SpanGuard v1.0.0

SpanGuard v1.0.0 — submission release

A span-level prompt-injection guard for AI agent tool traffic: strip the attack, keep the data.

What ships

• spanguard pip package: rules engine (21 patterns) · 135M span model (BIO tagger) · audit mode · OpenAI-compatible gateway (/v1/chat/completions proxy + /guard)
• Three published models, all trained locally on CPU from one deterministic fictional corpus (en/de/hu):
  • spanguard-span-mdistil — surgical span stripping
  • spanguard-docguard-mdistil — the one-bit baseline, trained on the same data for a fair fight
  • spanguard-toolguard-mdistil — tool-call argument guard
• Committed run records + SVG charts + CI regression gate (make gate)
• Static demo Space: https://huggingface.co/spaces/Nabidnur/spanguard-demo

Headline numbers (escape % · over-strip %)

Set	spanguard fast	rules-only	protectai v3	LLM 0.5B	horizon small	horizon base
Hand-written attacks (62, en/de/hu)	29.2 · 11.3	72.9 · 7.5	35.4 · 71.8	91.7 · 13.1	8.3 · 37.7	6.2 · 59.0
Agent traffic (900, synthetic)	0.0 · 3.3	13.4 · 3.3	43.6 · 48.0	97.5 · 5.1	12.5 · 6.3	15.2 · 13.1
Public prompts (452, deepset)	0.0 · 34.2	0.0 · 0.1	0.0 · 1.2	0.0 · 5.0	0.0 · 0.0	0.0 · 0.0

Cells are escape % · over-strip %. spanguard fast is Pareto-optimal on the hand-written set;
horizon-base buys 6.2% escape by destroying 59% of benign data; a 0.5B LLM self-check misses
91.7% of hand-written attacks. Tool-call surface (400 held-out calls): toolguard blocks 100%
of attacks with 0.0% false-blocks at p50 45.5 ms; the doc-level model on the same calls
false-blocks 39.0%.

Honesty

• Fictional data only; every number is a committed, re-runnable record (eval/results/, docs/REPRODUCE.md).
• Escape and over-stripping are reported together everywhere — a guard that deletes everything escapes 0%.
• The teacher-LLM path ships as optional tooling; committed labels are deterministic planted spans. No unrun inference is claimed.
• Per-family heatmaps show which families leak for which system — including ours.

Apache-2.0. Solo project for the Meta Global AI Hackathon 2026 — Indie track.