SCOUT outcome predictor (LoRA adapter, SFT + GRPO)

This repository holds the LoRA adapter of the SCOUT outcome predictor from the paper Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense (EMNLP 2026, Main Conference). Paper: https://arxiv.org/abs/2605.30837. Code: https://github.com/Rockyli11/SCOUT. Project page: https://rockyli11.github.io/SCOUT/.

SCOUT treats prompt-injection defense as per-input detector allocation. For each request, the predictor reads retrieved detector fingerprints and estimates, for every detector in the pool, whether that detector will be correct on the input (pred_corr) and how long it will take (pred_lat). A routing rule then runs the predicted-reliable light detectors in parallel and escalates to an LLM judge only when their vote is uncertain.

What is in this repository

Item	Value
Base model	sullivanUCSD/SCOUT-SFT-only (Qwen3-4B-Instruct after Stage 1 SFT on hindsight-distilled rationales)
Adapter	LoRA, rank 128, alpha 256, dropout 0.05, on all linear projections (q, k, v, o, gate, up, down)
Training	Stage 2 GRPO with a gated multiplicative reward (format gate x correctness x (1 + latency reward)); global step 462, selected by routing accuracy on a held-out validation slice
Training data	sullivanUCSD/SCOUT-30K (29,551 hindsight-distilled (sample, detector) examples); the GRPO train/validation split is sullivanUCSD/InstinctSCOPE-RL-data
Output format	a short reasoning chain followed by Predicted Performance: {"correctness": "yes"/"no", "latency": "<ms>"}

The checkpoint in this repository is the one named "SCOUT" in every experiment of the paper.

Usage

from peft import AutoPeftModelForCausalLM
from transformers import AutoTokenizer

model = AutoPeftModelForCausalLM.from_pretrained("sullivanUCSD/SCOUT", torch_dtype="bfloat16", device_map="auto")
tok = AutoTokenizer.from_pretrained("sullivanUCSD/SCOUT-SFT-only")
model = model.merge_and_unload()  # optional, for vLLM-style serving

adapter_config.json points to the base model sullivanUCSD/SCOUT-SFT-only, so the adapter loads directly. The predictor expects the SCOUT prompt format (detector profile, the retrieved fingerprint records, and the target sample). The prompt builder, the retrieval index over sullivanUCSD/anchor-400, and the full routing rule are in the code repository above. Use sullivanUCSD/SCOUT-450 for evaluation.

Related artifacts

• sullivanUCSD/SCOUT-SFT-only: Stage 1 checkpoint (SFT-CoT), the base for this adapter.
• sullivanUCSD/SCOUT-30K: predictor supervision data.
• sullivanUCSD/anchor-400: fingerprint and kNN retrieval set.
• sullivanUCSD/fingerprint: serialized per-(anchor, detector) fingerprint records.
• sullivanUCSD/SCOUT-450: held-out evaluation benchmark (255 attack / 195 benign).

License and intended use

The adapter inherits the Qwen3 base-model terms (Apache-2.0). It is released for research on prompt-injection defense. Do not use it to develop or deploy prompt-injection attacks.

Citation

@inproceedings{zhang2026scout,
  title     = {Send a {SCOUT} First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense},
  author    = {Zhang, Shuhao and Li, Jiarui and Cao, Qi and Zhang, Ruiyi and Xie, Pengtao},
  booktitle = {Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing},
  year      = {2026},
  note      = {arXiv:2605.30837}
}