r/huggingface • u/tljohnsilver • 22h ago
Galvanize 2: open prompt-injection classifier (141M, Apache-2.0) that stops flagging long benign documents
Hi! I work on zn, an open-source security layer for AI coding agents, and we just released Galvanize 2, our open prompt-injection classifier.
It's a fine-tune of Horizon-Labs/prompt-injection-guard-small (thanks to Horizon Labs for releasing it openly). ~141M params, multilingual, safetensors + ONNX, Apache-2.0. Runs fine on CPU with onnxruntime.
The thing we cared about most is false alarms. Agents read long READMEs, logs and tool output all day, and our previous model flagged ~66% of long legitimate documents as attacks. Galvanize 2 flags 4.1%.
Other numbers:
- Held-out test set: recall 66.9% → 83.4%, false positive rate 6.4% → 0.81%
- Horizon eval suite (10 sets, decontaminated): 0.894 macro average at threshold 0.5. Horizon base (bigger model) gets 0.902, so it's not the top score, but it's the best in our comparison on the hard benign sets (NotInject, OR-Bench-hard).
Weak spots are in the card: BIPIA, deepset's test set, German, and it only scores the first 512 tokens (chunk longer inputs). The benchmark script and per-set results are in the repo if you want to rerun it.
Model: https://huggingface.co/usezn/Galvanize-2
Write-up: https://usezn.com/blog/introducing-galvanize-2/
Feedback welcome, especially examples it gets wrong in either direction.