Decima Guard brings multilingual prompt checks to a CPU

Decima Guard puts a small multilingual checkpoint beside an LLM, rather than asking another large model to review every input. The community project’s October 18 preview is a 321-million-parameter classifier with CPU-oriented int8 ONNX files. Its English model card describes checks for user prompts, retrieved documents, tool results and model replies, with training aimed at English, Arabic and Persian.

The practical hook is local inspection: the author says inference stays on the user’s machine. Installation is documented as pip install decima-ai, with guard, guard-rag, guard-output and guard-web presets. These address different surfaces, from a suspicious user message to instructions hidden in a calendar tool’s result. They return scores for the application to interpret; they do not by themselves restrict what an agent can execute.

Fewer false alarms is not the same as fewer missed attacks

On the author’s 6,532-example prompt-injection comparison, Decima Guard reports 91.5% accuracy, versus 78.4% for ProtectAI’s DeBERTa baseline. But both models miss 431 of 2,290 attacks, about 18.8%. The reported improvement is mainly in benign examples: false alarms fall from 979 to 124 out of 4,242.

The card highlights ordinary Arabic and Persian messages as a source of baseline false alarms. That is a useful multilingual deployment angle, but the comparison’s Persian and Arabic columns contain harmless messages, not attacks. A separate translated-attack test reports 45 misses among 140 Persian attacks. Readers should not interpret strong benign-message scores as strong Persian attack detection.

These are the builder’s measurements, not independent AITrending results. The card also says both systems have exposure to some of the same public dataset sources, so the comparison is not cleanly zero-shot for either model. Results on teacher-written Finglish and Arabizi examples carry another stated caveat: the teacher also generated part of the training data.

A deployable preview with a bounded job

The author reports 111 milliseconds per question on one CPU thread, or 44 milliseconds on four, using int8 on an NVIDIA GB10’s ARM cores while the machine was busy. Those figures are hardware-specific per-question measurements, not an end-to-end latency promise for every preset or processor.

The input window is 2,048 tokens; longer input is refused rather than silently truncated. The card warns that ordinary static paths can be misclassified as web attacks and that instructions meant for people can trigger indirect-injection flags. It recommends combining the model with hard rules and tools that have limited permissions.

The checkpoint is labeled Apache-2.0, but the training disclosure identifies some datasets without published licenses and says a later version will drop them. That unresolved data-rights detail matters for adoption. AITrending reviewed the English card and public upload history without running the model. The news is a concrete local, multilingual guard preview, not a demonstrated security boundary.