aisquared / bolt-cls-content

Bolt CLS Content

Bolt CLS Content is a binary text classifier for detecting unsafe/policy-violating content in raw text. It is one of four Bolt CLS classifiers (PII, Content, Jailbreak, Router) used together in the production request-safety pipeline.

Model Overview

Bolt CLS Content is trained specifically to flag whether a piece of raw text is likely to contain unsafe or policy-violating content, acting as the first-pass sieve in front of a heavier downstream reviewer model.

Key design goals:

• Very high recall (catch nearly all unsafe content) even at the cost of precision
• Fast, lightweight scoring suitable for gating every request in a production pipeline
• A calibrated score that downstream systems can threshold for different use cases

Model Details

• Type: Text classifier (binary, single-label)
• Architecture: ModernBERT ( ModernBertForSequenceClassification )
• Base model: aisquared/bolt-embedding-large — frozen during training (only the classification head was trained). bolt-embedding-large is itself AI Squared's own encoder, fine-tuned from ibm-granite/granite-embedding-english-r2 .
• Hidden size: 768 · Layers: 22 · Attention heads: 12
• Max input length: 8,192 tokens
• Pooling: mean

Training Data

Training data combines four sources:

• An in-house content-safety dataset with its own is_sensitive labels.
• nvidia/Nemotron-3.5-Content-Safety-Dataset , a public safety dataset — unsafe rows keep their real violated_categories as labels; the rest are safe.
• LLM-LAT/harmful-dataset , a public harmful-content dataset — all rows treated as unsafe, labeled "Harmful Content" .
• yahma/alpaca-cleaned , a general-instructions dataset — all rows treated as safe negatives.

Balancing: unlike the PII and jailbreak merges, this one explicitly balances to a 50/50 class split — it pools every unsafe row and every safe row separately, downsamples both to the smaller of the two counts, then shuffles.

Split: 80% train / 20% test (seed 42) on the balanced+shuffled data (a separate stratified 90/10 eval carve-out happens later, on top of this 80% train portion, during training itself).

Known caveat: the LLM-LAT/harmful-dataset column mapping used in preparing this data was based on an assumed schema for typical harmful-content datasets, rather than one verified directly against that dataset's actual columns.

Training

Trained with AI Squared's internal classifier training pipeline, shared across all four Bolt CLS classifiers. This is a frozen-base run — only the classification head was trained on top of the frozen aisquared/bolt-embedding-large encoder.

• Objective/loss: weighted focal loss (γ = 2.0 by default) on top of standard cross-entropy, with inverse-class-frequency weighting plus an extra ×2.0 multiplier on the positive (unsafe) class — biases the model toward catching positives, consistent with the sieve design.
• Hyperparameters: learning rate 2e-5 · 4 epochs · per-device batch size 1 with 32 gradient-accumulation steps (effective batch size 32) · cosine LR schedule, 6% warmup · weight decay 0.01 · max grad norm 1.0 · max sequence length 8,192 tokens · seed 42.
• Threshold selection: after training, the eval-split positive-class scores are swept to find the F1-optimal decision threshold (ties broken by recall, then precision); that threshold and its metrics are saved to threshold.json and shipped with the model — this is the same file Threshold Guidance below is drawn from.
• Hardware: Nvidia H200

Threshold Guidance

Two thresholds are relevant to this model:

If you're integrating this model outside of the production sieve, default to the F1-optimal threshold (0.5271) unless you have the same "flag → model review" downstream step, in which case the lower 0.30 threshold is appropriate.

Evaluation

Reported production target at the operating threshold: FNR < 1%, FPR < 69% (the sieve intentionally trades a high false-positive rate for a very low false-negative rate, since flagged content still gets a real decision from a downstream reviewer model rather than an automatic block). Held-out eval metrics at the F1-optimal threshold (0.5271):

Intended Use

• Low-threshold pre-filter (sieve) in the production request pipeline, flagging prompts that may contain unsafe/policy-violating content for downstream review by a larger reviewer model.
• Standalone content-safety screening where a binary flag on raw text is sufficient and a permissive (high-recall, lower-precision) operating point is acceptable.

Out of scope: using this model's flag as a final block decision — by design it is a first-pass filter with a high tolerated false-positive rate; final adjudication happens downstream.

Deployment Notes (Hugging Face Inference Endpoints)

If you're deploying this model on HF Inference Endpoints:

1. The two frontmatter lines above are required. Without pipeline_tag and library_name set, HF cannot identify this repo's task/architecture, which blocks every specialized engine (vLLM, TEI, TGI, SGLang) from even appearing as selectable options — you'll only see "Default," along with a "no handler.py found" warning. Adding these two lines is what unlocks the full engine list on the deployment screen.
2. Manually select vLLM as the Inference Engine on the deployment screen — it is not selected by default, and the default recommendation may pick a different engine that doesn't correctly support this architecture's classification head. This has to be set explicitly every time you create a new endpoint; it is not remembered from prior deployments and cannot currently be pinned via any repo file.
3. No handler.py or requirements.txt is needed once vLLM is selected — vLLM reads config.json directly.

Usage

from transformers import pipeline

classifier = pipeline("text-classification", model="aisquared/bolt-cls-content")
result = classifier("Your text here")
print(result)

Limitations

• High false-positive rate (up to ~69%) at the production sieve threshold is expected and by design — this model should not be used anywhere a low FPR is required without raising the threshold toward the F1-optimal value.
• Evaluated against an internal content-safety eval set; performance on content categories not represented there is not guaranteed.
• As with any threshold-based classifier, behavior near the threshold boundary should be spot-checked before relying on it in a new context.

License

Bolt CLS Content is released under the AI Squared Community License .