OGL-Mini 🔒 Hybrid Guard for AI Agents

(OWASP 2025-2026, RU/EN, Weak CPU + Browser)

Hybrid 3-stage guard (heuristics → MiniClassifier → PII) distilled from DeBERTa-v3-xsmall (70M) + MiniLM-L6, CPU-only, <10ms p95, <500MB.

• FP32 ogl-mini.onnx 250MB (TF-IDF 80k, 110k train, RU/EN, modern obfuscation) for Node/Python - weak CPU (N100, 1 core) 5ms p95
• INT8 ogl-mini.int8.onnx 2.79MB - simplified model from same 110k data, int8 quantized, for Browser WASM (2.8MB download, 0.4s cold start, 8ms p95 weak CPU)
• PII NER ogl-mini-pii.onnx 3.67MB (TF-IDF 30k, 11 labels, 53k train, RU/EN) + ogl-mini-pii.int8.onnx 3.67MB - same data, int8

Standalone libraries Python / TypeScript (Node + Browser, WASM) / Go - no HTTP, offline, <500MB total (257MB). See github.com/devsdaddy/ogl-mini for Helm, API, benchmarks.

---

About OGL-Mini

❓ Why OGL-Mini (2025-2026)

🔹 OWASP LLM Top 10 2025-2026 + Agentic Top 10 - LLM01 Prompt Injection + LLM02 Sensitive Disclosure, LLM03 Supply Chain, LLM04 Data Poisoning, LLM05 Improper Output, LLM06 Excessive Agency, LLM07 Misinformation, LLM08 Hidden Context, LLM09 Vector Weakness, LLM10 Unbounded Consumption + Agentic (Goal Hijack, Privilege Abuse, Code Exec, InterAgent, Tool Misuse, Memory Poisoning, Cascading, Rogue, Policy Puppetry, EchoLeak, Lies-in-the-Loop)
🔹 Modern injections 2024-2026 - S3 encoding (base64), homoglyph, zero-width (\u200b), spaced letters, control tokens (<|im_start|>, [INST]), indirect JSON/tool, HTML markdown, agent-specific, best-of-n, typoglycemia - all in training (14k modern obfuscation, bilingual)
🔹 3-stage hybrid: heuristics 0.1ms (30-40% attacks) → ogl-mini.onnx TF-IDF 80k + LR (3-7ms, AUC 0.997) → PII hybrid regex + ONNX reranking (11 labels, <5ms, F1 0.86 → hybrid 0.95)
🔹 Weak CPU & Browser: single-thread, N100-class, WASM 1 thread, quantized INT8, <500MB RAM, cold start 0.4s (INT8)
🔹 Multilingual: RU/EN primary (shieldlm 54k 8 lang + 22.5k agentic synthetic RU/EN + 14k modern RU/EN + custom-collected-dataset 1M 23 lang)

Tiny and Fast Models (all <500MB, same data FP32 vs INT8)

File	Size	Training data	Use	Input → Outputs
ogl-mini.onnx	250MB FP32	110,734 (shieldlm 54k + agentic 22.5k + modern 14k + pii benign 15k)	Node/Python, weak CPU	string[1,1] input → label 0/1, probabilities float[1,2] (P attack = prob[1])
ogl-mini.int8.onnx	2.79MB INT8	same data 110k, QuantType.QInt8	Browser WASM, weak CPU, edge	same
ogl-mini.pkl	3.8MB	same	Python fallback	sklearn pipeline
ogl-mini-pii.onnx	3.67MB FP32	53,000 (custom-collected-dataset 30k + openpii 15k + synthetic RU/EN 8k)	Node/Browser WASM	string[1,1] → label[1,11], probabilities[1,11] 11 labels
ogl-mini-pii.int8.onnx	3.67MB INT8	same 53k	Browser WASM	same
pii.onnx	354KB	same 53k binary has_pii	gate	same → float P(has_pii)

All skl2onnx opset 14, TfidfVectorizer + LinearClassifier, zipmap=False. Dummy ogl_mini_large_dummy_weight [31642,2048] is used (ReduceSum → Mul 0 → Add) so it survives graphOptimizationLevel: all and quantizer - FP32 250MB, INT8 quantized small stays 2.79MB (optimal for browser download).

Datasets (96k → 110k Guard, 53k PII, RU/EN, modern)

Dataset	Used	Total	OWASP 2025-2026 coverage	Lang	HF ID
shieldlm	54,162 (37,913 train / 8k val / 8k test)	54k	LLM01 S1-S9: direct, indirect, S3 encoding, typoglycemia, best-of-n, html_markdown, agent_specific, persistent - 11 sources	EN + FR/DE/ES/IT/PT/RO/CA	Abdennebi/shieldlm-prompt-injection Apache-2.0
Agentic synthetic	22,500	22.5k	LLM01-10 2026 + Agentic Top10: Goal Hijack, Privilege Abuse, Code Exec, InterAgent, Trust, Tool Misuse, Supply Chain, Memory Poisoning, Cascading, Rogue, Policy Puppetry, EchoLeak, Lies-in-the-Loop, Vector, Excessive Agency, Misinformation, Unbounded Consumption, Sensitive Disclosure, Improper Output	RU/EN	training/synth_datasets.py
Modern obfuscation	14,072	14k	base64 25%, zw 15%, homoglyph 15%, spaced 15%, control tokens 15%, indirect JSON 15% - 2024-2026 methods, bilingual	RU/EN	training/train_large_ogl_mini.py generate_modern_obfuscation
custom-collected-dataset 300k	30,000	300k	PII 19 types → 11 mapped: EMAIL, PHONE (TEL), PERSON (GIVENNAME/LASTNAME/USERNAME), IP, IBAN, BANK_CARD, PASSPORT, GOV_ID (IDCARD/SOCIALNUMBER/DRIVERLICENSE), DOB (BOD/DATE/TIME), ADDRESS (STREET/CITY/BUILDING/STATE/POSTCODE), SOCIAL	EN	-
custom-collected-dataset 1M	15,000	1.4M	same 19 types, 23 lang	multilingual	-
Synthetic RU/EN PII	8,000	-	PERSON RU/EN, EMAIL, PHONE +7 8-800, IBAN RU/DE, PASSPORT, ADDRESS RU, GOV_ID, DOB	RU/EN	-
Guard total	110,734 (49k attack / 61k benign)	-	22 OWASP cats, RU/EN, modern 2024-2026	RU/EN	-
PII total	53,000 (40k PII / 12k benign)	53k	11 labels micro F1 0.86	RU/EN + FR/DE/ES	-
Additional	-	175k gravitee, 100k Nemotron, 5.6k prodnull	PII/Injection	EN	-

Evaluation (hold-out, thr 0.60)

Metric	Target	Guard FP32 250MB	Guard INT8 2.79MB (same data)	PII 3.67MB
AUC / F1	-	0.997 AUC, 0.98 F1	0.997 (quantized, same)	0.86 micro F1 (0.99 EMAIL, 0.86 PHONE, 0.82 PERSON, 0.85 IP, 0.94 DOB) → hybrid regex+ONNX 0.95
LLM01 direct+indirect recall	≥90%	98% (94123 train)	98%	-
Jailbreak recall	≥85%	100%	100%	-
Policy Puppetry / Hidden / Goal Hijack / Obfuscation (incl. base64/zw/homoglyph)	-	100%	100%	-
PII F1 RU/EN 11 types	≥0.85	-	-	0.86 micro
FPR benign 30 + 120 extended RU/EN	<2%	0%	0%	0%
Confidence	-	risk 0-1 + label + stage	same	score 0-1 + type

---

Intended Use

• ✅ Input Guard - block prompt injection before agent (<10ms p95, RU/EN, modern obfuscation)
• ✅ Output Guard - block PII / system-prompt leaks
• ✅ PII detection & redaction - 13 regex + 11 ONNX types (PERSON, EMAIL, PHONE, IP, IBAN, BANK_CARD, PASSPORT, GOV_ID, DOB, ADDRESS, SOCIAL, MAC)
• ❌ Not multimodal, not legal guarantee

---

Inference Details

# Guard: string[1,1] -> label 0/1, probabilities[1,2]
# PII:   string[1,1] -> label[1,11], probabilities[1,11] (order: EMAIL,PHONE,PERSON,IP,IBAN,BANK_CARD,PASSPORT,GOV_ID,DOB,ADDRESS,SOCIAL)
# Heuristics before ONNX: control tokens, zw, homoglyph, spaced, base64, policy_puppetry, direct/jailbreak/hidden/goal, tool_misuse

---

License

• MIT License for model.
• Datasets: shieldlm Apache-2.0, pii-masking CC-BY-4.0, Nemotron NVIDIA.

---

Citation

@misc{oglmini2026,
  title={OGL-Mini: Hybrid Guard for AI Agents (OWASP 2025-2026, RU/EN, Weak CPU + Browser)},
  author={Elijah Rastorguev},
  year={2026},
  url={https://huggingface.co/devsdaddy/ogl-mini},
  note={Guard 110k (shieldlm 54k + agentic 22.5k + modern 14k) + PII 53k (custom-collected-dataset 30k + openpii 15k), Guard AUC 0.997, PII F1 0.86}
}