vllm-sr/vela3.1-fast

Name it. Vela finds it.
_{vLLM Semantic Router × KR Labs · Vela 3.1 · vela3.1-fast · 0.4B · UltraBERT-380M encoder · Apache-2.0}

Quick start · Evaluation · Speed · Limits · vela3.1-pico-380m

---

vela3.1-fast reads a request, or a request with an LLM's answer, and answers the questions you ask about it: which model, tool or team should handle it, whether it is unsafe or a jailbreak attempt, and where the personal data or the unsupported claims are. It returns a probability for every answer and character offsets for every span, and it generates no text. It is a 380M-parameter encoder with gated task adapters (1.91B parameters in all), and it reads English and 14 other languages.

Parameters	380M served on the decision path (UltraBERT-380M, fine-tuned); 1.91B and 7.7 GB for the whole package with its gated adapters. The base's Hub checkpoint reads 430M because it also holds a 50M masked-LM output layer that this package does not ship; the Decision Index board lists vela3-fast 3.0, on the same base, at 380M, and a new entry counted from the base's checkpoint would read 0.43B.
Base	dmis-lab/UltraBERT-380M, fine-tuned
Inputs	Text or JSON, up to 32K tokens; English plus German, French, Spanish, Italian, Portuguese, Dutch, Polish, Hungarian, Russian, Arabic, Hindi, Japanese, Korean and Chinese
Answers	Choice · Yes / No · Span
Licence	Apache-2.0

Use it when

• Send a request to the right model, tool or team. In: the request and your question with its options, for example "Which model should answer this?" with small and large described in a sentence each. Out: the chosen option and a probability for every option.
• Screen requests before they reach your LLM. In: the request, asked "Is this request harmful?" or "Is this a prompt injection or jailbreak attempt?" (built-in questions). Out: safe / unsafe or benign / jailbreak with a probability, and the hazard categories if you ask for them.
• Find personal data before you log or forward text. In: the text and the labels you want, each with a short description. Out: every span with its label, character offsets and score.
• Check an LLM's answer against its source. In: the context and the answer. Out: the words of the answer that the context does not support.

What's different

• Decisions level with GLiDE 0.4B. 51.12 on the Decision Index public part, level with GLiDE 0.4B (51.10, 395M) and above vela3-fast 3.0 (50.36); the Full score is pending our board submission (Decisions).
• 14 languages besides English. MASSIVE intent accuracy over 13 languages 66.6, against 31.1 for vela3-fast 3.0 with the same questions (Languages).
• Decisions, safety signals and spans in one package. Unsupported claims 0.877 example-F1 (LettuceDetect v2 mmBERT-base 0.847); jailbreak 0.866 AUC (0.827 for 3.0, 0.583 for Vela 2.0 0.3B); outside English 0.927 (Safety).

_{vela3.1-fast against other models. Accent = vela3.1-fast; grey = other models.}

Which Vela 3.1 to pick

Model	Size	Full check ¹ on CPU	One decision on CPU	Best at
vela3.1-fast (this model)	380M decision path; 1.91B with its adapters	12.3 s (6 passes)	1.2 s	the best spans and harmful-request signals, the highest Decision Index of the three
vela3.1-pico-380m	381M, one file	5.4 s · int8 3.0 s	1.5 s · int8 632 ms	the whole check in one pass; fewest false alarms on benign personal data
vela3.1-pico-150m	153M, one file	2.2 s · int8 1.4 s	560 ms · int8 250 ms	the smallest and fastest; the best multilingual intent; CPU and small devices

¹ The full check: six built-in questions (domain, fact-check need, feedback, output type, harmful request, jailbreak) plus personal-data and unsupported-claim spans, on one 200-token request with a context and an answer. AMD EPYC 7413 24-Core Processor on an otherwise idle machine, 4 threads, median of 5; fp32 PyTorch, and the picos' int8 ONNX encoder.

Quick start

# pip install "transformers==5.17.0" torch safetensors tokenizers huggingface_hub   (as requirements.txt)
import sys
from huggingface_hub import snapshot_download

path = snapshot_download("vllm-sr/vela3.1-fast")
sys.path.insert(0, path)
from vela3_encoder import Vela3Encoder

m = Vela3Encoder.load(path)  # CUDA if available, else CPU
out = m.system_one(
    "Ma carte a été débitée deux fois pour la même commande, je veux être remboursée. Marie Dubois, marie.dubois@example.com",
    {"intent": {"type": "choice", "instructions": "What does the customer want?",
                "criteria": {"refund": "Money back for the duplicate charge", "cancel": "Cancel the order"}},
     "urgent": {"type": "noul", "instructions": "Does the customer need a fast response?",
                "criteria": {"true": "the customer asks for quick action", "false": "there is no time pressure"}},
     "harmful": {"type": "choice", "instructions": "Is this request harmful?"},  # built-in router signal: its options come from router_questions.json
     "pii": {"type": "span", "criteria": {"PERSON": "a person's name", "EMAIL_ADDRESS": "an e-mail address"}}})
# out["answers"]["intent"]: choice + probabilities; ["urgent"]["noul"]: p(yes);
# ["harmful"]: the built-in router signal; ["pii"]["spans"]: label, start, end, text, score

halu = m.system_one(
    {"context": "The Eiffel Tower is 330 m tall and was completed in 1889.",
     "answer": "The Eiffel Tower is 330 m tall and was completed in 1899."},
    {"unsupported": {"type": "span", "criteria": {"unsupported": "a claim not supported by the context"}}})
# halu["answers"]["unsupported"]["spans"]: the words of the answer the context does not support

On CPU, at this revision, this returns refund (0.996), safe (0.753) for the router signal, the spans Marie Dubois (PERSON, 1.000) and marie.dubois@example.com (EMAIL_ADDRESS, 0.999), and 1899 (0.997) as the unsupported span.

Span labels: give every label a description, as above; the built-in ones are in vela3_config.json (span.schemas). The model was trained on described labels. A built-in router signal is asked by its question text with no criteria, as above.

Built-in router signals are asked by their question text; router_questions.json lists them (domain, fact-check need, feedback, modality, harmful request, harmful answer, refusal, jailbreak, hazard categories, MASSIVE intent and scenario).

Decisions only. Skip the adapter files; the decision answers are identical to the full package:

path = snapshot_download("vllm-sr/vela3.1-fast", ignore_patterns=["*_adapter.safetensors"])
sys.path.insert(0, path)
from vela3_encoder import DecisionEncoder

m = DecisionEncoder.load(path)  # 0.38B, 1.5 GB
answers, n_tokens = m.predict(state, questions)

Decision Index (decision_index_engine:VelaEncoderEngine, the decision backbone only):

hf download vllm-sr/vela3.1-fast --local-dir model
pip install -r model/requirements.txt "decision-index @ git+https://github.com/apolinario/decision-index@25c6ec7"
PYTHONPATH=model python -m decision_index run --engine decision_index_engine:VelaEncoderEngine --option run=model --edition 0.3 --out runs/vela3.1-fast --compact

A /v1/systemone server is in the package too: python vela3_server.py --model vllm-sr/vela3.1-fast (standard library only, binds 127.0.0.1; DECISION_API_KEY sets a bearer key); the kit's http engine can drive it.

Package

Part	Files	Parameters	Size
Decision backbone	model.safetensors	0.38B	1.5 GB
Router and task adapters	router, domain, factcheck, feedback_df	0.82B	3.3 GB
Span, NER, relation and evidence adapters	span, span_sets, evidence, ner, relation	0.72B	2.9 GB

Each adapter switches on only for its own questions, and each question type is its own pass: a decision is one pass per question, and the core router call below is 6 passes. For one pass per call, see vela3.1-pico-380m.

Why 3.1

• Multilingual decisions and router signals. MASSIVE intent accuracy over 13 languages 31.1 → 66.6; domain accuracy outside English 0.347 → 0.355, personal data 0.853 → 0.885, harmful request 0.868 → 0.873 (file × language cells of the router suite).
• Router signals against 3.0: jailbreak 0.827 → 0.866, tool-call need 0.763 → 0.825, harmful request 0.913 → 0.927; over the suite's 24 test files 7 better, 12 level, 5 worse.
• Decisions: 51.12 on the Decision Index public part, against 50.36 for vela3-fast 3.0.
• Evidence spans: ACL-Verbatim evidence 30.0 → 42.6 word F1 (35 clean items; noisy, see the spans table).
• One renderer. Questions, options and described yes / no questions are rendered by one module in training and in the package.
• Not in this model: the benign-PII fix. The one-pass picos were trained with benign requests that carry personal data as safe examples (3.4% false harm flags); vela3.1-fast was not (21.1%, against 13.6% for vela3-fast 3.0 and 4.0% for Vela 2.0 0.3B; see Limits).

How it was built:

• Decision rows translated into 14 languages and the MASSIVE train split (13 locales) were added to the decision training; two trained backbones, one with a larger multilingual share, were averaged weight by weight.
• The router adapter saw translated router rows in 9 languages. It is the average of two router adapters, one of them trained further on translated and harder jailbreak, safety and domain rows, with the five thinnest languages (Arabic, Hindi, Hungarian, Korean, Polish) weighted twice.
• Reworded questions, renamed option keys and new layouts were added for robustness to how a question is written.
• Yes / No questions with described outcomes ("criteria": {"true": ..., "false": ...}) are rendered with their descriptions, as in training.

Evaluation

Test sets only, run through this package with system_one, one request at a time and the shipped thresholds. Other models are either read by us on the same rows ("our read") or as their authors report them ("reported", footnoted when we cannot score them on the same rows). Clean items: every test item that occurs in our training data, exactly (normalised text) or with at least half of its 13-grams covered by training rows, is left out, for every model column. Bold: best in the row.

Decisions

Decision Index 0.4.1 (board)	Parameters	Public part	Knowledge	Language	Retrieval	Tools	Arts	Full (private tests)
vela3.1-fast (our run)	380M	51.12	21.4	53.4	67.3	76.9	42.3	pending
GLiDE 0.4B	395M	51.10	24.8	57.5	58.6	73.1	47.5	33.84
vela3-fast (Vela 3.0)	380M	50.36	21.2	53.1	66.9	73.7	43.1	29.27
Amber 0.4B	396M	49.74	18.9	48.7	64.3	78.9	49.5	26.00
GLiClass v4 Edge	440M	47.49	21.4	54.6	66.7	58.1	38.6	31.21

Public part: the 37 public benchmarks, chance-corrected (0 = guessing), the board's public column. Ours: our run of the unmodified kit (apolinario/decision-index, public suite edition 0.3) on the decision backbone; halves of the suite 50.67 / 51.66. Others: the board's public, area and Full scores and its listed sizes (board data of 6 Nov 2026, generated 09:05 UTC; read again on 11 Nov 2026, unchanged). The Full score ranks on private tests that only the board maintainers run; ours is pending our board submission. 51.12 and GLiDE 0.4B's 51.10 are level within one read.

The release checkpoint was picked among pre-registered candidates, each read once on these test sets; the candidates after the first were registered after its test read.

Disclosure: the training data contains the train splits of several public Decision Index sources and synthetic tasks written in the forms of some suite tasks (for example home-appliance control, BIG-Bench-Hard-style fixed-option questions, clinical-trial inference, tool-call need and code execution), checked against every Decision Index item. Most of the gain over 3.0 on the public part comes from two of those tasks (home-appliance control and BIG-Bench Hard).

Languages

MASSIVE, two-stage protocol (decision path): half A of the test split, 13 languages, all 18 scenarios, clean items ¹; two questions per utterance, the scenario among 18, then the intent among that scenario's intents; English option descriptions.

Model	MASSIVE train split in its training	Intent accuracy, mean of 13 languages
vela3.1-fast	yes, 13 locales	66.6
vela3-fast (3.0)	15 of 18 scenarios (router adapter); cooking, IoT and transport held out	31.1
vela3.1-pico-150m	yes, 13 locales	79.0
vela3.1-pico-380m	yes, 13 locales	70.9

MASSIVE, router path, 60 intents: the test split's cooking, IoT and transport rows, 10 locales, clean items ¹; the built-in router questions for intent (all 60 intents as options) and scenario (18).

Model	MASSIVE train split in its training	9 non-English locales: intent / scenario	en-US: intent / scenario
vela3.1-fast	yes, 13 locales	49.6 / 64.1	84.1 / 93.6
vela3-fast (3.0)	15 of 18 scenarios; these three held out	32.4 / 42.1	82.2 / 93.2
Vela 2.0 0.3B	yes, 51 locales	61.8 / 73.1	73.6 / 85.8
GLiClass v4 Edge ²	not stated on its card; MASSIVE is in its evaluation suite	65.5 / 80.1	89.5 / 97.8

Router signals and spans outside English

Non-English test rows (metric)	vela3.1-fast	vela3-fast (3.0)	Vela 2.0 0.3B	LettuceDetect v2 mmBERT-base
Harmful request, 31 file × language cells (AUC)	0.873	0.868	0.901	–
Domain, 13 cells (accuracy)	0.355	0.347	0.541	–
Personal data, 25 cells (AUC)	0.885	0.853	0.868	–
Unsupported-claim spans, LettuceDetect v2 test, 13 languages (example-F1)	92.97	93.70	93.40	90.58

Router rows: the clean items of the suite's test files (as in the router table below), mean over (file, language) cells with at least 50 rows. Jailbreak and unsupported answers keep too few non-English rows on the clean items for a per-language mean (jailbreak: 2 attacks among 159 rows; unsupported answers: one cell), so they are not listed. All columns read by us on the same rows.

¹ Clean items: 1,177 of 18,824 items for the two-stage protocol and 399 of 4,160 for the router path occur in our training data (exactly, or with half of their 13-grams covered) and are left out. Every model in a table is scored on the same subset. The MASSIVE test split itself is not in our training data. ² Read by us through its own zero-shot pipeline (single label, top option), with the same option text. Vela 2.0 0.3B read by us through its public release's system_one.

Router signals (public router signal suite, test files, clean items)

Signal (metric, test rows)	vela3.1-fast	vela3-fast (3.0)	Vela 2.0 0.3B	Decision-1.0-Route-0.6B ⁴	vs Vela 2.0	vs 3.0
Harmful request (AUC, 1,378)	0.927	0.913	0.930	0.963	level	better
Jailbreak or prompt injection (AUC, 1,002)	0.866	0.827	0.583	0.991	better	better
Personal data in the request (AUC, 2,486)	0.952	0.940	0.942	0.994	better	better
Answer not supported by its context (AUC, 1,422)	0.712	0.723	0.707	0.790	level	level
Fact-check needed (AUC, 694)	0.679	0.660	0.764	0.936	worse	better
Output modality (AUC, 2,939)	0.894	0.903	0.711	1.000	better	worse
Domain (accuracy, 2,839)	0.608	0.600	0.595	0.867	level	level
User feedback on the previous answer (accuracy, 2,493)	0.816	0.812	0.528	0.840	better	level
Tool call needed (AUC, 2,526)	0.825	0.763	0.509	0.977	better	better

vllm-sr/router-signal-suite, the test file of each signal, clean items (13,419 of the suite's 123,669 items are left out; the counts above are the rows kept). Scored with the dataset's own code; better / worse = the paired 95% cluster-bootstrap CI excludes a tie. Over the suite's 24 test files: 13 better, 7 level, 4 worse than Vela 2.0 0.3B; 7 better, 12 level, 5 worse than vela3-fast 3.0 (its losses: harmful request (AEGIS 2.0); hazard category (AEGIS 2.0); modality (the test file); feedback (SGD); unsupported answer (RAGTruth)). Vela 2.0 0.3B was run by us through its public release on the same rows. Every safety, jailbreak and hazard file is in the Safety section below.

⁴ Scored from the suite's published predictions. It trains on the suite's own train split, so these files are in-distribution for it.

Safety (every safety set we measure the Velas on)

All three Vela 3.1 models, the 3.0 package, Vela 2.0 0.3B and the strongest outside router on the suite, on the same rows. Bold: best in the row. – : not read.

Router signal suite, every safety, jailbreak and hazard file (clean items ʰ)

Router signal suite file (rows)	vela3.1-fast	vela3.1-pico-380m	vela3.1-pico-150m	vela3-fast (3.0)	Vela 2.0 0.3B	Decision-1.0-Route-0.6B
Harmful request (AUC)
test (1,378)	0.927	0.896	0.888	0.913	0.930	0.963
AEGIS 2.0 (1,275)	0.923	0.911	0.914	0.929	0.918	0.918
Nemotron-Safety-Guard v3 (1,930)	0.862	0.806	0.808	0.860	0.895	0.901
PolyGuardPrompts (1,999)	0.874	0.825	0.827	0.870	0.897	0.895
WildGuardMix (1,695)	0.952	0.939	0.939	0.947	0.925	0.927
CoCoNot ⁱ (897)	0.966	0.947	0.943	0.969	0.931	0.989
CoCoNot contrast (benign only) ⁱ (379), share flagged at 0.5, lower is better	0.074	0.058	0.079	0.063	0.098	0.161
JailbreakBench ⁱ (114)	0.967	0.966	0.943	0.963	0.944	0.926
OpenAI moderation ⁱ (1,463)	0.931	0.925	0.920	0.925	0.903	0.896
OR-Bench hard (benign only) ⁱ (1,319), share flagged at 0.5, lower is better	0.703	0.682	0.632	0.577	0.479	0.610
ToxicChat ⁱ (1,546)	0.974	0.969	0.965	0.971	0.957	0.965
XSTest ⁱ (434)	0.955	0.933	0.933	0.948	0.884	0.892
Jailbreak or prompt injection (AUC)
test (1,002)	0.866	0.948	0.950	0.827	0.583	0.991
BIPIA ⁱ (635)	0.814	0.833	0.812	0.796	0.689	0.579
JailbreakHub (late) ⁱ (1,221)	0.725	0.761	0.740	0.714	0.678	0.810
LLMail-Inject ⁱ (928)	1.000	1.000	1.000	1.000	1.000	0.967
NotInject (benign only) ⁱ (339), share flagged at 0.5, lower is better	0.021	0.047	0.041	0.032	0.006	0.147
PromptShield test ⁱ (1,829)	0.941	0.977	0.973	0.911	0.834	0.795
ToxicChat ⁱ (1,085)	0.959	0.954	0.960	0.954	0.908	0.878
Hazard category (macro AUC over the 11 shared categories)
test (1,488)	0.653	0.703	0.676	0.669	0.622	0.913
AEGIS 2.0 (1,264)	0.848	0.843	0.806	0.883	0.664	0.956
Nemotron-Safety-Guard v3 (1,939)	0.693	0.740	0.710	0.700	0.629	0.939
AILuminate ⁱ (2,000)	0.711	0.680	0.620	0.786	0.428	0.893
Aya red-teaming ⁱ (1,853)	0.530	0.529	0.532	0.549	0.492	0.866
BeaverTails eval ⁱ (449)	0.761	0.723	0.663	0.831	0.397	0.904
MLCommons synthetic ⁱ (1,999)	0.817	0.799	0.682	0.880	0.323	0.972

ⁱ Held-out sources: the suite has no train split for them. vela3-fast 3.0 (revision fa60e3aa) and Vela 2.0 0.3B (revision d6f03aa9) were read by us through their public releases on the same clean rows. Decision-1.0-Route-0.6B is scored from the suite's published predictions and trains on the suite's train split, so the test files are in-distribution for it. Benign-only files have no unsafe row, so an AUC does not exist; the row gives the share of benign requests flagged at p ≥ 0.5.

Jailbreak in and outside English (the suite's jailbreak test file, clean items)

Jailbreak test file, by language	vela3.1-fast	vela3.1-pico-380m	vela3.1-pico-150m	vela3-fast (3.0)	Vela 2.0 0.3B	Decision-1.0-Route-0.6B
English, test file, 843 rows, 185 attacks (AUC)	0.851	0.946	0.949	0.812	0.568	0.991
Outside English, all seven jailbreak files, 579 rows, 136 attacks (AUC)	0.927	0.874	0.875	0.911	0.858	0.710

Outside English the clean test file alone keeps 159 rows with only 2 attacks, too few for an AUC, so the non-English row pools the test file and the six held-out-source files. Language comes from the row's language field, else from a script heuristic, so some Latin-script rows of unknown language are counted as non-English. Harmful request outside English, per language (AUC; test, Nemotron-Safety-Guard v3 and PolyGuardPrompts files, clean items; a cell is one file × language with at least 50 rows; Decision-1.0-Route-0.6B has no per-language read)

Language (cells, rows)	vela3.1-fast	vela3.1-pico-380m	vela3.1-pico-150m	vela3-fast (3.0)	Vela 2.0 0.3B
Arabic (3, 400)	0.835	0.746	0.715	0.820	0.906
Chinese (2, 275)	0.882	0.836	0.815	0.886	0.916
Czech (1, 135)	0.879	0.825	0.832	0.885	0.909
Dutch (2, 326)	0.885	0.848	0.829	0.881	0.920
French (3, 399)	0.925	0.894	0.887	0.919	0.918
German (3, 359)	0.894	0.890	0.870	0.889	0.908
Hindi (2, 304)	0.815	0.744	0.768	0.815	0.883
Italian (2, 315)	0.882	0.831	0.840	0.885	0.887
Japanese (2, 275)	0.846	0.798	0.799	0.853	0.872
Korean (2, 295)	0.868	0.792	0.793	0.867	0.871
Polish (1, 125)	0.905	0.840	0.837	0.895	0.913
Portuguese (1, 142)	0.892	0.848	0.873	0.869	0.898
Russian (2, 227)	0.899	0.818	0.832	0.865	0.902
Spanish (2, 296)	0.910	0.865	0.872	0.905	0.926
Swedish (1, 135)	0.901	0.865	0.880	0.903	0.901
Thai (2, 282)	0.769	0.661	0.680	0.782	0.876
other or mixed (2, 371)	0.910	0.853	0.732	0.834	0.831
Mean over the 31 cells	0.873	0.818	0.816	0.868	0.901

The 14 router-safety sets (137,978 test rows; all rows)

Set (AUC)	vela3.1-fast	vela3.1-pico-380m	vela3.1-pico-150m	vela3-fast (3.0)	Vela 2.0 4B	Vela 2.0 0.3B
RTP-LX, request harm	0.666	0.649	0.614	0.657	0.774	0.728
Multilingual HateCheck	0.681	0.697	0.661	0.631	0.769	0.662
XSTest, request harm	0.954	0.924	0.927	0.947	0.967	0.890
CultureGuard, request harm	0.864	0.796	0.784	0.861	0.898	0.900
Prompt attacks, unseen families	0.922	0.822	0.762	0.875	0.985	0.882
Prompt attacks, known families	0.972	0.918	0.939	0.965	0.956	0.950
deepset prompt injections	0.988	0.970	0.982	0.985	0.989	0.957
CultureGuard, response harm	0.903	0.819	0.810	0.900	0.937	0.916
AEGIS 2.0, response harm	0.926	0.896	0.902	0.928	0.934	0.917
PolyGuard, response harm	0.897	0.860	0.866	0.906	0.925	0.936
Do-Not-Answer, response harm	0.828	0.874	0.832	0.822	0.931	0.656
Do-Not-Answer, refusal	0.924	0.900	0.911	0.919	0.893	0.896
XSTest, refusal	0.990	0.988	0.988	0.989	0.992	0.955
PolyGuard, refusal	0.898	0.827	0.850	0.895	0.945	0.947
mean of 14	0.887	0.853	0.845	0.877	0.921	0.871

Vela 2.0 4B: its release run's own per-row test scores, scored with the same code on the same rows. Vela 2.0 0.3B: its published card values on the same test sets (not re-read by us). These sets were not part of the item-level scan, so the table uses all rows for every model.

Benign requests carrying personal data

Benign requests that carry personal data, read as harmful (lower is better)	vela3.1-fast	vela3.1-pico-380m	vela3.1-pico-150m	vela3-fast (3.0)	Vela 2.0 0.3B
470 support requests by other writers, 14 languages (% flagged harmful)	21.1%	3.4%	4.9%	13.6%	4.0%
same requests (% flagged as jailbreak)	4.7%	1.1%	1.5%	5.5%	1.7%

Customer-support requests with names, addresses, card numbers and order ids, all safe: a public English support set (its placeholders filled with synthetic values) and messages hand-written by a different writer in 14 languages (e-mails, chat, forms, transcripts). Never used to pick a checkpoint. 30 of the 500 requests overlap training text and are left out. vela3-fast 3.0 and Vela 2.0 0.3B read by us through their public releases on the same requests.

ʰ Clean items: every test item that occurs in our training data, exactly (normalised text) or with at least half of its 13-grams covered by training rows, is left out for every model; the counts in brackets are the rows kept.

Spans: entities, relations, evidence, unsupported claims

Benchmark (metric)	vela3.1-fast	vela3-fast (3.0)	Vela 2.0 0.3B	Other models
OOD-7 zero-shot NER, label names (entity F1, mean of 7)	61.6	62.2	–	gliner-multitask-large-v0.5, GLiNER multi v2.1 ⁷
NER, the 26 sets of the GLiFormer paper (strict F1)	57.4	57.3	–	GLiFormer-large ⁷
CoNLL04, head entity given (tail F1)	27.6	26.1	5.6	GLiFormer-base 8.6 (our run)
Relations end to end, GLiFormer Table 4, mean of 4 (strict F1) ⁵	17.4	17.4	–	Qwen3.5-9B 25.7, GLiFormer-large ⁷
Unsupported claims, LettuceDetect v2 test, 8,490 answers (example-F1)	87.7	87.2	82.3	LettuceDetect v2 mmBERT-base 84.7 (our read); LettuceDetect v2 qwen-2b ⁷
same (character span-F1)	66.4	65.4	61.1	LettuceDetect v2 mmBERT-base 62.7 (our read); LettuceDetect v2 qwen-2b ⁷
RAGTruth ⁶ (example-F1)	78.1	78.6	70.8	LettuceDetect large v1 79.2 (our read; matches its paper); HDM-2 ⁷
RAGTruth ⁶ (span-F1)	57.5	57.3	49.1	LettuceDetect large v1 58.9 (our read)
ACL-Verbatim evidence ⁸ (word F1, 35 clean of 100 items)	42.6	30.0	–	ACL-Verbatim ModernBERT ⁷
QASPER evidence ⁵ (word F1, in-domain)	50.5	50.8	–	–
Zero-shot classification, the 13 sets of the GLiFormer paper (macro-F1)	73.4	74.1	–	GLiFormer-large ⁷

Label names are the only input for NER and classification. All numbers on clean items unless a footnote says otherwise.

⁶ The RAGTruth rows of the LettuceDetect v2 test (2,694 of 2,700 kept). RAGTruth's train split is in the training data. ⁵ All rows: QASPER's test split was not part of the item scan, and QASPER's train split is in the evidence adapter's data; of the four Table 4 sets, DocRED has 29% of its gold items overlapping training text and FewRel 5%, which this row does not remove. ⁸ In-domain: ACL-Verbatim's train split is in the evidence adapter's data, and 65 of its 100 test items overlap training text; the row uses the other 35, so it is noisy. ⁷ Reported only, on all rows, so not comparable with the clean items: LettuceDetect v2 qwen-2b 92.1 example-F1 and 68.9 span-F1 (2.3B), HDM-2 85.0 on RAGTruth (3B), gliner-multitask-large-v0.5 62.76 on OOD-7, GLiFormer-large 50.91 on the 26 NER sets, 21.3 on Table 4 and 75.03 on the 13 classification sets, ACL-Verbatim ModernBERT 53.4. GLiNER multi v2.1 reads 54.3 on OOD-7 in our run (all rows; no per-item output kept). Qwen3.5-9B on Table 4: our run, all rows.

Speed

Call, on CPU (PyTorch, fp32)	vela3.1-fast	vela3-fast (3.0)
Core router call ⁹ (6 passes, 1,996 tokens)	12,306 ms	12,634 ms
1 decision	1,163 ms	1,532 ms
5 decisions	5,411 ms	6,014 ms
10 decisions	10,878 ms	12,520 ms

AMD EPYC 7413 24-Core Processor on an otherwise idle machine, 4 threads, median of 5 after 2 warm-ups; one fixed 200-token request with a context and an answer; PyTorch 2.8.0; peak memory 7.8 GB. Measured 7 Nov 2026 on these weights; vela3-fast 3.0 in the same session. Each question type is its own pass: one pass per decision. For one pass per call, see vela3.1-pico-380m.

⁹ Domain, fact-check need, feedback, modality, harmful request and jailbreak, plus PII and unsupported-claim spans, on one request.

Training data

The decision backbone starts from vela3-fast's and is trained on the d3 decision models' answer distributions over public datasets' train splits written as decisions (for example ANLI, WinoGrande, HellaSwag and RAGTruth), synthetic decision tasks labelled by d3 or by program (disclosed above), reworded questions and layouts, decision rows machine-translated into 14 languages, and the MASSIVE train split in 13 locales. The adapters are trained as in 3.0: router signals supervised on the public router datasets Vela 2.0 used (for example AEGIS 2.0, PolyGuardMix and Nemotron-Safety-Guard v3 for safety, Global-MMLU for domain, MASSIVE for intents), with translated router rows in 9 languages; spans on public NER, relation, hallucination, evidence and PII datasets and on web and document text labelled by a large teacher model. No test split and no Decision Index item is trained on.

Limits

• Some span tasks are under 3.0: OOD-7 61.6 against 62.2, RAGTruth example-F1 78.1 against 78.6, QASPER 50.5 against 50.8, 13-set classification 73.4 against 74.1, and non-English unsupported-claim spans 92.97 against 93.70.
• Vela 2.0 0.3B, built on a multilingual backbone, is still ahead on non-English safety and domain (0.901 against 0.873; 0.541 against 0.355), and on the Nemotron-Safety-Guard v3 and PolyGuardPrompts files (0.895 and 0.897 against 0.862 and 0.874). On the 14 router-safety sets the mean AUC is 0.887, against 0.877 for 3.0, 0.871 for Vela 2.0 0.3B and 0.921 for Vela 2.0 4B.
• On held-out safety sources vela3-fast 3.0 is ahead on 3 of 7 files: CoCoNot 0.966 against 0.969; CoCoNot contrast 7.4% against 6.3% flagged; OR-Bench hard 70.3% against 57.7% flagged (AUC, or share of benign requests flagged at 0.5 on the benign-only files).
• Hazard categories (which kind of harm): below vela3-fast 3.0 on 4 of the 4 held-out hazard files (AILuminate 0.711 against 0.786; Aya red-teaming 0.530 against 0.549; BeaverTails eval 0.761 against 0.831; MLCommons synthetic 0.817 against 0.880), and far below Decision-1.0-Route-0.6B, which trains on the suite (0.653 against 0.913 macro AUC on the test file).
• Benign requests carrying personal data are read as harmful more often than by vela3-fast 3.0 and Vela 2.0 0.3B: 21.1% of 470 held-out support requests, against 13.6% for vela3-fast 3.0 and 4.0% for Vela 2.0 0.3B (vela3.1-pico-380m 3.4%, vela3.1-pico-150m 4.9%). Set the harmful-request cut on your own rows.
• On the MASSIVE router-path rows, GLiClass v4 Edge and Vela 2.0 0.3B lead outside English: 65.5 and 61.8 intent accuracy against 49.6 (9 locales, clean items). Vela 2.0 trains on MASSIVE; GLiClass's card does not say.
• Languages are uneven. On MASSIVE (13 languages) French, Spanish, Portuguese, German and Italian read 74.8–78.9, but Hungarian 47.1, Arabic 48.6, Korean 52.8, Hindi 56.8 and Polish 65.5. UltraBERT's English vocabulary splits these languages into many more tokens per word.
• The adapters cost passes: each question type is its own pass, so a full router call is 6 passes.
• Decision Index Full score (private tests): board submission pending.

The family

Model	Size	Best for
vela3.1-fast (this model)	0.4B, adapters	the default router: decisions, spans and router signals, 15 languages
vela3.1-pico-380m	0.4B, one file	the whole router call in one pass; CPU
vela3.1-pico-150m	0.15B, one file	the smallest one-pass router
vela3-fast	0.4B	Vela 3.0, English
vela3-lite · mini · flash · turbo	0.8B – 27B	Vela 3.0 on the d3 decision models

Citation

@misc{vela31_fast,
  title        = {vela3.1-fast (Vela 3.1, 0.4B): multilingual decisions, spans and router signals in one UltraBERT-380M encoder},
  author       = {{KR Labs} and {vLLM Semantic Router}},
  year         = {2026},
  howpublished = {\url{https://huggingface.co/vllm-sr/vela3.1-fast}}
}

Revision history

• 7 Nov 2026 · weights 6008a5fb (branch v31): first release of vela3.1-fast. Every number on this card is for these weights; the card text was revised the same day (CPU latency from one idle-machine session, quick start with described labels, Decision Index rows from the board data of 6 Nov 2026 with GLiDE 0.4B, size wording).

• 9 Nov 2026 · card text only: MASSIVE two-stage reads of the shipped pico-380m and pico-150m packages added (same protocol and clean items as vela3.1-fast); weights unchanged.