SAVRN
Search Contact SAVRN

Open-weight model · Text classification

deberta-v3-base-prompt-injection-v2

by Protect AI protectai/deberta-v3-base-prompt-injection-v2

deberta-v3-base-prompt-injection-v2 is an open-weight model for text classification from Protect AI, released under Apache License 2.0. It has 184M parameters and a 512-token context. At 16-bit it needs about 0.4 GB of GPU memory, which fits on 1x MI300X from $1.85 an hour, at the lowest prices in the SAVRN Index. It draws 869.5k downloads a month.

This model is a fine-tuned version of microsoft/deberta-v3-base specifically developed to detect and classify prompt injection attacks which can manipulate language models into producing unintended outputs.

Parameters184M
Context512
Weights1.5 GB
Licenseapache-2.0
AccessOpen weights
Monthly Downloads869.5k

Runs On

What it takes to serve deberta-v3-base-prompt-injection-v2 (184M parameters): the memory its weights need at each precision, and the cheapest way to rent enough data-center GPUs to hold them.

PrecisionWeightsMemory neededCheapest setupPer hourAlso fits
16-bit 0.4 GB 0.4 GB 1x MI300X (192 GB)
Vultr
$1.85 1x H100 $1.99 · 1x MI325X $2.00
8-bit 0.2 GB 0.2 GB 1x MI300X (192 GB)
Vultr
$1.85 1x H100 $1.99 · 1x MI325X $2.00
4-bit 0.1 GB 0.1 GB 1x MI300X (192 GB)
Vultr
$1.85 1x H100 $1.99 · 1x MI325X $2.00

Memory is the weights at that precision plus 20% for the runtime and a short context; a long context needs more. Prices are the lowest on-demand hourly rates in the SAVRN Index, read Oct 9, 2026.

deberta-v3-base-prompt-injection-v2 on every accelerator the SAVRN Index prices, at every precision

SAVRN's Notes on deberta-v3-base-prompt-injection-v2

Put this one in front of the generator, not behind it. Protect AI trained deberta-v3-base-prompt-injection-v2 to sort each input into benign, label 0, or injection detected, label 1. It needs 0.4 GB at 16-bit, 0.2 GB at 8-bit and 0.1 GB at 4-bit, so on the cheapest slot we price, one 192 GB MI300X at $1.85 an hour, it shares the card with the model it guards. The deployment is shaped by 512 tokens of context: anything longer must be windowed first, and that logic is yours to build.

Apache 2.0 permits commercial use inside a paid product and redistribution with the notices kept. Check the lineage, listed in full: a fine-tuned version of microsoft/deberta-v3-base, trained on seven datasets including Harelix/Prompt-Injection-Mixed-Techniques-2024, jackhhao/jailbreak-classification and OpenSafetyLab/Salad-Data. Compare those against the traffic you actually receive. Released April 20, 2024, files updated July 9, 2026, so pull the current set, safetensors or ONNX.

Model Card

By Protect AI, published under apache-2.0, revision 90c9989b1a34.

[!WARNING] THIS PROJECT HAS BEEN ARCHIVED.

This project and its associated code on GitHub are no longer under active development or maintained.

Model Card for deberta-v3-base-prompt-injection-v2

This model is a fine-tuned version of microsoft/deberta-v3-base specifically developed to detect and classify prompt injection attacks which can manipulate language models into producing unintended outputs.

Introduction

Prompt injection attacks manipulate language models by inserting or altering prompts to trigger harmful or unintended responses. The deberta-v3-base-prompt-injection-v2 model is designed to enhance security in language model applications by detecting these malicious interventions.

Model Details

  • Fine-tuned by: Protect AI
  • Model type: deberta-v3-base
  • Language(s) (NLP): English
  • License: Apache License 2.0
  • Finetuned from model: microsoft/deberta-v3-base

Intended Uses

This model classifies inputs into benign (0) and injection-detected (1).

Limitations

deberta-v3-base-prompt-injection-v2 is highly accurate in identifying prompt injections in English. It does not detect jailbreak attacks or handle non-English prompts, which may limit its applicability in diverse linguistic environments or against advanced adversarial techniques.

Read the full model card (544 words)

Configuration

Architecture
DebertaV2ForSequenceClassification
Context length (tokens)
512
Layers
12
Hidden size
768
Feed-forward size
3,072
Attention heads
12
Vocabulary size
128,100
Stored precision
float32
Model type
deberta-v2

Identity and Version

Repository
protectai/deberta-v3-base-prompt-injection-v2
Publisher
Protect AI
Task
Text classification
Modality
Text
Library
transformers
Parameters
184M parameters
Languages
en
Revision
90c9989b1a342275dd0d1a95aad283c04e075671
First published
2024-04-20
Last updated
2026-07-09

Files and Weights

19 files, 1.5 GB in total. The weights are 3 files totalling 1.5 GB in bin, onnx, safetensors.

Weights3 files · 1.5 GB
Configuration6 files · 3.3 KB
Tokenizer4 files · 17.3 MB
Documentation2 files · 16.5 KB
Other3 files · 4.9 MB
Repository1 file · 1.5 KB
Every file
FileTypeSizeSHA-256
model.safetensorsWeights737.7 MB 6521cb8d0ac0
onnx/model.onnxWeights738.6 MB f0ea7f239f76
training_args.binWeights5.0 KB 850c358d86ce
added_tokens.jsonConfiguration23 B —
config.jsonConfiguration994 B —
onnx/added_tokens.jsonConfiguration23 B —
onnx/config.jsonConfiguration1.0 KB —
onnx/special_tokens_map.jsonConfiguration970 B —
special_tokens_map.jsonConfiguration286 B —
LICENSEDocumentation10.2 KB —
README.mdDocumentation6.3 KB —
deberta-v3-base-prompt-injection-v2_emissions.csvOther810 B —
onnx/spm.modelOther2.5 MB c679fbf93643
spm.modelOther2.5 MB c679fbf93643
.gitattributesRepository1.5 KB —
onnx/tokenizer.jsonTokenizer8.6 MB —
onnx/tokenizer_config.jsonTokenizer1.4 KB —
tokenizer.jsonTokenizer8.7 MB —
tokenizer_config.jsonTokenizer1.3 KB —

License and Download

License
apache-2.0
Access
Open weights, no gate
Download size
1.5 GB
Download from Protect AI

Released by Protect AI through its official repository on Hugging Face. Read the license.

Built From

  • Derived from microsoft/deberta-v3-base
  • Quantized from microsoft/deberta-v3-base
  • Trained on (disclosed) Harelix/Prompt-Injection-Mixed-Techniques-2024
  • Trained on (disclosed) HuggingFaceH4/grok-conversation-harmless
  • Trained on (disclosed) OpenSafetyLab/Salad-Data
  • Trained on (disclosed) VMware/open-instruct
  • Trained on (disclosed) alespalla/chatbot_instruction_prompts
  • Trained on (disclosed) jackhhao/jailbreak-classification
  • Trained on (disclosed) natolambert/xstest-v2-copy

Memory Requirements

PrecisionWeights in memory
As published1.5 GB
16-bit0.4 GB
8-bit0.2 GB
4-bit0.1 GB

Weights only, from the published parameter count; the key-value cache and runtime add to this.

Questions About deberta-v3-base-prompt-injection-v2

How much GPU memory does deberta-v3-base-prompt-injection-v2 need?

About 0.4 GB at 16-bit and 0.1 GB at 4-bit: the weights (184M parameters) plus a working margin. A long context needs more.

What is the cheapest GPU to run deberta-v3-base-prompt-injection-v2 on?

At 16-bit, 1x MI300X from $1.85 an hour; at 4-bit, 1x MI300X from $1.85 an hour, at the lowest on-demand prices the SAVRN Index lists.

Can I use deberta-v3-base-prompt-injection-v2 commercially?

Yes. deberta-v3-base-prompt-injection-v2 is released under Apache License 2.0. The Apache License 2.0 is a permissive open-source license. It permits commercial use, modification and redistribution. It requires keeping the license and copyright notices and any NOTICE file, stating significant changes, and it includes an express patent grant from contributors.

What is deberta-v3-base-prompt-injection-v2's context length?

512 tokens, from the maximum position embeddings in its published configuration.

Similar Models

Model · Text classification

DEBATE-kor-base

Jong Rock Jeong

DEBATE-kor-base is a Korean-adapted Political DEBATE model for binary natural language inference (NLI) on political text. The model is initialized from mlburnham/PoliticalDEBATEDeBERTabasev1.1, the original DeBERTa-based Political DEBATE checkpoint, and subsequently fine-tuned on jongrock17/PolNLI-kor, a Korean translation and adaptation of PolNLI. Political DEBATE DeBERTa-base → PolNLI-kor → DEBATE-kor-base Unlike the PolNLI-kor-RoBERTa model family, which starts from Korean-pretrained KLUE-RoBERTa encoders, DEBATE-kor directly adapts the original Political DEBATE checkpoint to Korean political NLI. DEBATE-kor formulates NLI as a binary classification problem. notentailment combines…

Open weights 184M parameters 512 tokens transformers

This model was trained on 1.279.665 hypothesis-premise pairs from 8 NLI datasets: MultiNLI, Fever-NLI, LingNLI and DocNLI (which includes ANLI, QNLI, DUC, CNN/DailyMail, Curation). It is the only model in the model hub trained on 8 NLI datasets, including DocNLI with very long texts to learn long range reasoning. Note that the model was trained on binary NLI to predict either "entailment" or "not-entailment". The DocNLI merges the classes "neural" and "contradiction" into "not-entailment" to enable the inclusion of the DocNLI dataset. The base model is DeBERTa-v3-base from Microsoft. The v3 variant of DeBERTa substantially outperforms previous versions of the model by including a different…

Open weights mit 184M parameters 512 tokens transformers

Model · Text classification

ai-agent-sme-sentiment-mbert

Atsushi Hatakeyama

This is a three-class Japanese/English sentiment classifier for short hospitality reviews, fine-tuned from google-bert/bert-base-multilingual-cased. It categorizes each review as negative, neutral, or positive. The model predicts one overall label for a short Japanese or English hospitality It is intended for research, prototyping, and human-reviewed analytics. It must not be used as the sole basis for consequential business, employment, moderation, or customer-service decisions. Applications using this model should allow operators to review and correct its predictions. The model was fine-tuned on 480 synthetic bilingual reviews: 240 Japanese and 240 English, balanced across the three…

Open weights apache-2.0 178M parameters 512 tokens transformers

Model · Text classification

bert-base-multilingual-uncased-sentiment

NLP Town

Visit the NLP Town website for an updated version of this model, with a 40% error reduction on product reviews. This is a bert-base-multilingual-uncased model finetuned for sentiment analysis on product reviews in six languages: English, Dutch, German, French, Spanish, and Italian. It predicts the sentiment of the review as a number of stars (between 1 and 5). This model is intended for direct use as a sentiment analysis model for product reviews in any of the six languages above or for further finetuning on related sentiment analysis tasks. Here is the number of product reviews we used for finetuning the model: The fine-tuned model obtained the following accuracy on 5,000 held-out product…

Open weights mit 167M parameters 512 tokens transformers

Model · Text classification

pyrrho-v2-nano-g1

Yan Fitzner

Pyrrho is a CPU-runnable co-processor for retrieval-augmented generation. It reads a question before retrieval to suggest what evidence to seek, then reads the question with retrieved passages to assess whether those passages support an answer. A surrounding RAG runtime decides whether to answer, retrieve again, or surface a conflict. The broader project is described in the The evidence verdict is SUFFICIENT, DISPUTED, or INSUFFICIENT. These are predictions about the supplied passages. The model does not retrieve sources, generate answers or citations, check external facts, or prove that a corpus has been searched completely. The two passes use the same encoder with different input…

Open weights cc-by-nc-4.0 150M parameters 8,192 tokens transformers

Model · Text classification

groundcheck-modernbert

Pranshu Raj

A ~150M-parameter encoder that checks whether a RAG answer is supported by the source it was given. Given an answer and a source (and optionally the question), it returns grounded or hallucinated with P(grounded). It runs on CPU. - Every number below is traceable to a committed report in that repository. Hashes for every file are in the repository's MODELPROVENANCE.json. python -m eval.provenance --verify re-checks them. All measured on CPU against the pinned weights, using test sets rebuilt from pinned public datasets. F1 is for the hallucinated class, and the 95% CIs come from a 2,000-resample bootstrap. - 512 tokens reproduces the training run's published numbers (F1 0.6824, acc 0.7468…

Open weights mit 150M parameters 8,192 tokens transformers