stackone-defender 0.9.2__tar.gz → 0.9.3__tar.gz

stackone_defender-0.9.3/.release-please-manifest.json

@@ -0,0 +1 @@
+{".":"0.9.3"}

{stackone_defender-0.9.2 → stackone_defender-0.9.3}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.9.3](https://github.com/StackOneHQ/defender-py/compare/stackone-defender-v0.9.2...stackone-defender-v0.9.3) (2026-10-20)
+
+
+### Bug Fixes
+
+* **ENG-3282:** swap the Tier-2 model and recalibrate its threshold ([#44](https://github.com/StackOneHQ/defender-py/issues/44)) ([5fd8f87](https://github.com/StackOneHQ/defender-py/commit/5fd8f8748bcc72a42324b5fba09d90465b062135))
+
 ## [0.9.2](https://github.com/StackOneHQ/defender-py/compare/stackone-defender-v0.9.1...stackone-defender-v0.9.2) (2026-10-20)
 
 

{stackone_defender-0.9.2 → stackone_defender-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stackone-defender
-Version: 0.9.2
+Version: 0.9.3
 Summary: Indirect prompt injection defense for AI agents using tool calls
 Project-URL: Homepage, https://defender.stackone.com/?utm_source=pypi&utm_medium=listing&utm_campaign=homepage
 Project-URL: Repository, https://github.com/StackOneHQ/defender-py
@@ -49,7 +49,7 @@ Description-Content-Type: text/markdown
     <img src="https://img.shields.io/badge/model-22MB-047B43?style=flat-square" alt="Model size: 22MB" />
     <img src="https://img.shields.io/badge/latency-~10ms-047B43?style=flat-square" alt="Latency: ~10ms" />
     <img src="https://img.shields.io/badge/CPU--only-no%20GPU%20needed-047B43?style=flat-square" alt="CPU only" />
-    <img src="https://img.shields.io/badge/F1%20Score-90.8%25-047B43?style=flat-square" alt="F1 Score: 90.8%" />
+    <img src="https://img.shields.io/badge/F1%20Score-86.5%25-047B43?style=flat-square" alt="F1 Score: 86.5%" />
   </p>
 
 </div>
@@ -142,8 +142,9 @@ Packed-chunk MiniLM classifier (int8 ONNX ~22 MB, bundled):
 - Split text into sentences, pack to model-sized chunks, score chunks in batched ONNX calls
 - Catches paraphrased or novel injections missed by regex
 - Uses chunked batch inference to bound memory on large payloads
-- The bundled model is multi-head. Its auxiliary head flags meta-discussion and documentation that quotes injection text. Turn the multi-head rule on with `tier2_config={"multihead": MultiheadConfig(main_threshold=..., aux_threshold=...)}`: a chunk then blocks only when its main score >= `main_threshold` and its aux score < `aux_threshold`. The result reports `tier2_aux_score` and `tier2_multihead_blocked`.
-- The bundled model carries calibrated defaults in its `classifier_config.json` (`high_risk_threshold` 0.64 at temperature 2.41). They override library defaults when the model loads.
+- The bundled model is multi-head (variant `jbv2-mh-grid-agpjb2pinstr-s2` since 0.9.3; it still lives in the `minilm-multihead-v5` folder so existing paths keep working). Its auxiliary head flags meta-discussion and documentation that quotes injection text.
+- The bundled model carries calibrated defaults in its `classifier_config.json` (`high_risk_threshold` 0.52 at temperature 2.41). They override library defaults when the model loads. Thresholds are model-specific: 0.64 was right for the previous model, not this one.
+- Multi-head mode is off by default; Tier 2 then rates a chunk high at `high_risk_threshold` (blocking also needs `block_high_risk=True`). To turn it on, pass a preset as `tier2_config={"multihead": MultiheadConfig(main_threshold=..., aux_threshold=...)}`: a chunk then blocks when its main score >= `main_threshold` and its aux score < `aux_threshold`, and the result reports `tier2_aux_score` and `tier2_multihead_blocked`. Presets tuned for this model: High 0.77/0.325, Medium 0.88/0.325, Low 0.94/0.30. They're also in `classifier_config.json` under `multihead_presets`, but defender doesn't load them for you.
 
 ### Optional SFE preprocessor
 
@@ -152,14 +153,16 @@ Packed-chunk MiniLM classifier (int8 ONNX ~22 MB, bundled):
 - **Tier 2** extracts strings from the SFE-filtered tree; `fields_dropped` lists paths omitted from that extraction (not removed from `sanitized`)
 - Fails open if the runtime/model is unavailable: payload continues unfiltered
 
-**Benchmarks** (F1 @ threshold 0.5):
+**Benchmarks** (Tier 2 only, through the package pipeline at the default threshold 0.52; measured 2026-10-20):
 
-| Benchmark | F1 | Samples |
-|-----------|-----|--------|
-| Qualifire (in-distribution) | 0.8686 | ~1.5k |
-| xxz224 (out-of-distribution) | 0.8834 | ~22.5k |
-| jayavibhav (adversarial) | 0.9717 | ~1k |
-| **Average** | **0.9079** | ~25k |
+| Benchmark | F1 | Precision | Recall | Samples |
+|-----------|-----|-----------|--------|---------|
+| Qualifire (held-out test split; the dataset's train split is used in training) | 0.828 | 0.857 | 0.800 | 751 |
+| xxz224 (out-of-distribution) | 0.814 | 0.989 | 0.691 | ~22.5k |
+| jayavibhav (unseen rows; other rows of this split are used in training) | 0.955 | 0.960 | 0.950 | ~60k |
+| **Average** | **0.865** | | | |
+
+The previous model scores 0.843 on the same sets and method. Earlier READMEs showed 0.908 from a different method (raw scores, best threshold picked per dataset), which isn't comparable. Latency is about 10 ms per call (p50 on a 2-vCPU container, short inputs); long inputs that split into several chunks take longer.
 
 ### Optional Tier 3 — LLM adjudication (bring your own LLM)
 
@@ -269,7 +272,7 @@ A failed chunk is skipped (fail open), and `result.tier3.errored` and `coverage_
 | Option | Default | What it does |
 |---|---|---|
 | `allow_override` | `True` | Cascade: whether a Tier-3 `allow` can undo a Tier-2 block. `False`: Tier 3 only adds blocks. `{"max_tier2_score": x}`: only when Tier 2's undamped score is below `x`. A general-purpose LLM can be talked into `allow`, so prefer `False` or a cap. Defender warns once when it's `True` with a provider from `create_llm_tier3_provider` or `create_openai_compatible_tier3_provider`. |
-| `on_error` | cascade `"tier2"`, tier3_only `"allow"` | What a failure (error, timeout, invalid verdict) does. `"tier2"` keeps Tier 2's verdict. `"allow"` treats it as an allow. `"block"` blocks: in cascade when Tier 2 rated the payload medium or higher; in tier3_only when any chunk failed (and `on_oversize` then defaults to `"scan_anyway"`). A missing provider fails closed too. `"tier2"` isn't valid in tier3_only: defender warns and uses `"allow"`. |
+| `on_error` | cascade `"tier2"`, tier3_only `"allow"` | What a failure (error, timeout, invalid verdict) does. `"tier2"` keeps Tier 2's verdict. `"allow"` treats it as an allow. `"block"` blocks: in cascade when Tier 2 rated the payload medium or higher (with the bundled model Tier 2 rarely reports `medium`: its band is [0.5, 0.52)); in tier3_only when any chunk failed (and `on_oversize` then defaults to `"scan_anyway"`). A missing provider fails closed too. `"tier2"` isn't valid in tier3_only: defender warns and uses `"allow"`. |
 | `decide` | none | `decide(Tier3DecisionInput) -> "block" \| "allow" \| "default"`, called once per call after Tier 3 ran or failed. Replaces `allow_override` and `on_error` for that call. Gets metadata only (never content). Must be synchronous. A raise or bad return means `"default"`. It can't undo a Tier 1 detection, override `on_oversize`, or block when `block_high_risk=False`. |
 | `timeout_ms` | none | Per provider call, from when it gets a concurrency slot. An async provider is cancelled at the deadline (`ctx["deadline"]`); a sync one can't be interrupted. |
 | `max_concurrency` | unbounded | Max in-flight provider calls per instance, per event loop. Each sync `defend_tool_result` call runs its own loop, so the cap doesn't span threads that use the sync API. Set `timeout_ms` with it. |
@@ -314,7 +317,7 @@ defense = create_prompt_defense(
     annotate_boundary=False,  # True: wrap risky strings with [UD-…] tags (npm: annotateBoundary)
     sanitize_content=True,  # False: detect-and-gate; sanitized is the input verbatim
     tier2_fields=["subject", "body", "snippet"],  # optional: scope Tier 2 to these JSON keys (default: all strings)
-    tier2_config={"high_risk_threshold": 0.64},  # optional; defaults come from the bundled model's classifier_config.json
+    tier2_config={"high_risk_threshold": 0.52},  # optional; defaults come from the bundled model's classifier_config.json
     use_sfe=False,  # True, or {"threshold": 0.5, "predictor": ...}: SFE preprocessing before Tier 2
     enable_tier3=False,
     defender_mode="cascade",  # or "tier3_only"; ignored unless enable_tier3

{stackone_defender-0.9.2 → stackone_defender-0.9.3}/README.md

@@ -19,7 +19,7 @@
     <img src="https://img.shields.io/badge/model-22MB-047B43?style=flat-square" alt="Model size: 22MB" />
     <img src="https://img.shields.io/badge/latency-~10ms-047B43?style=flat-square" alt="Latency: ~10ms" />
     <img src="https://img.shields.io/badge/CPU--only-no%20GPU%20needed-047B43?style=flat-square" alt="CPU only" />
-    <img src="https://img.shields.io/badge/F1%20Score-90.8%25-047B43?style=flat-square" alt="F1 Score: 90.8%" />
+    <img src="https://img.shields.io/badge/F1%20Score-86.5%25-047B43?style=flat-square" alt="F1 Score: 86.5%" />
   </p>
 
 </div>
@@ -112,8 +112,9 @@ Packed-chunk MiniLM classifier (int8 ONNX ~22 MB, bundled):
 - Split text into sentences, pack to model-sized chunks, score chunks in batched ONNX calls
 - Catches paraphrased or novel injections missed by regex
 - Uses chunked batch inference to bound memory on large payloads
-- The bundled model is multi-head. Its auxiliary head flags meta-discussion and documentation that quotes injection text. Turn the multi-head rule on with `tier2_config={"multihead": MultiheadConfig(main_threshold=..., aux_threshold=...)}`: a chunk then blocks only when its main score >= `main_threshold` and its aux score < `aux_threshold`. The result reports `tier2_aux_score` and `tier2_multihead_blocked`.
-- The bundled model carries calibrated defaults in its `classifier_config.json` (`high_risk_threshold` 0.64 at temperature 2.41). They override library defaults when the model loads.
+- The bundled model is multi-head (variant `jbv2-mh-grid-agpjb2pinstr-s2` since 0.9.3; it still lives in the `minilm-multihead-v5` folder so existing paths keep working). Its auxiliary head flags meta-discussion and documentation that quotes injection text.
+- The bundled model carries calibrated defaults in its `classifier_config.json` (`high_risk_threshold` 0.52 at temperature 2.41). They override library defaults when the model loads. Thresholds are model-specific: 0.64 was right for the previous model, not this one.
+- Multi-head mode is off by default; Tier 2 then rates a chunk high at `high_risk_threshold` (blocking also needs `block_high_risk=True`). To turn it on, pass a preset as `tier2_config={"multihead": MultiheadConfig(main_threshold=..., aux_threshold=...)}`: a chunk then blocks when its main score >= `main_threshold` and its aux score < `aux_threshold`, and the result reports `tier2_aux_score` and `tier2_multihead_blocked`. Presets tuned for this model: High 0.77/0.325, Medium 0.88/0.325, Low 0.94/0.30. They're also in `classifier_config.json` under `multihead_presets`, but defender doesn't load them for you.
 
 ### Optional SFE preprocessor
 
@@ -122,14 +123,16 @@ Packed-chunk MiniLM classifier (int8 ONNX ~22 MB, bundled):
 - **Tier 2** extracts strings from the SFE-filtered tree; `fields_dropped` lists paths omitted from that extraction (not removed from `sanitized`)
 - Fails open if the runtime/model is unavailable: payload continues unfiltered
 
-**Benchmarks** (F1 @ threshold 0.5):
+**Benchmarks** (Tier 2 only, through the package pipeline at the default threshold 0.52; measured 2026-10-20):
 
-| Benchmark | F1 | Samples |
-|-----------|-----|--------|
-| Qualifire (in-distribution) | 0.8686 | ~1.5k |
-| xxz224 (out-of-distribution) | 0.8834 | ~22.5k |
-| jayavibhav (adversarial) | 0.9717 | ~1k |
-| **Average** | **0.9079** | ~25k |
+| Benchmark | F1 | Precision | Recall | Samples |
+|-----------|-----|-----------|--------|---------|
+| Qualifire (held-out test split; the dataset's train split is used in training) | 0.828 | 0.857 | 0.800 | 751 |
+| xxz224 (out-of-distribution) | 0.814 | 0.989 | 0.691 | ~22.5k |
+| jayavibhav (unseen rows; other rows of this split are used in training) | 0.955 | 0.960 | 0.950 | ~60k |
+| **Average** | **0.865** | | | |
+
+The previous model scores 0.843 on the same sets and method. Earlier READMEs showed 0.908 from a different method (raw scores, best threshold picked per dataset), which isn't comparable. Latency is about 10 ms per call (p50 on a 2-vCPU container, short inputs); long inputs that split into several chunks take longer.
 
 ### Optional Tier 3 — LLM adjudication (bring your own LLM)
 
@@ -239,7 +242,7 @@ A failed chunk is skipped (fail open), and `result.tier3.errored` and `coverage_
 | Option | Default | What it does |
 |---|---|---|
 | `allow_override` | `True` | Cascade: whether a Tier-3 `allow` can undo a Tier-2 block. `False`: Tier 3 only adds blocks. `{"max_tier2_score": x}`: only when Tier 2's undamped score is below `x`. A general-purpose LLM can be talked into `allow`, so prefer `False` or a cap. Defender warns once when it's `True` with a provider from `create_llm_tier3_provider` or `create_openai_compatible_tier3_provider`. |
-| `on_error` | cascade `"tier2"`, tier3_only `"allow"` | What a failure (error, timeout, invalid verdict) does. `"tier2"` keeps Tier 2's verdict. `"allow"` treats it as an allow. `"block"` blocks: in cascade when Tier 2 rated the payload medium or higher; in tier3_only when any chunk failed (and `on_oversize` then defaults to `"scan_anyway"`). A missing provider fails closed too. `"tier2"` isn't valid in tier3_only: defender warns and uses `"allow"`. |
+| `on_error` | cascade `"tier2"`, tier3_only `"allow"` | What a failure (error, timeout, invalid verdict) does. `"tier2"` keeps Tier 2's verdict. `"allow"` treats it as an allow. `"block"` blocks: in cascade when Tier 2 rated the payload medium or higher (with the bundled model Tier 2 rarely reports `medium`: its band is [0.5, 0.52)); in tier3_only when any chunk failed (and `on_oversize` then defaults to `"scan_anyway"`). A missing provider fails closed too. `"tier2"` isn't valid in tier3_only: defender warns and uses `"allow"`. |
 | `decide` | none | `decide(Tier3DecisionInput) -> "block" \| "allow" \| "default"`, called once per call after Tier 3 ran or failed. Replaces `allow_override` and `on_error` for that call. Gets metadata only (never content). Must be synchronous. A raise or bad return means `"default"`. It can't undo a Tier 1 detection, override `on_oversize`, or block when `block_high_risk=False`. |
 | `timeout_ms` | none | Per provider call, from when it gets a concurrency slot. An async provider is cancelled at the deadline (`ctx["deadline"]`); a sync one can't be interrupted. |
 | `max_concurrency` | unbounded | Max in-flight provider calls per instance, per event loop. Each sync `defend_tool_result` call runs its own loop, so the cap doesn't span threads that use the sync API. Set `timeout_ms` with it. |
@@ -284,7 +287,7 @@ defense = create_prompt_defense(
     annotate_boundary=False,  # True: wrap risky strings with [UD-…] tags (npm: annotateBoundary)
     sanitize_content=True,  # False: detect-and-gate; sanitized is the input verbatim
     tier2_fields=["subject", "body", "snippet"],  # optional: scope Tier 2 to these JSON keys (default: all strings)
-    tier2_config={"high_risk_threshold": 0.64},  # optional; defaults come from the bundled model's classifier_config.json
+    tier2_config={"high_risk_threshold": 0.52},  # optional; defaults come from the bundled model's classifier_config.json
     use_sfe=False,  # True, or {"threshold": 0.5, "predictor": ...}: SFE preprocessing before Tier 2
     enable_tier3=False,
     defender_mode="cascade",  # or "tier3_only"; ignored unless enable_tier3

{stackone_defender-0.9.2 → stackone_defender-0.9.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stackone-defender"
-version = "0.9.2"
+version = "0.9.3"
 description = "Indirect prompt injection defense for AI agents using tool calls"
 readme = "README.md"
 requires-python = ">=3.11"

stackone_defender-0.9.3/src/stackone_defender/models/minilm-multihead-v5/classifier_config.json

@@ -0,0 +1,75 @@
+{
+  "model_id": "sentence-transformers/all-MiniLM-L6-v2",
+  "model_type": "minilm",
+  "use_seq_clf": false,
+  "hidden_size": 384,
+  "freeze_layers": 4,
+  "pooling": "mean",
+  "optimal_threshold": 0.15,
+  "datasets": [
+    "qualifire",
+    "jayavibhav",
+    "agentdojo",
+    "jasperls",
+    "jailbreakbench",
+    "toxic-chat",
+    "chatgpt-jailbreaks",
+    "email-hardneg",
+    "email-hardneg-gen",
+    "multilingual-hardneg",
+    "jailbreakbench-neg",
+    "toxic-chat-neg",
+    "fujitsu-injecagent",
+    "fujitsu-rag",
+    "enron-ham",
+    "connector-hardneg-v2",
+    "dev-tooling-hardneg-curated",
+    "dev-tooling-attacks",
+    "agentshield-shape-attacks",
+    "system-prompt-extraction-attacks",
+    "emoji-ci-benign",
+    "benign-user-queries",
+    "code-docs-benign"
+  ],
+  "token_level": false,
+  "token_pool": "max",
+  "token_topk": 5,
+  "three_class": false,
+  "multi_head": true,
+  "aux_loss_alpha": 0.5,
+  "extra_benchmarks": [
+    "hd-negatives-v1",
+    "hd-pairs-v1",
+    "hd-negatives-v2",
+    "hd-pairs-v2",
+    "hd-negatives-v4",
+    "hd-pairs-v4",
+    "hd-short-v1",
+    "hd-negatives-v5",
+    "hd-pairs-v5",
+    "hd-pairs-agent-v1"
+  ],
+  "variant": "jbv2-mh-grid-agpjb2pinstr-s2",
+  "calibration": {
+    "temperatureT": 2.41,
+    "highRiskThreshold": 0.52,
+    "ece": 0.09,
+    "fitted_on": "labeled plugin events 2026-05-13",
+    "notes": "tier2Score is the calibrated probability sigmoid(logit/T) at T=2.41. highRiskThreshold 0.52 is the single-head operating point for this model, chosen to match the shipped false-positive rate (v5 used 0.64). Do not reuse 0.64 with this model."
+  },
+  "multihead_presets": {
+    "High": {
+      "mainThreshold": 0.77,
+      "auxThreshold": 0.325
+    },
+    "Medium": {
+      "mainThreshold": 0.88,
+      "auxThreshold": 0.325
+    },
+    "Low": {
+      "mainThreshold": 0.94,
+      "auxThreshold": 0.3
+    },
+    "notes": "Tuned 2026-10-14 for this model only (docs/2026-09-30-tier2-prompt-injection-identifiability.md, release gate 1). Do not reuse for another model."
+  }
+}

stackone_defender-0.9.3/tests/conformance/VERSION

@@ -0,0 +1 @@
+defender-v0.9.3

{stackone_defender-0.9.2 → stackone_defender-0.9.3}/tests/conformance/tier3-policy.json

@@ -1737,6 +1737,37 @@
 				"coverageDegraded": false,
 				"judgeCalls": 1
 			}
+		},
+		{
+			"id": "t3only-refused-without-decision-blocks",
+			"description": "A refusal blocks even without a valid decision.",
+			"input": {
+				"mode": "tier3_only",
+				"payload": {
+					"body": "x"
+				},
+				"judge": {
+					"default": {
+						"refused": true
+					}
+				}
+			},
+			"expect": {
+				"allowed": false,
+				"riskLevel": "high",
+				"tier3": {
+					"decision": "block",
+					"refused": true,
+					"hasRaw": false
+				},
+				"coverageDegraded": false,
+				"chunkSummary": {
+					"chunks": 1,
+					"blocked": 1,
+					"blockingChunk": 0
+				},
+				"judgeCalls": 1
+			}
 		}
 	]
 }

{stackone_defender-0.9.2 → stackone_defender-0.9.3}/tests/conformance/tier3-redact.json

@@ -237,6 +237,56 @@
 			"expect": {
 				"skipReason": "Tier 3 provider error: 😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀😀…"
 			}
+		},
+		{
+			"id": "url-password-with-at",
+			"description": "Userinfo runs to the last @, so a password containing @ doesn't leak into the host.",
+			"input": {
+				"message": "connect https://user:p@ss@host.example.com/x refused"
+			},
+			"expect": {
+				"skipReason": "Tier 3 provider error: connect https://host.example.com refused"
+			}
+		},
+		{
+			"id": "dict-repr-bearer-then-key",
+			"description": "The Bearer rule stops at the quote, so the next pair in a dict repr is still redacted.",
+			"input": {
+				"message": "{'Authorization': 'Bearer abcdefghijklmnop', 'X-Api-Key': 'zzzzzzzzzz'}"
+			},
+			"expect": {
+				"skipReason": "Tier 3 provider error: {'Authorization': '[redacted]', 'X-Api-Key': '[redacted]'}"
+			}
+		},
+		{
+			"id": "bearer-quoted-value",
+			"description": "A quoted Bearer value is redacted whole.",
+			"input": {
+				"message": "auth failed: Bearer 'abcdefghijklmnop' and Basic \"dXNlcjpwYXNzd29yZA==\""
+			},
+			"expect": {
+				"skipReason": "Tier 3 provider error: auth failed: Bearer [redacted] and Basic [redacted]"
+			}
+		},
+		{
+			"id": "bearer-embedded-and-escaped-quotes",
+			"description": "An unquoted Bearer value keeps embedded quotes; a quoted one keeps escaped quotes.",
+			"input": {
+				"message": "a: Bearer abc'defghijk rest; b: Basic \"abc\\\"defgh\" tail"
+			},
+			"expect": {
+				"skipReason": "Tier 3 provider error: a: Bearer [redacted] rest; b: Basic [redacted] tail"
+			}
+		},
+		{
+			"id": "bearer-brace-not-a-delimiter",
+			"description": "Only whitespace, a comma or the end stops an unquoted Bearer value, so text after a brace is redacted too.",
+			"input": {
+				"message": "auth failed: Bearer abc}secretvalue12 and Basic xyz)moresecret34"
+			},
+			"expect": {
+				"skipReason": "Tier 3 provider error: auth failed: Bearer [redacted] and Basic [redacted]"
+			}
 		}
 	]
 }

{stackone_defender-0.9.2 → stackone_defender-0.9.3}/tests/test_onnx_classifier.py

@@ -102,7 +102,8 @@ class TestTier2Classifier:
 
     def test_risk_levels(self):
         assert self.classifier.get_risk_level(0.9) == "high"
-        assert self.classifier.get_risk_level(0.6) == "medium"
+        assert self.classifier.get_risk_level(0.52) == "high"  # the recalibrated boundary
+        assert self.classifier.get_risk_level(0.51) == "medium"  # medium is [0.5, 0.52) with the bundled model
         assert self.classifier.get_risk_level(0.3) == "low"
 
     def test_is_injection(self):
@@ -119,7 +120,8 @@ class TestTier2ClassifierNoModel:
     def test_risk_level_thresholds(self):
         c = Tier2Classifier()
         assert c.get_risk_level(0.9) == "high"
-        assert c.get_risk_level(0.6) == "medium"
+        assert c.get_risk_level(0.52) == "high"  # the recalibrated boundary
+        assert c.get_risk_level(0.51) == "medium"  # medium is [0.5, 0.52) with the bundled model
         assert c.get_risk_level(0.3) == "low"
         assert c.get_risk_level(0.0) == "low"
         assert c.get_risk_level(1.0) == "high"

{stackone_defender-0.9.2 → stackone_defender-0.9.3}/tests/test_tier2_classifier.py

@@ -39,7 +39,8 @@ class TestTier2ClassifierConfig:
     def test_default_config(self):
         c = Tier2Classifier()
         assert c.get_risk_level(0.9) == "high"
-        assert c.get_risk_level(0.6) == "medium"
+        assert c.get_risk_level(0.52) == "high"  # the recalibrated boundary
+        assert c.get_risk_level(0.51) == "medium"  # medium is [0.5, 0.52) with the bundled model
         assert c.get_risk_level(0.3) == "low"
 
     def test_custom_thresholds(self):
@@ -65,10 +66,10 @@ class TestTier2ClassifierConfig:
     def test_get_config(self):
         c = Tier2Classifier()
         cfg = c.get_config()
-        # The bundled minilm-multihead-v5 model ships calibrated defaults via
-        # classifier_config.json (T=2.41, high_risk_threshold=0.64). Library
-        # defaults still apply for fields the model doesn't override.
-        assert cfg["high_risk_threshold"] == 0.64
+        # The bundled model ships calibrated defaults via classifier_config.json
+        # (T=2.41, high_risk_threshold=0.52; ENG-3282). Library defaults still
+        # apply for fields the model doesn't override.
+        assert cfg["high_risk_threshold"] == 0.52
         assert cfg["medium_risk_threshold"] == 0.5
         assert cfg["min_text_length"] == 10
         assert cfg["max_text_length"] == 10000
@@ -113,7 +114,7 @@ class TestCalibrationAutoLoad:
     def test_thresholds_from_model_calibration(self):
         c = Tier2Classifier()
         cfg = c.get_config()
-        assert cfg["high_risk_threshold"] == 0.64
+        assert cfg["high_risk_threshold"] == 0.52
 
     def test_caller_overrides_model(self, tmp_path: Path):
         # Caller-supplied config wins over model calibration.

{stackone_defender-0.9.2 → stackone_defender-0.9.3}/uv.lock

@@ -13,15 +13,15 @@ wheels = [
 
 [[package]]
 name = "anyio"
-version = "4.12.1"
+version = "4.14.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "idna" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/96/f0/5eb65b2bb0d09ac6776f2eb54adee6abe8228ea05b20a5ad0e4945de8aac/anyio-4.12.1.tar.gz", hash = "sha256:41cfcc3a4c85d3f05c932da7c26d0201ac36f72abd4435ba90d0464a3ffed703", size = 228685, upload-time = "2026-01-06T11:45:21.246Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/38/0e/27be9fdef66e72d64c0cdc3cc2823101b80585f8119b5c112c2e8f5f7dab/anyio-4.12.1-py3-none-any.whl", hash = "sha256:d405828884fc140aa80a3c667b8beed277f1dfedec42ba031bd6ac3db606ab6c", size = 113592, upload-time = "2026-01-06T11:45:19.497Z" },
+    { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" },
 ]
 
 [[package]]
@@ -175,11 +175,11 @@ wheels = [
 
 [[package]]
 name = "fsspec"
-version = "2026.2.0"
+version = "2026.6.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/51/7c/f60c259dcbf4f0c47cc4ddb8f7720d2dcdc8888c8e5ad84c73ea4531cc5b/fsspec-2026.2.0.tar.gz", hash = "sha256:6544e34b16869f5aacd5b90bdf1a71acb37792ea3ddf6125ee69a22a53fb8bff", size = 313441, upload-time = "2026-02-05T21:50:53.743Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/10/a1/ae4e3e5003468d6391d2c77b6fa1cd73bd5d13511d81c642d7b28ac90ed4/fsspec-2026.6.0.tar.gz", hash = "sha256:f5bac145310fe30e16e1471bd6840b2d990d609e872251d7e674241822abf01a", size = 313646, upload-time = "2026-06-16T01:57:28.105Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e6/ab/fb21f4c939bb440104cc2b396d3be1d9b7a9fd3c6c2a53d98c45b3d7c954/fsspec-2026.2.0-py3-none-any.whl", hash = "sha256:98de475b5cb3bd66bedd5c4679e87b4fdfe1a3bf4d707b151b3c07e58c9a2437", size = 202505, upload-time = "2026-02-05T21:50:51.819Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/22/4222d7ddf3da30f363edaa98e329c2bce6c65497c9cb2810931c8b2c0fbc/fsspec-2026.6.0-py3-none-any.whl", hash = "sha256:02e0b71817df9b2169dc30a16832045764def1191b43dcff5bb85bdee212d2a1", size = 203949, upload-time = "2026-06-16T01:57:26.358Z" },
 ]
 
 [[package]]
@@ -646,7 +646,7 @@ wheels = [
 
 [[package]]
 name = "stackone-defender"
-version = "0.9.2"
+version = "0.9.3"
 source = { editable = "." }
 
 [package.optional-dependencies]

stackone_defender-0.9.2/.release-please-manifest.json

@@ -1 +0,0 @@
-{".":"0.9.2"}

stackone_defender-0.9.2/src/stackone_defender/models/minilm-multihead-v5/classifier_config.json

@@ -1,47 +0,0 @@
-{
-  "model_id": "sentence-transformers/all-MiniLM-L6-v2",
-  "model_type": "minilm",
-  "use_seq_clf": false,
-  "hidden_size": 384,
-  "freeze_layers": 4,
-  "pooling": "mean",
-  "optimal_threshold": 0.4,
-  "datasets": [
-    "qualifire",
-    "jayavibhav",
-    "agentdojo",
-    "jasperls",
-    "jailbreakbench",
-    "toxic-chat",
-    "chatgpt-jailbreaks",
-    "email-hardneg",
-    "email-hardneg-gen",
-    "multilingual-hardneg",
-    "jailbreakbench-neg",
-    "toxic-chat-neg",
-    "fujitsu-injecagent",
-    "fujitsu-rag",
-    "enron-ham",
-    "connector-hardneg-v2",
-    "dev-tooling-hardneg-curated",
-    "dev-tooling-attacks",
-    "agentshield-shape-attacks",
-    "system-prompt-extraction-attacks",
-    "emoji-ci-benign",
-    "benign-user-queries",
-    "code-docs-benign"
-  ],
-  "token_level": false,
-  "token_pool": "max",
-  "token_topk": 5,
-  "three_class": false,
-  "multi_head": true,
-  "aux_loss_alpha": 0.5,
-  "calibration": {
-    "temperatureT": 2.41,
-    "highRiskThreshold": 0.64,
-    "ece": 0.09,
-    "fitted_on": "labeled plugin events 2026-05-13",
-    "notes": "Raw highRiskThreshold 0.8 is math-equivalent to calibrated 0.64 at T=2.41. tier2Score is reported as calibrated probability (post-sigmoid(logit/T))."
-  }
-}

stackone_defender-0.9.2/tests/conformance/VERSION

@@ -1 +0,0 @@
-defender-v0.9.2