribution
+
+Galvanize 2 is fine-tuned from [Horizon-Labs/prompt-injection-guard-small](https://huggingface.co/Horizon-Labs/prompt-injection-guard-small), released by Horizon Labs under the Apache License 2.0. Thank you to Horizon Labs for publishing the base model.
+
+The fine-tuning set has about 21,200 labelled rows. Each row keeps the licence of its source. Counts are approximate, except the licence totals.
+
+| Source | Licence | Approximate rows | Notes |
+|---|---|---|---|
+| Wikipedia text ([wikimedia/wikipedia](https://huggingface.co/datasets/wikimedia/wikipedia), dump 2023-11-01, German, English, Spanish, French, Italian, Portuguese, Russian) | CC BY-SA 3.0 and GFDL | about 2,000 benign passages, from 2,008 different articles | Share-alike applies. See the attribution section below. |
+| Wikipedia text used as carrier for injected instructions (InjecAgent and BIPIA attack strings) | CC BY-SA 3.0 and GFDL (text); MIT (instruction strings) | about 1,400 rows | These rows combine a Wikipedia passage with an instruction. |
+| WildChat-1M ([allenai/WildChat-1M](https://huggingface.co/datasets/allenai/WildChat-1M)) | ODC-BY 1.0 | about 3,700 | Benign user prompts and assistant replies. The assistant replies were written by OpenAI models. |
+| Nemotron-RL Agentic Indirect Prompt Injection v1 (NVIDIA) | CC BY 4.0 | about 350 | Attribution required. |
+| Nemotron-RL Jailbreak Robustness v1 (NVIDIA) | CC BY 4.0 | about 450 | Attribution required. The dataset card also lists Apache 2.0 and MIT for some underlying prompts. |
+| Agentic prompt injection 5k ([3nesdeniz](https://huggingface.co/datasets/3nesdeniz/agentic-prompt-injection-5k)) | CC BY 4.0 | about 450 | Attribution required. |
+| OR-Bench 80k ([bench-llm/or-bench](https://huggingface.co/datasets/bench-llm/or-bench)) | CC BY 4.0 | about 500 | Benign prompts. Attribution required. |
+| Apache 2.0 sources: aya_dataset, oasst2, deepset/prompt-injections, neuralchemy, jackhhao, rgeada/tool-response-injections, PromptShield, yanismiraoui | Apache 2.0 | about 6,600 in total | Benign and injection examples. |
+| MIT sources: InjecAgent, BIPIA attack strings, TrustAIRLab in-the-wild jailbreaks, Lakera gandalf and mosscap, S-Labs, wambosec, SPML, CTF (SaTML 2024) | MIT | about 4,100 in total | Licences checked on Hugging Face and GitHub, 14 October 2026. |
+| prompts.chat ([fka/prompts.chat](https://huggingface.co/datasets/fka/prompts.chat)) | CC0 1.0 | about 350 | Public domain dedication. |
+| Synthetic examples generated with a third-party language model and filtered by us | Terms of that provider | about 2,700 | Generated and filtered by us. |
+
+Licence totals across the 21,211 training rows:
+
+- Rows with CC BY-SA text (Wikipedia passages, alone or as the carrier for an injected instruction): about 3,400, or 16 % of the training set.
+- ODC-BY: about 3,660.
+- Apache 2.0: about 6,640.
+- MIT: about 4,110.
+- CC BY 4.0: about 1,750.
+- CC0: about 350.
+- Synthetic: about 2,700.
+
+Evaluation sets are kept apart from training. They are not used to update the weights and are not released.
+
+### Attribution for Wikipedia text
+
+About 3,400 training rows contain text from Wikipedia articles, licensed under CC BY-SA 3.0 and the GNU Free Documentation License. We follow the Wikimedia Terms of Use: each article is credited by a link to the article, which has a history page listing its authors. The full list of article titles, languages and links is in [ATTRIBUTION.md](ATTRIBUTION.md). The list covers the 2,008 articles that provide the benign passages. Each of the other rows uses one of those same passages as its carrier text, so the list covers them too.
+
+### Licence of this model
+
+The model weights, the ONNX export and the code in this repository are released under the Apache License 2.0. The NOTICE file credits Horizon Labs and records our changes.
+
+The training datasets are not released with the model. Each dataset keeps its own licence. This release does not change those licences. Anyone who redistributes a dataset must follow its licence, and anyone who redistributes Wikipedia text must follow CC BY-SA 3.0 and the attribution terms above.
+
+This section describes our sources. It is not legal advice.