---
license: apache-2.0
language:
- de
- en
base_model:
- patronus-studio/lion-warden-ai-security-classifier
pipeline_tag: text-classification
tags:
- multi-task
- prompt-injection
- threat-detection
- guardrails
- ai-agents
- security
- llm-security
- ai-safety
- ai-agent-security
- patronus
- multilingual
- modernbert
- onnx
- quantized
- edge
---

# Model Card for Lion Warden AI Security Classifier Edge

**Quantized ONNX builds of [Lion Warden AI Security Classifier](https://huggingface.co/patronus-studio/lion-warden-ai-security-classifier) for local / edge inference.**

This repository contains the size- and memory-optimized ONNX exports of the FP32 model. For
intended uses, class definitions, training data, benchmarks, and limitations, see the
[main model card](https://huggingface.co/patronus-studio/lion-warden-ai-security-classifier).

## Variants

| Variant | Path | Quantization |
| --- | --- | --- |
| FP16 | `onnx/fp16/model.onnx` | FP16 weights |
| INT8 | `onnx/int8/model.onnx` | Post-training dynamic INT8 (MatMul/Gemm) |
| INT8 + INT4 embeddings | `onnx/int8_int4_embeddings/model.onnx` | Dynamic INT8 plus 4-bit weight-only token embeddings |

The exact quantization parameters are recorded in `onnx/quantization_manifest.json`.

## Benchmark

Quantization parity for the v3 model, FP32 vs the recommended INT8+INT4-embeddings build
(per-head F1 over non-null labels, CPU). Quantization is near-lossless — max degradation
**0.005 F1** across all heads; FP16 and INT8 sit between FP32 and INT8+INT4.

| Head | FP32 F1 | INT8+INT4 F1 | Δ |
| --- | --- | --- | --- |
| injection | 0.948 | 0.943 | -0.005 |
| sensitive_document | 0.969 | 0.973 | +0.004 |
| tool_class | 0.952 | 0.953 | +0.001 |
| tool_action | 0.940 | 0.937 | -0.003 |
| tool_tags | 0.947 | 0.947 | 0.000 |
| routing | 0.897 | 0.901 | +0.004 |
| threat | 0.950 | 0.947 | -0.003 |

Sizes: FP16 281 MB · INT8 144 MB · **INT8+INT4 98 MB**. Measured CPU latency (batch 64):
~19 ms/text for the INT8+INT4 build.

Full details in `metrics/quant_bench.json`.

## Usage

The unified model has multiple output heads, so it is loaded with a plain ONNX Runtime session:

```python
import onnxruntime as ort
from huggingface_hub import hf_hub_download
from transformers import AutoTokenizer

model_id = "patronus-studio/lion-warden-ai-security-classifier-edge"
path = hf_hub_download(model_id, "onnx/int8_int4_embeddings/model.onnx")
session = ort.InferenceSession(path)
tokenizer = AutoTokenizer.from_pretrained(model_id)

enc = tokenizer("...", return_tensors="np")
names = [i.name for i in session.get_inputs()]
outputs = session.run(None, {k: v for k, v in enc.items() if k in names})
```

The output heads and their label spaces are documented in the main model card.

## License

Released under the [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0); the full
text is included as `LICENSE`. Derived from
[Lion Warden AI Security Classifier](https://huggingface.co/patronus-studio/lion-warden-ai-security-classifier) and ultimately from
[jhu-clsp/mmBERT-small](https://huggingface.co/jhu-clsp/mmBERT-small) (MIT License); upstream
notices are retained.

## Patronus Ark

This model is built to run inside **Patronus Ark**, Patronus' open-source on-device
AI-security scanning library (L1 native rules → L2 NTDB cascade → L3 transformer).
Ark is not publicly released yet — a repository link will be added here at launch.

---

## 🛡️ Patronus Protect

Brought to you by [Patronus Protect](https://patronus.studio) — a local AI firewall that
secures every AI interaction, including prompts, tools and documents, before it reaches
your models.

Try it for free at [patronus.studio](https://patronus.studio).