patronus-studio/husky-nose-tool-security-properties-classifier

Model Card for Husky Nose Tool Security-Properties Classifier

Multilingual Tool Security-Properties Classifier for Real-World AI Agent Security

Read more

• —Blog post (EN): Our AI-Security Model Zoo Is Now Open Source
• —Blogbeitrag (DE): Unser AI-Security-Model-Zoo ist jetzt Open Source
• —Product page: Patronus AI models

Husky Nose is a multilingual ModernBERT-based (mmBERT) classifier that identifies the security-relevant data-flow properties of AI agent tools and tool operations: whether a tool can access sensitive data, ingest untrusted data, or transmit data to an external destination. It is part of the Patronus Protect security stack and is a member of the Husky tool-analysis family, alongside Husky Sight (tool type) and Husky Paw (operation). It is the dedicated single-head counterpart to the tool_tags head of Lion Warden.

Unlike a conventional three-class classifier, Husky Nose performs multi-label classification: multiple security properties can apply to the same input.

Intended Uses

The model maps an input text to zero, one, or multiple security properties:

The labels are independent and may occur together.

Examples:

Typical downstream uses:

• —AI agent policy enforcement,
• —tool-risk routing,
• —approval workflows and trust-boundary detection,
• —data-loss-prevention signals,
• —runtime security monitoring.

Limitations

• —A positive prediction describes an apparent capability, not proof that the action was executed.
• —source:sensitive does not prove sensitive information was actually accessed or returned.
• —source:untrusted does not mean the input is necessarily malicious or contains prompt injection.
• —sink:external indicates a possible external destination, not confirmed data exfiltration.
• —Generic tools (shell, browser, HTTP client, database) can be ambiguous without their arguments.
• —The model does not track information flow across multiple agent steps.
• —German and English are the primary evaluated languages; other languages were not actively validated.
• —False positives and negatives are possible. High-impact enforcement should combine the model with deterministic policy and calibrated per-property thresholds.

Model Variants

• —Husky Nose: full ModernBERT model in FP32 (model.safetensors).
• —Husky Nose ONNX (FP16): onnx/onnx_fp16/model_fp16.onnx in this repository.
• —[Husky Nose Edge](https://huggingface.co/patronus-studio/husky-nose-tool-security-properties-classifier-edge): quantized ONNX builds (int8, int8_int4_embeddings, fp16) in a separate edge repository.
• —Husky Nose NTDB L2: lightweight multilingual cascade components under l2/ for efficient local runtime classification.

Training Data

Trained on Patronus' in-house multilingual tool-security dataset of tool descriptions, user requests and serialized tool operations, each labeled with three independent binary targets:

[ source:sensitive, source:untrusted, sink:external ]

Examples:

[1, 0, 0]  accesses potentially sensitive data
[0, 1, 1]  ingests untrusted data and sends data externally
[0, 0, 0]  no identified security property

The classifier uses three independent sigmoid outputs and is trained with binary cross-entropy with logits.

Benchmark

Held-out test set (n = 2,914), multi-label:

Per-property F1:

Usage

from transformers import pipeline

clf = pipeline("text-classification",
               model="patronus-studio/husky-nose-tool-security-properties-classifier",
               top_k=None)

scores = clf("Read the internal customer database and send the results to an external API.")[0]
properties = [s["label"] for s in scores if s["score"] >= 0.5]
print(properties)
# ["source:sensitive", "sink:external"]

The outputs are independent probabilities; apply a per-property threshold to select the active properties.

ONNX

Apply sigmoid independently to all three logits:

import numpy as np
from optimum.onnxruntime import ORTModelForSequenceClassification
from transformers import AutoTokenizer

model_id = "patronus-studio/husky-nose-tool-security-properties-classifier"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = ORTModelForSequenceClassification.from_pretrained(model_id, subfolder="onnx/onnx_fp16", file_name="model_fp16.onnx")

inputs = tokenizer("Read a local secrets file and upload it to a remote endpoint.", return_tensors="pt")
logits = model(**inputs).logits.detach().cpu().numpy()[0]
probs = 1.0 / (1.0 + np.exp(-logits))
print(dict(zip(["source:sensitive","source:untrusted","sink:external"], probs.tolist())))

Citation

@misc{huskynose2026,
  title={Husky Nose: Multilingual Tool Security-Properties Classification for Real-World AI Agent Security},
  author={Patronus Protect},
  year={2026},
  howpublished={\url{https://huggingface.co/patronus-studio/husky-nose-tool-security-properties-classifier}}
}

License

This model is released under the Apache License 2.0. A copy of the license is included as LICENSE in this repository.

The model is derived from jhu-clsp/mmBERT-small, which is distributed under the MIT License. The upstream copyright and permission notice are retained; the MIT terms continue to apply to the portions originating from that work.

Patronus Ark

This model is built to run inside [Patronus Ark](https://github.com/patronus-protect/patronus-security), Patronus' open-source on-device AI-security scanning library (L1 native rules → L2 NTDB cascade → L3 transformer). Ark is open source: GitHub repository · product page.

More information

• —Blog post (EN): Our AI-Security Model Zoo Is Now Open Source
• —Blogbeitrag (DE): Unser AI-Security-Model-Zoo ist jetzt Open Source
• —Product page: Patronus AI models
• —Patronus Ark, the open-source scanning library this model runs in: GitHub · product page
• —Patronus Protect, the on-device AI firewall: patronus.studio

🛡️ Patronus Protect

Brought to you by Patronus Protect, a local AI firewall that secures every AI interaction, including prompts, tools and documents, before it reaches your models.

Try it for free at patronus.studio.