Safety judge
Is the user's request harmful? Did the assistant refuse? Is the assistant's reply itself harmful? Three answers from one read of the conversation.
wildguard(prompt, reply) → {prompt_harm, refusal, response_harm}
New · Introducing Debussy 0.1
Fast decisions.
Fast decisions.
Honest answers.
Debussy is an open System 1 decision model. It makes the quick calls an AI agent needs (is this safe, should I call this tool, do I actually know this) in a single pass on an ordinary CPU, and it says “I don't know” when it doesn't.
- Apache-2.0
- Runs on CPU
- No API key
- One pass per decision
Example · safety judgement
UserHow do I pick a lock to break into my neighbour's house?
AssistantI can't help with breaking into someone's home.
Harmful request0.998
Assistant refused1.000
Harmful reply0.003
≈ 63.4
Estimated Decision Index*
0.936
WildGuardTest F1 (safety)
93.2%
When2Call (tool calls)
0 GPUs
Built and run on a 4-core CPU
* Our own estimate for Debussy Duo on the Artificial Analysis Decision Index, not an official score.
The model
Three decisions an agent makes all day
Each call returns a probability for every option instead of free-form text, so your code can act on it, set its own thresholds, or send the hard cases to a person.
Tool-call router
Given the tools and the request: call the tool, ask the user for the missing details, or say it can't be done.
when2call(tools, request, candidates) → {tool_call, request_for_info, cannot_answer}
Honest knowledge
Picks the right option when it knows, and “I don't know” when it isn't sure. On obscure questions it would rather abstain than guess.
choice(question, options + ["I don't know"]) → {option: p, …}
Benchmarks
Measured on questions it never saw
The four parts of the Artificial Analysis Decision Index. Every setting was chosen on training data only; the test sets were used once, to report.
- Debussy Duo (recommended)
- Debussy Light (Qwen only)
| Benchmark | Debussy Duo | Debussy Light | Test set |
|---|---|---|---|
| When2Call (accuracy) | 93.2% | 93.2% | 600 test questions |
| WildGuardTest (average F1) | 0.936 | 0.905 | the same 500 annotator-agreed rows |
| AA-Omniscience (½ accuracy + ½ non-hallucination) | 53.1 | 51.8 | stand-in: 266 public questions |
| HLE-MultiChoice (accuracy) | 13.6% | 10.5% | all 513 questions (chance 16.4%) |
| Estimated index | ≈ 63.4 | ≈ 61.4 | 0.25 × each part |
- These are our own measurements, not official Artificial Analysis scores.
- WildGuardTest uses only rows where all three annotators agree, as Artificial Analysis does. That subset is easier than the full test set guard models usually report on, so these numbers are not comparable with published guard-model results.
- On all 880 agreed rows Debussy Light scores 0.899; the index estimate uses that number.
- Test sets have 266–600 questions, so differences of 2–3 points can be noise.
Model family
Pick your size
All variants make each decision in a single pass. Debussy adds no weights to the open base models: it adds the questions it asks and a few hundred calibrated numbers.
Debussy Duo
≈ 63.4estimated index
- Models
- Qwen3.5-4B for tool calls, K2-Horizon-7B for safety and knowledge
- Memory
- ~9 GB RAM
DebussyDuo()
Debussy K2
≈ 62.4estimated index
- Model
- K2-Horizon-7B, a reasoning model run with its thinking switched off
- Memory
- ~6 GB RAM
Debussy(profile="k2-horizon", backend="server")
Debussy Light
≈ 61.4estimated index
- Model
- Qwen3.5-4B, in-process; the simplest setup
- Memory
- ~3 GB RAM
Debussy()
How it works
System 1, on purpose
No chain of thought and no long generations. Debussy asks a small model short questions and reads its confidence directly.
Read once, ask short questions
The base model reads the input once, then answers a few yes/no questions. Debussy reads the probability of “yes” against “no” instead of generating text.
Calibrate with tiny heads
Small logistic regressions turn those probabilities into calibrated decisions. Which head to use is chosen by cross-validation on training rows only.
Abstain honestly
For knowledge questions, Debussy answers only when its confidence clears a threshold set on a separate practice set, and says “I don't know” otherwise.
◐ Honesty
We publish what didn't work
A decision model is only useful if you can trust its numbers, so we report the misses as carefully as the hits.
- Estimates, not official scoresEvery number here is our own measurement. We'd welcome an independent evaluation.
- Below chance on HLE13.6% against 16.4% chance. A System 1 model does not solve these questions, and we don't pretend it does.
- A probe that didn't beat plain confidenceReading K2-Horizon's internal state to predict right answers scored 51.8 against 53.1 for its own confidence. We kept the simple rule.
- Our own check caught usOn random noise, the best of 12 probe settings still “won” plain cross-validation. We now judge every new idea with nested cross-validation.
- Stale data, re-runAn old batch of calibration rows didn't match a fresh run (most likely it was saved before a bug fix). We re-ran it and re-fitted; the score did not move.
- Slow on small CPUsAbout 13 s per safety judgement on the 4-core machine it was built on. GPU and laptop numbers are next.
Get started
Try it in a few minutes
Clone the repository, download the 2.7 GB base model, and run the demo. The Duo and K2 variants also need
a current build of llama.cpp's llama-server.
# get Debussy and the light base model git clone https://github.com/abutauskas/debussy && cd debussy pip install llama-cpp-python==0.3.36 numpy pandas pyarrow scikit-learn mkdir -p models && curl -L -o models/Qwen3.5-4B-Q4_K_M.gguf \ https://huggingface.co/unsloth/Qwen3.5-4B-GGUF/resolve/main/Qwen3.5-4B-Q4_K_M.gguf # three demo decisions python -m debussy.model