DEBATE-kor-base is a Korean-adapted Political DEBATE model for binary natural language inference (NLI) on political text. The model is initialized from mlburnham/PoliticalDEBATEDeBERTabasev1.1, the original DeBERTa-based Political DEBATE checkpoint, and subsequently fine-tuned on jongrock17/PolNLI-kor, a Korean translation and adaptation of PolNLI. Political DEBATE DeBERTa-base → PolNLI-kor → DEBATE-kor-base Unlike the PolNLI-kor-RoBERTa model family, which starts from Korean-pretrained KLUE-RoBERTa encoders, DEBATE-kor directly adapts the original Political DEBATE checkpoint to Korean political NLI. DEBATE-kor formulates NLI as a binary classification problem. notentailment combines…
Open-weight model · Text classification
deberta-v3-base-prompt-injection-v2
by Protect AI protectai/deberta-v3-base-prompt-injection-v2
deberta-v3-base-prompt-injection-v2 is an open-weight model for text classification from Protect AI, released under Apache License 2.0. It has 184M parameters and a 512-token context. At 16-bit it needs about 0.4 GB of GPU memory, which fits on 1x MI300X from $1.85 an hour, at the lowest prices in the SAVRN Index. It draws 869.5k downloads a month.
This model is a fine-tuned version of microsoft/deberta-v3-base specifically developed to detect and classify prompt injection attacks which can manipulate language models into producing unintended outputs.
Runs On
What it takes to serve deberta-v3-base-prompt-injection-v2 (184M parameters): the memory its weights need at each precision, and the cheapest way to rent enough data-center GPUs to hold them.
| Precision | Weights | Memory needed | Cheapest setup | Per hour | Also fits |
|---|---|---|---|---|---|
| 16-bit | 0.4 GB | 0.4 GB | 1x MI300X (192 GB) Vultr |
$1.85 | 1x H100 $1.99 · 1x MI325X $2.00 |
| 8-bit | 0.2 GB | 0.2 GB | 1x MI300X (192 GB) Vultr |
$1.85 | 1x H100 $1.99 · 1x MI325X $2.00 |
| 4-bit | 0.1 GB | 0.1 GB | 1x MI300X (192 GB) Vultr |
$1.85 | 1x H100 $1.99 · 1x MI325X $2.00 |
Memory is the weights at that precision plus 20% for the runtime and a short context; a long context needs more. Prices are the lowest on-demand hourly rates in the SAVRN Index, read Oct 9, 2026.
deberta-v3-base-prompt-injection-v2 on every accelerator the SAVRN Index prices, at every precision
SAVRN's Notes on deberta-v3-base-prompt-injection-v2
Put this one in front of the generator, not behind it. Protect AI trained deberta-v3-base-prompt-injection-v2 to sort each input into benign, label 0, or injection detected, label 1. It needs 0.4 GB at 16-bit, 0.2 GB at 8-bit and 0.1 GB at 4-bit, so on the cheapest slot we price, one 192 GB MI300X at $1.85 an hour, it shares the card with the model it guards. The deployment is shaped by 512 tokens of context: anything longer must be windowed first, and that logic is yours to build.
Apache 2.0 permits commercial use inside a paid product and redistribution with the notices kept. Check the lineage, listed in full: a fine-tuned version of microsoft/deberta-v3-base, trained on seven datasets including Harelix/Prompt-Injection-Mixed-Techniques-2024, jackhhao/jailbreak-classification and OpenSafetyLab/Salad-Data. Compare those against the traffic you actually receive. Released April 20, 2024, files updated July 9, 2026, so pull the current set, safetensors or ONNX.
Model Card
By Protect AI, published under apache-2.0, revision 90c9989b1a34.
[!WARNING] THIS PROJECT HAS BEEN ARCHIVED.
This project and its associated code on GitHub are no longer under active development or maintained.
Model Card for deberta-v3-base-prompt-injection-v2
This model is a fine-tuned version of microsoft/deberta-v3-base specifically developed to detect and classify prompt injection attacks which can manipulate language models into producing unintended outputs.
Introduction
Prompt injection attacks manipulate language models by inserting or altering prompts to trigger harmful or unintended responses. The deberta-v3-base-prompt-injection-v2 model is designed to enhance security in language model applications by detecting these malicious interventions.
Model Details
- Fine-tuned by: Protect AI
- Model type: deberta-v3-base
- Language(s) (NLP): English
- License: Apache License 2.0
- Finetuned from model: microsoft/deberta-v3-base
Intended Uses
This model classifies inputs into benign (0) and injection-detected (1).
Limitations
deberta-v3-base-prompt-injection-v2 is highly accurate in identifying prompt injections in English.
It does not detect jailbreak attacks or handle non-English prompts, which may limit its applicability in diverse linguistic environments or against advanced adversarial techniques.
Configuration
- Architecture
- DebertaV2ForSequenceClassification
- Context length (tokens)
- 512
- Layers
- 12
- Hidden size
- 768
- Feed-forward size
- 3,072
- Attention heads
- 12
- Vocabulary size
- 128,100
- Stored precision
- float32
- Model type
- deberta-v2
Identity and Version
- Repository
- protectai/deberta-v3-base-prompt-injection-v2
- Publisher
- Protect AI
- Task
- Text classification
- Modality
- Text
- Library
- transformers
- Parameters
- 184M parameters
- Languages
- en
- Revision
- 90c9989b1a342275dd0d1a95aad283c04e075671
- First published
- 2024-04-20
- Last updated
- 2026-07-09
Files and Weights
19 files, 1.5 GB in total. The weights are 3 files totalling 1.5 GB in bin, onnx, safetensors.
Every file
| File | Type | Size | SHA-256 |
|---|---|---|---|
| model.safetensors | Weights | 737.7 MB | 6521cb8d0ac0 |
| onnx/model.onnx | Weights | 738.6 MB | f0ea7f239f76 |
| training_args.bin | Weights | 5.0 KB | 850c358d86ce |
| added_tokens.json | Configuration | 23 B | — |
| config.json | Configuration | 994 B | — |
| onnx/added_tokens.json | Configuration | 23 B | — |
| onnx/config.json | Configuration | 1.0 KB | — |
| onnx/special_tokens_map.json | Configuration | 970 B | — |
| special_tokens_map.json | Configuration | 286 B | — |
| LICENSE | Documentation | 10.2 KB | — |
| README.md | Documentation | 6.3 KB | — |
| deberta-v3-base-prompt-injection-v2_emissions.csv | Other | 810 B | — |
| onnx/spm.model | Other | 2.5 MB | c679fbf93643 |
| spm.model | Other | 2.5 MB | c679fbf93643 |
| .gitattributes | Repository | 1.5 KB | — |
| onnx/tokenizer.json | Tokenizer | 8.6 MB | — |
| onnx/tokenizer_config.json | Tokenizer | 1.4 KB | — |
| tokenizer.json | Tokenizer | 8.7 MB | — |
| tokenizer_config.json | Tokenizer | 1.3 KB | — |
License and Download
- License
- apache-2.0
- Access
- Open weights, no gate
- Download size
- 1.5 GB
Released by Protect AI through its official repository on Hugging Face. Read the license.
Built From
- Derived from microsoft/deberta-v3-base
- Quantized from microsoft/deberta-v3-base
- Trained on (disclosed) Harelix/Prompt-Injection-Mixed-Techniques-2024
- Trained on (disclosed) HuggingFaceH4/grok-conversation-harmless
- Trained on (disclosed) OpenSafetyLab/Salad-Data
- Trained on (disclosed) VMware/open-instruct
- Trained on (disclosed) alespalla/chatbot_instruction_prompts
- Trained on (disclosed) jackhhao/jailbreak-classification
- Trained on (disclosed) natolambert/xstest-v2-copy
Memory Requirements
| Precision | Weights in memory |
|---|---|
| As published | 1.5 GB |
| 16-bit | 0.4 GB |
| 8-bit | 0.2 GB |
| 4-bit | 0.1 GB |
Weights only, from the published parameter count; the key-value cache and runtime add to this.
Questions About deberta-v3-base-prompt-injection-v2
How much GPU memory does deberta-v3-base-prompt-injection-v2 need?
About 0.4 GB at 16-bit and 0.1 GB at 4-bit: the weights (184M parameters) plus a working margin. A long context needs more.
What is the cheapest GPU to run deberta-v3-base-prompt-injection-v2 on?
At 16-bit, 1x MI300X from $1.85 an hour; at 4-bit, 1x MI300X from $1.85 an hour, at the lowest on-demand prices the SAVRN Index lists.
Can I use deberta-v3-base-prompt-injection-v2 commercially?
Yes. deberta-v3-base-prompt-injection-v2 is released under Apache License 2.0. The Apache License 2.0 is a permissive open-source license. It permits commercial use, modification and redistribution. It requires keeping the license and copyright notices and any NOTICE file, stating significant changes, and it includes an express patent grant from contributors.
What is deberta-v3-base-prompt-injection-v2's context length?
512 tokens, from the maximum position embeddings in its published configuration.
Similar Models
Model · Text classification
DeBERTa-v3-base-mnli-fever-docnli-ling-2c
This model was trained on 1.279.665 hypothesis-premise pairs from 8 NLI datasets: MultiNLI, Fever-NLI, LingNLI and DocNLI (which includes ANLI, QNLI, DUC, CNN/DailyMail, Curation). It is the only model in the model hub trained on 8 NLI datasets, including DocNLI with very long texts to learn long range reasoning. Note that the model was trained on binary NLI to predict either "entailment" or "not-entailment". The DocNLI merges the classes "neural" and "contradiction" into "not-entailment" to enable the inclusion of the DocNLI dataset. The base model is DeBERTa-v3-base from Microsoft. The v3 variant of DeBERTa substantially outperforms previous versions of the model by including a different…
This is a three-class Japanese/English sentiment classifier for short hospitality reviews, fine-tuned from google-bert/bert-base-multilingual-cased. It categorizes each review as negative, neutral, or positive. The model predicts one overall label for a short Japanese or English hospitality It is intended for research, prototyping, and human-reviewed analytics. It must not be used as the sole basis for consequential business, employment, moderation, or customer-service decisions. Applications using this model should allow operators to review and correct its predictions. The model was fine-tuned on 480 synthetic bilingual reviews: 240 Japanese and 240 English, balanced across the three…
Visit the NLP Town website for an updated version of this model, with a 40% error reduction on product reviews. This is a bert-base-multilingual-uncased model finetuned for sentiment analysis on product reviews in six languages: English, Dutch, German, French, Spanish, and Italian. It predicts the sentiment of the review as a number of stars (between 1 and 5). This model is intended for direct use as a sentiment analysis model for product reviews in any of the six languages above or for further finetuning on related sentiment analysis tasks. Here is the number of product reviews we used for finetuning the model: The fine-tuned model obtained the following accuracy on 5,000 held-out product…
Pyrrho is a CPU-runnable co-processor for retrieval-augmented generation. It reads a question before retrieval to suggest what evidence to seek, then reads the question with retrieved passages to assess whether those passages support an answer. A surrounding RAG runtime decides whether to answer, retrieve again, or surface a conflict. The broader project is described in the The evidence verdict is SUFFICIENT, DISPUTED, or INSUFFICIENT. These are predictions about the supplied passages. The model does not retrieve sources, generate answers or citations, check external facts, or prove that a corpus has been searched completely. The two passes use the same encoder with different input…
A ~150M-parameter encoder that checks whether a RAG answer is supported by the source it was given. Given an answer and a source (and optionally the question), it returns grounded or hallucinated with P(grounded). It runs on CPU. - Every number below is traceable to a committed report in that repository. Hashes for every file are in the repository's MODELPROVENANCE.json. python -m eval.provenance --verify re-checks them. All measured on CPU against the pinned weights, using test sets rebuilt from pinned public datasets. F1 is for the hallucinated class, and the 95% CIs come from a 2,000-resample bootstrap. - 512 tokens reproduces the training run's published numbers (F1 0.6824, acc 0.7468…