AgentGuard v1.2.0

inter-agent-guard v1.2.0 — Release Notes

The ML layer is no longer the v1 length detector. v1.2.0 ships a retrained
INT8 ONNX scorer (Kaggle kernel v27) plus prefix scoring, evaluated against
a public corpus this project did not write.

Quote this: on deepset/prompt-injections test (train split used in
training, test held out), Rules + ML at risk > 0.85:

Detector	Detection	FPR	Balanced accuracy
length > 430 (reads nothing)	8.3%	0.0%	54.2%
Rules + ML	90.0%	0.0%	95.0%

Do not quote the in-house holdout (92.0% / 0.3% FPR) as general detection —
it is the same Claude generator as training. Do not quote the withdrawn v1
99.4%. Do not quote jailbreak-classification (high FPR). Details:
KNOWN_LIMITATIONS.md.

Install

pip install "inter-agent-guard==1.2.0"
python scripts/download_release_model.py   # from a clone; pulls GitHub release v1.2.0

Or download risk_scorer.onnx + model.sha256 from
https://github.com/nizba06/agentguard/releases/tag/v1.2.0 into
agentguard/models/.

What changed

• Prefix scoring — if a long message looks benign, also score the first
  256 characters. Sliding windows were tried and reverted (holdout FPR 5.8%).
• Length-balanced retrain — short status pings stay in training; class
  medians overlap.
• Public mix — deepset train only; official scores use test.
• Deterministic layers (Ed25519 trust, capability manifests, hash-chained
  audit) are unchanged.

Latency

CPU holdout P95 is about 3.3 s. The 15 ms design target is not met on
INT8 CPU. Use rules-only, GPU, or async for high QPS
(latency guide).

Reproduce

py -3.12 scripts/verify_model.py
py -3.12 benchmarks/adaptive_eval.py
py -3.12 benchmarks/external_eval.py --corpus deepset --offline

Full detail: CHANGELOG.md → [1.2.0].