SAVRN
Search Contact SAVRN

Open-weight model · Text classification

deberta-v3-base-prompt-injection-v2

by Protect AI protectai/deberta-v3-base-prompt-injection-v2

This model is a fine-tuned version of microsoft/deberta-v3-base specifically developed to detect and classify prompt injection attacks which can manipulate language models into producing unintended outputs.

Parameters184M
Context512
Weights1.5 GB
Licenseapache-2.0
AccessOpen weights
Monthly Downloads869.5k

Runs On

What it takes to serve deberta-v3-base-prompt-injection-v2 (184M parameters): the memory its weights need at each precision, and the cheapest way to rent enough data-center GPUs to hold them.

PrecisionWeightsMemory neededCheapest setupPer hourAlso fits
16-bit 0.4 GB 0.4 GB 1x MI300X (192 GB)
Vultr
$1.85 1x H100 $1.99 · 1x MI325X $2.00
8-bit 0.2 GB 0.2 GB 1x MI300X (192 GB)
Vultr
$1.85 1x H100 $1.99 · 1x MI325X $2.00
4-bit 0.1 GB 0.1 GB 1x MI300X (192 GB)
Vultr
$1.85 1x H100 $1.99 · 1x MI325X $2.00

Memory is the weights at that precision plus 20% for the runtime and a short context; a long context needs more. Prices are the lowest on-demand hourly rates in the SAVRN Index, read Sep 18, 2026.

SAVRN's Notes on deberta-v3-base-prompt-injection-v2

Put this one in front of the generator, not behind it. Protect AI trained deberta-v3-base-prompt-injection-v2 to sort each input into benign, label 0, or injection detected, label 1. It needs 0.4 GB at 16-bit, 0.2 GB at 8-bit and 0.1 GB at 4-bit, so on the cheapest slot we price, one 192 GB MI300X at $1.85 an hour, it shares the card with the model it guards. The deployment is shaped by 512 tokens of context: anything longer must be windowed first, and that logic is yours to build.

Apache 2.0 permits commercial use inside a paid product and redistribution with the notices kept. Check the lineage, listed in full: a fine-tuned version of microsoft/deberta-v3-base, trained on seven datasets including Harelix/Prompt-Injection-Mixed-Techniques-2024, jackhhao/jailbreak-classification and OpenSafetyLab/Salad-Data. Compare those against the traffic you actually receive. Released April 20, 2024, files updated July 9, 2026, so pull the current set, safetensors or ONNX.

Model Card

By Protect AI, published under apache-2.0, revision 90c9989b1a34.

[!WARNING] THIS PROJECT HAS BEEN ARCHIVED.

This project and its associated code on GitHub are no longer under active development or maintained.

Model Card for deberta-v3-base-prompt-injection-v2

This model is a fine-tuned version of microsoft/deberta-v3-base specifically developed to detect and classify prompt injection attacks which can manipulate language models into producing unintended outputs.

Introduction

Prompt injection attacks manipulate language models by inserting or altering prompts to trigger harmful or unintended responses. The deberta-v3-base-prompt-injection-v2 model is designed to enhance security in language model applications by detecting these malicious interventions.

Model Details

  • Fine-tuned by: Protect AI
  • Model type: deberta-v3-base
  • Language(s) (NLP): English
  • License: Apache License 2.0
  • Finetuned from model: microsoft/deberta-v3-base

Intended Uses

This model classifies inputs into benign (0) and injection-detected (1).

Limitations

deberta-v3-base-prompt-injection-v2 is highly accurate in identifying prompt injections in English. It does not detect jailbreak attacks or handle non-English prompts, which may limit its applicability in diverse linguistic environments or against advanced adversarial techniques.

Read the full model card (544 words)

Configuration

Architecture
DebertaV2ForSequenceClassification
Context length (tokens)
512
Layers
12
Hidden size
768
Feed-forward size
3,072
Attention heads
12
Vocabulary size
128,100
Stored precision
float32
Model type
deberta-v2

Identity and Version

Repository
protectai/deberta-v3-base-prompt-injection-v2
Publisher
Protect AI
Task
Text classification
Modality
Text
Library
transformers
Parameters
184M parameters
Languages
en
Revision
90c9989b1a342275dd0d1a95aad283c04e075671
First published
2024-04-20
Last updated
2026-07-09

Files and Weights

19 files, 1.5 GB in total. The weights are 3 files totalling 1.5 GB in bin, onnx, safetensors.

Weights3 files · 1.5 GB
Configuration6 files · 3.3 KB
Tokenizer4 files · 17.3 MB
Documentation2 files · 16.5 KB
Other3 files · 4.9 MB
Repository1 file · 1.5 KB
Every file
FileTypeSizeSHA-256
model.safetensorsWeights737.7 MB 6521cb8d0ac0
onnx/model.onnxWeights738.6 MB f0ea7f239f76
training_args.binWeights5.0 KB 850c358d86ce
added_tokens.jsonConfiguration23 B
config.jsonConfiguration994 B
onnx/added_tokens.jsonConfiguration23 B
onnx/config.jsonConfiguration1.0 KB
onnx/special_tokens_map.jsonConfiguration970 B
special_tokens_map.jsonConfiguration286 B
LICENSEDocumentation10.2 KB
README.mdDocumentation6.3 KB
deberta-v3-base-prompt-injection-v2_emissions.csvOther810 B
onnx/spm.modelOther2.5 MB c679fbf93643
spm.modelOther2.5 MB c679fbf93643
.gitattributesRepository1.5 KB
onnx/tokenizer.jsonTokenizer8.6 MB
onnx/tokenizer_config.jsonTokenizer1.4 KB
tokenizer.jsonTokenizer8.7 MB
tokenizer_config.jsonTokenizer1.3 KB

License and Download

License
apache-2.0
Access
Open weights, no gate
Download size
1.5 GB
Download from Protect AI

Released by Protect AI through its official repository on Hugging Face. Read the license.

Built From

  • Derived from microsoft/deberta-v3-base
  • Quantized from microsoft/deberta-v3-base
  • Trained on (disclosed) Harelix/Prompt-Injection-Mixed-Techniques-2024
  • Trained on (disclosed) HuggingFaceH4/grok-conversation-harmless
  • Trained on (disclosed) OpenSafetyLab/Salad-Data
  • Trained on (disclosed) VMware/open-instruct
  • Trained on (disclosed) alespalla/chatbot_instruction_prompts
  • Trained on (disclosed) jackhhao/jailbreak-classification
  • Trained on (disclosed) natolambert/xstest-v2-copy

Memory Requirements

PrecisionWeights in memory
As published1.5 GB
16-bit0.4 GB
8-bit0.2 GB
4-bit0.1 GB

Weights only, from the published parameter count; the key-value cache and runtime add to this.

Questions About deberta-v3-base-prompt-injection-v2

How much GPU memory does deberta-v3-base-prompt-injection-v2 need?

About 0.4 GB at 16-bit and 0.1 GB at 4-bit: the weights (184M parameters) plus a working margin. A long context needs more.

What is the cheapest GPU to run deberta-v3-base-prompt-injection-v2 on?

At 16-bit, 1x MI300X from $1.85 an hour; at 4-bit, 1x MI300X from $1.85 an hour, at the lowest on-demand prices the SAVRN Index lists.

Can I use deberta-v3-base-prompt-injection-v2 commercially?

Yes. deberta-v3-base-prompt-injection-v2 is released under Apache License 2.0. The Apache License 2.0 is a permissive open-source license. It permits commercial use, modification and redistribution. It requires keeping the license and copyright notices and any NOTICE file, stating significant changes, and it includes an express patent grant from contributors.

What is deberta-v3-base-prompt-injection-v2's context length?

512 tokens, from the maximum position embeddings in its published configuration.

Similar Models

This model was trained on 1.279.665 hypothesis-premise pairs from 8 NLI datasets: MultiNLI, Fever-NLI, LingNLI and DocNLI (which includes ANLI, QNLI, DUC, CNN/DailyMail, Curation). It is the only model in the model hub trained on 8 NLI datasets, including DocNLI with very long texts to learn long range reasoning. Note that the model was trained on binary NLI to predict either "entailment" or "not-entailment". The DocNLI merges the classes "neural" and "contradiction" into "not-entailment" to enable the inclusion of the DocNLI dataset. The base model is DeBERTa-v3-base from Microsoft. The v3 variant of DeBERTa substantially outperforms previous versions of the model by including a different…

Open weights mit 184M parameters 512 tokens transformers

Model · Text classification

bert-base-multilingual-uncased-sentiment

NLP Town

Visit the NLP Town website for an updated version of this model, with a 40% error reduction on product reviews. This is a bert-base-multilingual-uncased model finetuned for sentiment analysis on product reviews in six languages: English, Dutch, German, French, Spanish, and Italian. It predicts the sentiment of the review as a number of stars (between 1 and 5). This model is intended for direct use as a sentiment analysis model for product reviews in any of the six languages above or for further finetuning on related sentiment analysis tasks. Here is the number of product reviews we used for finetuning the model: The fine-tuned model obtained the following accuracy on 5,000 held-out product…

Open weights mit 167M parameters 512 tokens transformers

Model · Text classification

Firebird-ModernBERT-512-RW

Noumenon, Inc.

Firebird-ModernBERT-512-RW is an experimental post-trained variant of It is a ~149M parameter ModernBERT binary classifier for distinguishing: - 0 — HUMAN The maximum sequence length is 512 tokens. This checkpoint was produced through reward-weighted classifier post-training. The original Firebird checkpoint was kept frozen as a reference model. Training examples were scored by the original classifier, difficult examples received larger loss weights, and the post-trained model was constrained against the frozen reference using a KL penalty. L = weightedcrossentropy + beta KL(reference || policy) Hard human examples received greater weighting than ordinary examples because one goal of the…

Open weights 150M parameters 8,192 tokens transformers

Model · Text classification

SciFive-base-Pubmed_PMC

Razent

Paper: SciFive: a text-to-text transformer model for biomedical literature Authors: Long N. Phan, James T. Anibal, Hieu Tran, Shaurya Chanana, Erol Bahadroglu, Alec Peltekian, Grégoire Altan-Bonnet For more details, do check out our Github repo.

Open weights 223M parameters transformers

This model is distilled from the zero-shot classification pipeline on the Multilingual Sentiment dataset using this script. In reality the multilingual-sentiment dataset is annotated of course, but we'll pretend and ignore the annotations for the sake of example. Result can be reproduce using the following commands: If you are training this model on Colab, make the following code changes to avoid Out-of-memory error message: - Transformers 4.28.1 - Pytorch 2.0.0+cu118 - Datasets 2.11.0 - Tokenizers 0.13.3

Open weights apache-2.0 135M parameters 512 tokens transformers

Model · Text classification

turn-detector

LiveKit

An open-weights language model for contextually-aware end-of-utterance (EOU) detection in voice AI applications. The model predicts whether a user has finished speaking based on the semantic content of their transcribed speech, providing a critical complement to voice activity detection (VAD) systems. Traditional voice agents rely on voice activity detection (VAD) to determine when a user has finished speaking. VAD works by detecting the presence or absence of speech in an audio signal and applying a silence timer. While effective for detecting pauses, VAD lacks language understanding and frequently causes false positives. For example, a user who says "I need to think about that for a…

Open weights other 135M parameters 8,192 tokens transformers