Opir
Show HN: Jailbreak this model to get 3B tokens
Last verified:
What is Opir?
Opir is an open-source family of encoder-based guardrail models designed for real-time LLM safety filtering, jailbreak detection, and fine-grained policy classification. Built on the GLiClass architecture, it provides efficient multi-task safety classification that can detect unsafe prompts, toxic language, jailbreak attempts, and harmful content without the cost and latency of large generative guardrail models. The model family includes variants for English multitask classification, multilingual multitask classification, and edge binary safety classification.
Key features include binary safe/unsafe classification, multi-label toxicity classification, multi-label jailbreak classification, and zero-shot unsafe prompt/response categorization across a comprehensive hierarchical taxonomy of 996 safety labels. Opir supports multi-label compatibility, enabling simultaneous labeling of text spans with multiple categories, and offers hierarchical reporting at top-level, mid-level, and leaf-level granularity. The models achieve sub-30ms p50 latency at 1024 tokens for the large variant and sub-10ms for edge variants, operating 10x-33x faster than decoder-based guardrails while maintaining comparable accuracy.
Opir is designed for builders, red teamers, prompt-injection researchers, AI security teams, and organizations developing LLM applications, agents, RAG systems, or moderation workflows. It covers 23 languages and addresses ordinary toxicity, hate speech, self-harm, sexual safety, child safety, privacy, WMD, cyber security, crime, regulated domains, biosecurity, misinformation, AI security, fairness, and benign contexts. The models are Apache 2.0 licensed and built for teams needing safety checks at middleware speeds.
Opir pricing
Pricing model: Freemium
Opir is completely free and open-source under Apache 2.0 license. All four model variants (Opir-multitask-large, Opir-multitask-multilang, Opir-edge, Opir-edge-multilang) are available on Hugging Face at knowledgator/opir collection with no paid tiers. The Opir Challenge offers winners 100M tokens/day for 30 days from SCX.ai as prizes. Models can be downloaded and used without cost for LLM moderation, safety routing, and analysis.
Opir pros
- Open-source with Apache 2.0 license
- 10x-33x faster than decoder-based guardrails
- Sub-10ms p50 latency for edge variants at 1024 tokens
- 996 safety labels across hierarchical taxonomy
- Supports 23 languages including multilingual variants
- Multi-label compatible for simultaneous category labeling
- Competitive accuracy with 7B-22B parameter models
- 32M-430M parameter range for efficient deployment
- Zero-shot classification over custom taxonomies
- Built on DeBERTaV3/GLiClass backbone
- Trained on millions of examples including synthetic data
- Includes benign sensitive contexts to reduce over-refusal
- Binary safe/unsafe and multi-task classification in one model
- Hierarchical reporting at multiple granularity levels
- Lightweight deployment footprint compared to generative guardrails
- Evaluated across 17 public benchmark families
- Edge variants under 100M parameters for resource-constrained environments
Opir cons
- English-only for multitask-large variant
- Safety labels remain policy-dependent and subjective
- Potential generator and judge biases from LLM-based data creation
- Multilingual performance varies due to translation artifacts
- Not intended as sole safety control for high-risk deployments
- May miss novel jailbreaks or obfuscated prompts
- Thresholds from benchmarks may not transfer to production traffic
- Prompt-response formatting affects classification results
- Weak performance on OR-Bench category rows in benchmarks
- Cannot guarantee complete jailbreak resistance
Frequently asked questions about Opir
What is Opir and what does it do?
Opir is an open-source family of encoder-based guardrail models built on the GLiClass architecture for efficient, real-time multi-task safety classification in LLM applications. It detects unsafe prompts, toxic language, jailbreak attempts, prompt injections, and harmful content while distinguishing benign sensitive text from genuinely covert harmful content. The family includes models for binary safe/unsafe classification, multi-label toxicity classification, jailbreak classification, and zero-shot unsafe prompt/response categorization.
How fast is Opir compared to other guardrail models?
Opir variants operate 10x to 33x faster than contemporary decoder-based guardrails. Opir-multitask-large achieves 25.65ms p50 latency at 1024 tokens (50.51 samples/s), while Opir-edge achieves sub-10ms p50 latency (499.49 samples/s). This represents an order-of-magnitude improvement over models like Nemotron Safety Guard v3 (97.63ms), WildGuard (243ms), and PolyGuard-Qwen (308.59ms) while maintaining comparable accuracy.
What safety taxonomy does Opir use?
Opir uses a three-level hierarchical taxonomy containing 996 total labels: 16 top-level categories, 126 mid-level labels, and 854 leaf labels. Top-level categories include toxicity, violence_and_physical_harm, self_harm_and_suicide, sexual_content, child_safety, personal_information_privacy_and_intellectual_property, cybersecurity, criminal_and_illegal_activity, regulated_goods_and_advice, biological_medical_and_environmental_harm, weapons_of_mass_destruction, information_integrity_and_manipulation, ai_system_security_and_reliability, bias_fairness_and_representation, other_or_uncertain, and safe_and_benign.
What model variants are available in the Opir family?
The Opir family includes four variants: Opir-multitask-large (DeBERTaV3-large backbone, 430M parameters, English-only multi-task classification), Opir-multitask-multilang (mDeBERTaV3-base, multilingual multi-task for 23 languages), Opir-edge (Ettin-encoder-32m, 32M parameters, English binary safety classification), and Opir-edge-multilang (mmBERT-small, multilingual binary safety for 23 languages). All variants are under 100M-430M parameters.
Is Opir open-source and what license does it use?
Yes, Opir is fully open-source under the Apache 2.0 license. All models are available on Hugging Face at the knowledgator/opir collection and can be downloaded and used without cost. The code, training data methodology, and evaluation harness are also open-sourced on GitHub.
What datasets were used to train Opir?
Opir's training data combines taxonomy-grounded unsafe prompts (30 per taxonomy node), adversarially mined hard negatives through evolutionary modification, benign safety-preserving examples from the safe_and_benign branch, generated response examples from Qwen3-4B fine-tuned on Aegis2, multilingual translations into 23 languages using DeepSeek-V3.1, and portions of Aegis2 and WildGuardMix training subsets. The English multi-task training file contains 426,356 examples.
How does Opir handle multi-label classification?
Opir is multi-label compatible, meaning it can simultaneously label text spans with multiple categories like sexual_content.sexual_harassment and toxicity.harassment_and_abuse. For multi-label tasks, logits are converted to independent probabilities using a sigmoid function, and labels are emitted when probability exceeds the threshold (default 0.5). This enables labeling text with ordinary toxicity, hate, self-harm, sexual safety, and other categories simultaneously.
What benchmarks was Opir evaluated on?
Opir was evaluated across 12 safety classification tasks and 17 category tasks spanning OpenAI moderation, Aegis/Aegis2, SimpleSafetyTests, HarmBench, PKU-SafeRLHF, BeaverTails, XSTest, OR-Bench, ToxicChat, WildGuardMix, PolyGuardPrompts, JBB-Behaviors, and PAN12 predator conversational safety. Opir-multitask-large achieved 0.8045 macro F1 average on binary safety (winning 2 of 12 rows) and 0.5432 accuracy on categorization (winning 11 of 17 rows).
What are the intended use cases for Opir?
Recommended uses include LLM input moderation before prompt execution, LLM output moderation before delivery to users, safety routing to stricter guardrails or human review, toxicity/jailbreak/prompt-injection classification, and offline safety analytics over red-team results and moderation logs. Out-of-scope uses include sole safety control for high-risk deployments without calibration, legal/medical/employment high-impact decisions, or guarantees of complete jailbreak resistance.
What is the Opir Challenge and how can I participate?
The Opir Challenge is a competition inviting builders, red teamers, and prompt-injection researchers to attempt bypassing the flagship Opir guardrail model. Participants get 100 attempts to extract a secret key from the sandbox system. The challenge starts July 5 at 9:00 AM ET and ends July 12 at 9:00 AM ET. The first 5 users to extract the secret key win 100M tokens/day for 30 days from SCX.ai. Rules include one account per person, only chat messages allowed, and staying inside the sandbox.