kontext-security/Merlin

Merlin

Merlin is a 70.8M-parameter local encoder that classifies a proposed AI-agent tool invocation as safe or unsafe using its surrounding context.

This repository contains the portable checkpoint. Use the reference package at <https://github.com/kontext-security/merlin>; a generic Transformers pipeline does not reproduce the benchmark because Merlin uses four independently budgeted fields, deterministic history normalization, and a validation-fitted calibrator.

Inputs

1. 1.user request
2. 2.prior interaction history
3. 3.current tool name and arguments
4. 4.tool descriptions/schemas

Prior ReAct history is converted to canonical JSON tool/argument/observation events. Thought and Final Answer text is excluded. The current action is reduced to tool name and arguments. Each field has its own token budget within a 512-token packed sequence.

Results

Strict binary evaluation on TS-Bench (0.0 safe; 0.5 and 1.0 unsafe), fixed 0.5 threshold:

The pooled score is dominated by ASB-Traj and is not evidence of uniform cross-environment performance. See the GitHub repository for the full protocol, preprocessing code, data provenance, system measurements, and limitations.

Training

• —Base: microsoft/deberta-v3-xsmall at revision 4b419818330868dff6a60ad3e6b1c730f8b8c0c6
• —Train: 2,192 examples (841 safe, 1,351 unsafe)
• —Validation: 789 examples
• —Epochs: 5; learning rate: 2e-5; batch size: 8; gradient accumulation: 2
• —Sigmoid calibration coefficient: 1.427213430140093
• —Sigmoid calibration intercept: 2.953687013257505
• —Default threshold: 0.5

Intended use

Use Merlin as a low-latency, local safety signal before executing an agent tool call. It is not a complete authorization layer and should be combined with least privilege, deterministic policy, sandboxing, and human confirmation for consequential actions.

Do not use it as the sole control for high-impact actions, as a general content moderator, or outside the documented input representation without evaluation.

Data and license

The base model is MIT licensed. Merlin was fine-tuned on TS-Bench data from <https://github.com/MurrayTom/ToolSafe>. That repository had no explicit repository license at release time, so the checkpoint is marked other and no raw TS-Bench examples are mirrored here. Review upstream terms before commercial use or redistribution. Reference code is Apache-2.0.