opena2a/nanomind-security-classifier-demo

NanoMind security classifier (inline NLM tier)

An interactive demo of the smallest, fastest tier of NanoMind: the on-device classifier that ships inside HackMyAgent. Paste an AI agent artifact (an MCP config, a SKILL.md, a SOUL.md, or a system-prompt snippet) and see the raw attack-pattern affinity it reads across 10 classes.

Model: `opena2a/nanomind-security-classifier` (0.5.0, Mamba TME, 8.3 MB ONNX). Runs on the free CPU tier. The Space loads the same published artifact HackMyAgent loads, and runs it on its own. It does not reproduce the pipeline HackMyAgent runs around the model, and its verdicts differ from the scanner's.

This is a raw signal, not a verdict

The classifier is a high-recall pre-filter. It was trained on attack data without hard-negative benign examples, so it keys off vocabulary and over-flags benign input (a plain "Hello, how are you today?" reads as an attack pattern at high confidence). It also errs in the other direction: a payload with no whitespace, such as one using zero-width or bidi-override characters, collapses to a single unknown token and reads benign. HackMyAgent catches those with a separate deterministic analyzer that this Space does not run. Both directions are why NanoMind has more than one tier.

In HackMyAgent this raw signal is never shown as a verdict. It is:

1. 1.run on sanitized content,
2. 2.corrected with benign-context rules (authorization language, negation lists, scoped paths, and so on override a raw malicious read), and
3. 3.escalated to the analyst tier (a Qwen3-1.7B reasoning model) for the actual security judgment.

This demo intentionally exposes the raw tier so its behavior, and the reason the analyst tier exists, are both visible. A public security classifier will be adversarially probed; that is welcome, and findings feed the corpus.

The full NanoMind model line

• —Collection: NanoMind AI agent security models
• —Classifier (this demo's model)
• —Analyst (the reasoning tier)
• —Analyst, MLX build (Metal-stable, Apple Silicon)

Apache-2.0. 10 attack classes: exfiltration, injection, privilegeescalation, persistence, credentialabuse, lateralmovement, socialengineering, policy_violation, benign, steganography.