HarmBench-Llama-2-13b-cls
HarmBench-Llama-2-13b-cls is a 13B parameter classifier model designed to detect harmful behaviors in LLM outputs. It evaluates text against specified harmful behavior descriptions, returning binary yes/no judgments. The model was trained on data distilled from GPT-4 and achieves ~93% agreement with human judgments on a validation set, outperforming comparable classifiers. It supports both standard and contextual (background-aware) evaluation modes.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Developer | cais |
| Parameters | 13B |
| Context window | Unknown |
| License | mit — OSI-approved |
| Modality / task | text-generation |
| Gated on HuggingFace | No |
| Downloads | 46.8k |
| Likes | 31 |
| Last updated | 2024-03-17 |
| Source | cais/HarmBench-Llama-2-13b-cls |
What HarmBench-Llama-2-13b-cls is
A Llama-2-based sequence classification model (13B parameters) fine-tuned for behavior detection in red-teaming contexts. Operates via prompt-based classification with templated inputs (behavior + generation + optional context). Supports safetensors format, compatible with text-generation-inference endpoints. Performance metrics: 94.53% accuracy on standard behaviors, 90.5% on contextual behaviors. Trained on distilled GPT-4 judgments per HarmBench paper (arXiv:2402.04249).
Run HarmBench-Llama-2-13b-cls locally
Load the open weights with 🤗 Transformers and generate — the same model, self-hosted.
from transformers import pipelinepipe = pipeline("text-generation", model="cais/HarmBench-Llama-2-13b-cls")out = pipe("Explain retrieval-augmented generation in one sentence.", max_new_tokens=128)print(out[0]["generated_text"])Swap in vLLM or Ollama for production-grade serving. DEV.co can stand up the inference stack.
How you'd run it
A typical self-hosted path — open weights, an inference server, your application.
DEV.co builds each layer — from GPU infrastructure to the application.
Best use cases
Running & fine-tuning it
Estimated 10–30GB VRAM (depending on precision: ~26GB for fp32, ~13GB for fp16, ~7GB for int8 quantization). Inference on single high-end GPU (A100 40GB, H100, RTX 4090, or equivalent) or distributed setup. CPU inference feasible but slow (estimate minutes per inference on typical CPUs); not practical for latency-sensitive use.
Unknown whether the model supports fine-tuning or LoRA/QLoRA adaptation. Card does not document fine-tuning procedures, additional training, or task-specific customization. Recommend reviewing official HarmBench repository for guidance or contacting cais directly. Standard Llama-2 fine-tuning tooling (bitsandbytes, peft) may be compatible but not explicitly confirmed.
When to avoid it — and what to weigh
- Real-time Content Moderation at Sub-Second Latency — 13B model inference requires ~10–30GB VRAM; inference latency may not meet sub-second SLA requirements for high-throughput live moderation without GPU clusters.
- Nuanced Harm Context Without Explicit Behavior Definition — The model requires explicit behavior prompts as input. It is not a zero-shot general-purpose content moderation system and will not reliably detect harms not articulated in the behavior template.
- Non-English or Multilingual Harm Detection (Primary Use) — Card states English-primary evaluation. Performance on non-English harmful content is not documented; contextual rules require English-speaker interpretability.
- Minimal Computational Infrastructure — 13B parameter model unsuitable for CPU-only, edge, or extremely constrained environments. Requires GPU and 10–30GB VRAM depending on quantization.
License & commercial use
MIT license. Permissive OSI-approved license permitting use, modification, and distribution for commercial and private purposes, subject to inclusion of license and copyright notice.
MIT license is commercially permissive and allows commercial deployment without restriction. However, the model is a classifier trained on GPT-4-distilled data; ensure OpenAI's Terms of Service regarding GPT-4 output usage do not conflict with your intended use (e.g., if retraining or redistributing the model itself). For custom LLM integration, MIT alone is clear; for resale or significant derivative offerings, legal review is advisable.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Moderate |
| Documentation | Adequate |
| License clarity | Clear |
| Deployment complexity | Moderate |
| DEV.co fit | Good |
| Assessment confidence | High |
Model is a classifier, not a generative system, reducing direct prompt-injection risk. However, consider: (1) Classifier input (user-provided behavior and generation text) may itself be adversarially crafted to bypass detection; (2) no adversarial robustness evaluation documented; (3) distilled from GPT-4, inheriting any biases or artifacts in that training; (4) binary classification can produce false negatives/positives, potentially causing harm misses or false alarms; (5) intended for red-teaming, not as a sole safety guardrail. Deploy as one component in a defense-in-depth safety stack, not as a complete solution.
Alternatives to consider
Llama-Guard (Meta)
Proprietary, production-grade content classifier from Meta. Potentially more mature and battle-tested, but closed-source and requires licensing review. Achieved 68.41% accuracy on this benchmark; lower than HarmBench but may offer better latency or different design trade-offs.
GPT-4 (OpenAI)
Achieved 88.37% average accuracy on this benchmark, slightly below HarmBench. API-based, no self-hosting required, likely more robust to adversarial inputs. Trade-off: higher cost per inference, external dependency, privacy/latency constraints.
Lightweight, dedicated content moderation API. Lower accuracy on HarmBench tasks but simpler deployment and lower latency. Suitable if behavior detection is broad rather than highly specific.
Ship HarmBench-Llama-2-13b-cls with senior software developers
HarmBench-Llama-2-13b-cls is production-ready for safety evaluation. Review the official notebook, estimate your GPU infrastructure, and integrate into your red-teaming or safety monitoring pipeline. Contact us for deployment architecture guidance.
Talk to DEV.coRelated open-source tools
Surfaced by semantic similarity across the DEV.co open-source index.
Related on DEV.co
Explore the category and the services that help you build with it.
HarmBench-Llama-2-13b-cls FAQ
Can I use this model commercially?
What hardware do I need to run this model?
How do I use this for my own custom harmful behaviors?
Is this a replacement for human moderation?
Software developers & web developers for hire
DEV.co helps companies turn open-source tools like HarmBench-Llama-2-13b-cls into production software. Our software development services cover the full lifecycle — architecture, web development, integration, and maintenance — delivered by software developers and web developers who ship. Engage our software development agency to implement or customize it for your open-source llms stack.
Ready to Deploy Automated Harm Detection?
HarmBench-Llama-2-13b-cls is production-ready for safety evaluation. Review the official notebook, estimate your GPU infrastructure, and integrate into your red-teaming or safety monitoring pipeline. Contact us for deployment architecture guidance.