nvidia

/

NemoGuard-JailbreakDetect

Like 26

Follow

NVIDIA 68k

I am evaluating NemoGuard-JailbreakDetect for integration with NVIDIA NeMo Guardrails and found a reproducible discrepancy between the published snowflake.pkl and snowflake.onnx artifacts.

Using the same 768-dimensional embeddings from Snowflake/snowflake-arctic-embed-m-long:

Input               snowflake.pkl       snowflake.onnx
------------------------------------------------------
Hello               class 0             class 1
What is Python?     class 0             class 1
Write factorial     class 0             class 1
Explain Docker      --                  class 1
Fix Python syntax   --                  class 1

For example, with the sklearn PKL classifier:

Hello              -> class 0, P(class=1)=0.0085
What is Python?    -> class 0, P(class=1)=0.0171
Write factorial    -> class 0, P(class=1)=0.0166

The ONNX classifier returns class 1 for these same benign inputs.

I also verified that the embeddings themselves are not the source of the discrepancy. The embedding generated by NeMo's SnowflakeEmbed implementation is exactly identical to the embedding generated directly using AutoTokenizer and AutoModel from the same Snowflake model snapshot.

The published PKL model is a 100-tree RandomForestClassifier with 768 input features. The ONNX artifact is also a 100-tree TreeEnsembleClassifier, but comparison of the corresponding tree structures shows that they are not identical.

Could you please clarify:

1. Are snowflake.pkl and snowflake.onnx expected to be functionally equivalent?
2. Was snowflake.onnx generated from the same Random Forest represented by snowflake.pkl?
3. Is the currently published ONNX artifact the recommended artifact for production inference?
4. Is there a known difference in the expected preprocessing or inference procedure between the two artifacts?

I have also reported the integration-level behavior to NeMo Guardrails:
[NVIDIA-NeMo/Guardrails issue #2285 is unrelated; a separate bug report has been filed regarding the jailbreak detector behavior.]

The goal here is to determine whether the discrepancy is expected, an artifact-generation issue, or an inference/integration issue.