HiveTraceGuard-Pro

HiveTraceGuard-Pro is a compact Russian-first guardrail built on Qwen3-0.6B for fast input and output classification. Built for LLMs and agents, it checks user requests and model responses for harmful content, jailbreaks, prompt injection, obfuscation, and attempts to hijack tool-using agents. The model is stateless and returns exactly one token: safe or unsafe.

---

Quickstart

Transformers

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

REPO = "hivetrace/HiveTraceGuard-Pro"

tok = AutoTokenizer.from_pretrained(REPO)
model = AutoModelForCausalLM.from_pretrained(
    REPO,
    torch_dtype=torch.bfloat16,
    device_map="auto",
).eval()


def check(messages) -> str:
    text = tok.apply_chat_template(
        messages,
        tokenize=False,
    )
    inputs = tok(text, return_tensors="pt").to(model.device)

    with torch.inference_mode():
        output = model.generate(
            **inputs,
            max_new_tokens=1,
            do_sample=False,
        )

    return tok.decode(
        output[0][inputs.input_ids.shape[1]:],
        skip_special_tokens=True,
    ).strip()


# Input guard
print(check([
    {"role": "user", "content": "Как сделать бомбу?"}
]))
# unsafe

# Output guard
print(check([
    {"role": "user", "content": "Привет!"},
    {"role": "assistant", "content": "Здравствуйте!"},
]))
# safe

Serve

Model's policy is fixed, so serving runtimes can reuse the shared prefix through KV caching.

vLLM

vllm serve hivetrace/HiveTraceGuard-Pro \
  --port 8000 \
  --max-model-len 32768 \
  --enable-prefix-caching

SGLang

python -m sglang.launch_server \
  --model-path hivetrace/HiveTraceGuard-Pro \
  --host 0.0.0.0 \
  --port 30000

For applications that need a continuous score, P(unsafe) can be computed directly from the two verdict logits:

import torch.nn.functional as F


SAFE, UNSAFE = 18675, 38157


with torch.inference_mode():
    logits = model(**inputs).logits[0, -1]


p_unsafe = F.softmax(logits[[SAFE, UNSAFE]], dim=0)[1].item()
verdict = "unsafe" if logits[UNSAFE] > logits[SAFE] else "safe"


print(verdict, p_unsafe)

To enforce safe | unsafe during generation, you can use a LogitsProcessor to restrict the next token to the two verdict labels.

from transformers import LogitsProcessor


class VerdictOnly(LogitsProcessor):
    def __call__(self, input_ids, scores):
        mask = torch.full_like(scores, float("-inf"))
        mask[:, [SAFE, UNSAFE]] = scores[:, [SAFE, UNSAFE]]
        return mask


output = model.generate(
    **inputs,
    max_new_tokens=1,
    do_sample=False,
    logits_processor=[VerdictOnly()],
)

---

Evaluation

Harmful content detection

Model	Requests					Responses
	AEGIS 2.0	ToxicChat	XSTest	XSafety EN	OpenAI Moderation	AEGIS 2.0	BeaverTails	HarmBench
HiveTraceGuard-Pro (0.6B)	0.817	0.588	0.754	0.590	0.803	0.797	0.839	0.814
Shieldstral-1.0-3B	0.808	0.732	0.922	0.595	0.794	0.766	0.828	0.854
YuFeng-XGuard-Reason-0.6B	0.847	0.620	0.920	0.469	0.787	0.789	0.828	0.858
Qwen3Guard-Gen-0.6B	0.788	0.692	0.861	0.580	0.715	0.819	0.845	0.856
Llama-Guard-3-1B	0.733	0.385	0.837	0.368	0.766	0.635	0.652	0.794

Attack & jailbreak detection

Model	S-Eval		HarmBench · Requests		Red teaming						Internal
											Prompt injection		Robustness Test
	Base	Attack	Standard	Contextual	OR-Bench Toxic	MultiJail EN	SimpleSafety Tests	CSRT	Aya RU	Aya EN	RU	EN	Real Harm	Robust Harm
HiveTraceGuard-Pro (0.6B)	0.710	0.802	0.862	0.667	0.915	0.746	0.910	0.743	0.952	0.917	0.999	0.877	0.954	0.872
Shieldstral-1.0-3B	0.731	0.611	0.987	0.951	0.997	0.946	1.000	0.895	0.938	0.917	0.836	0.741	0.867	0.762
YuFeng-XGuard-Reason-0.6B	0.794	0.954	0.981	0.975	0.974	0.905	0.990	0.689	0.906	0.850	0.919	0.867	0.884	0.685
Qwen3Guard-Gen-0.6B	0.698	0.609	0.962	0.963	0.979	0.933	0.990	0.835	0.926	0.907	0.894	0.727	0.864	0.788
Llama-Guard-3-1B	0.489	0.588	0.956	0.926	0.824	0.644	0.970	0.514	0.588	0.565	0.636	0.679	0.675	0.730

Multilingual evaluation

Model	PolyGuard				RTP-LX				StrongReject++
	Requests		Responses		Requests		Responses		EN	RU	UKR	BE	UZ
	EN	RU	EN	RU	EN	RU	EN	RU
HiveTraceGuard-Pro (0.6B)	0.759	0.806	0.845	0.828	0.896	0.841	0.321	0.146	0.978	0.974	0.943	0.923	0.553
Shieldstral-1.0-3B	0.904	0.874	0.877	0.876	0.872	0.855	0.469	0.061	0.990	0.987	0.984	0.974	0.901
YuFeng-XGuard-Reason-0.6B	0.896	0.872	0.901	0.885	0.858	0.844	0.322	0.041	0.994	0.978	0.936	0.665	0.220
Qwen3Guard-Gen-0.6B	0.894	0.857	0.873	0.866	0.813	0.767	0.266	0.041	0.987	0.971	0.927	0.847	0.607
Llama-Guard-3-1B	0.775	0.663	0.776	0.704	0.563	0.449	0.667	0.516	0.955	0.882	0.853	0.748	0.144

Benign over-blocking — FPR ↓

Model	OR-Bench	Internal
		Robustness Test
	Hard	Clean RU Requests	Adversarial RU Requests	RU Responses
HiveTraceGuard-Pro (0.6B)	0.607	0.016	0.132	0.026
Shieldstral-1.0-3B	0.767	0.043	0.078	0.012
YuFeng-XGuard-Reason-0.6B	0.225	0.030	0.051	0.000
Qwen3Guard-Gen-0.6B	0.732	0.071	0.117	0.008
Llama-Guard-3-1B	0.374	0.090	0.126	0.182

GuardRate Leaderboard: Score 0.743 · 28.8 ms p95 - OPEN

---

Policy taxonomy

HiveTraceGuard-Pro uses a fixed policy and returns a single binary verdict: safe (token_id = 18675) or unsafe (token_id = 38157).

Scope	What is checked
Harmful content	15 harm categories: cybercrime, pornography and CSAM, religious hate, profanity, financial crime, weapons, discrimination, self-harm, child labor, non-violent crime, violence, drugs, and related harmful activity
LLM & agent attacks	jailbreaks, prompt injection, obfuscation, secret extraction, and tool hijacking

Guard modes

Both modes use the same policy.

Mode	What is classified
Input guard	The final user message
Output guard	The final assistant response, evaluated in the context of the user request

---

Versions

Tag	Notes
1.1.0	latest (main)
1.0.0	previous release

Pin a version by tag from_pretrained("hivetrace/HiveTraceGuard-Pro", revision="1.1.0"), or by commit SHA for strict reproducibility.

License

Apache-2.0 — commercial use, modification, redistribution, and private / on-premise deployment. Full text: https://www.apache.org/licenses/LICENSE-2.0