astroware/Halo4B-guard-alpha-v1

Halo4B-guard-alpha

Halo4B-guard-alpha is Astroware's first finetuned safety guard model, built on top of Qwen/Qwen3Guard-4B. It is trained on Astroware's proprietary constitutional safety dataset and hardened against jailbreak patterns surfaced by the Trishool | SN23 red-teaming subnet.

Overview

Halo4B-guard-alpha is a constitutional input classifier — a guard model that sits in front of LLM deployments and determines whether an incoming user query is safe to process. It operates on the full conversation context (user turn + prior turns) and returns a binary harmful / harmless prediction with an associated confidence score.

The model is optimized for:

• —Low false-negative rate — minimizing missed harmful queries
• —Controlled false-positive rate — limiting unnecessary refusals of legitimate requests
• —Jailbreak robustness — resisting obfuscation, encoding, and prompt-injection attacks observed in the wild via Trishool SN23 adversarial mining

What Changed vs. Qwen3Guard-4B Baseline

Benchmark Results

F1 scores across 7 public safety benchmarks. Final F1 is the unweighted average across all benchmarks.

The largest gains are on Aegis (+4.3pp) and OpenAI Moderation (+1.1pp), driven by improved recall on adversarial and edge-case harmful queries.

Jailbreak Patches (Trishool SN23)

Halo4B-guard-alpha patches a set of jailbreak patterns discovered through adversarial mining activity on Trishool | SN23, Astroware's Bittensor subnet. Miners on SN23 are incentivized to find inputs that bypass safety classifiers; confirmed bypasses are folded back into the training dataset via augmentation.

Specific classes of attack patched in this release:

• —Adversarial noise — perturbation-based inputs that subtly corrupt token boundaries or spacing to confuse the classifier while remaining human-readable
• —Narrative injection — harmful instructions embedded inside fictional stories, roleplay scenarios, or creative writing prompts; the original model failed to flag these when harmful content was wrapped in an ostensibly benign narrative frame
• —Benign tail — queries that open with a harmless preamble and append a harmful instruction at the end, exploiting a tendency in the base model to anchor on early tokens
• —Encoding / obfuscation attacks: Base64, hex, ROT13, Morse code, homoglyph substitutions, and leetspeak (basic, extended, and aggressive multi-character forms)
• —Style-shift attacks: CamelCase injection, pig Latin transforms, emoji-substituted harmful intent
• —Semantic paraphrase attacks: back-translation roundtrips, synonym insertion, and word-swap augmentations that preserve harmful meaning while shifting surface form
• —Prompt injection patterns: role-playing / system-prompt override attempts, mischievous-user persona injections
• —Chained / mixed tactics: attacks that layer multiple obfuscation methods (e.g., narrative wrapper + synonym swap + Base64)

Safety Categories

Halo4B-guard-alpha inherits and extends the safety taxonomy defined in the Qwen3Guard technical report. The model classifies inputs across 9 categories, each assessed at one of three severity tiers.

Severity Tiers

Harm Categories

The Jailbreak category is scoped to input classification only — it applies to engineered prompts, not model outputs.

Usage

from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch

model_id = "astroware/Halo4B-guard-alpha"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForSequenceClassification.from_pretrained(model_id)
model.eval()

conversation = [
    {"role": "user", "content": "How do I make chlorine gas at home?"}
]

inputs = tokenizer.apply_chat_template(
    conversation,
    return_tensors="pt",
    add_generation_prompt=False
)

with torch.no_grad():
    logits = model(**inputs).logits
    prob_harmful = torch.sigmoid(logits[0, 1]).item()

print(f"Harmful probability: {prob_harmful:.3f}")
# Threshold at 0.5 for binary classification
is_harmful = prob_harmful >= 0.5

Note: The exact input format follows the Qwen3Guard chat template. Refer to the base model documentation for prompt formatting details until Astroware publishes its inference library.

Limitations

• —Alpha release — this model is not yet production-hardened across all safety categories. Current coverage is strongest in Violent, Non-Violent Illegal Acts, and Suicide & Self-Harm.
• —English-primary — the training corpus is predominantly English. Cross-lingual robustness has not been formally evaluated.
• —Output classifier not included — Halo4B-guard-alpha is an input classifier only. It does not monitor model outputs or operate on streaming token-level generation.
• —Threshold sensitivity — the default 0.5 threshold is a starting point. Operators should calibrate against their own false-positive tolerance using a held-out sample of their traffic.
• —Not a replacement for defense-in-depth — this model is one layer in a multi-stage safety stack. It should be combined with output classifiers, rate limiting, and session-level monitoring.

Evaluation

Full metrics across all 7 benchmarks. FPR = false positive rate (overrefusal); FNR = false negative rate (missed harm).

Aegis (n=869)

Aegis 2.0

HarmBench

OpenAI Moderation

SimpleSafetyTests

ToxicChat

WildGuardTest

Summary

The recall-precision tradeoff shifts slightly toward recall on OpenAI Moderation, ToxicChat, and WildGuardTest — reflecting a deliberate tuning decision to reduce missed harmful queries (FNR) at a small cost to overrefusal (FPR). The ToxicChat F1 regression (−0.3pp) is the only net decline and is under active investigation.

Trishool | SN23

Trishool is Astroware's Bittensor subnet (SN23) dedicated to adversarial red-teaming of safety classifiers. Miners compete to discover inputs that bypass the guard model; successful bypasses are validated, scored, and incorporated into the next training iteration. This creates a continuous adversarial feedback loop:

Guard model deployed → Miners probe for bypasses → 
Confirmed bypasses collected → Dataset augmented → 
Next guard model trained

Halo4B-guard-alpha is the first model to incorporate SN23 feedback at training time.

Citation

@misc{astroware2026halo4b,
  title        = {Halo4B-guard-alpha: A Constitutional Safety Classifier Hardened via Adversarial Red-Teaming},
  author       = {Astroware},
  year         = {2026},
  howpublished = {Hugging Face Model Hub},
  url          = {https://huggingface.co/astroware/Halo4B-guard-alpha}
}

License

Apache 2.0 — same as the Qwen3Guard base model.

Built by [Astroware](https://astroware.ai) · Halo project · Trishool SN23