Fine-Tuning a 322M Model to Guard Coding Agents: 3 Runs, 2 Failures, 1 Shipped

Extreme_Ad5709 · reddit · 2026-11-03

A developer documents fine-tuning a 322M model for laya-guard, a local hook that judges every tool call a coding agent makes: three runs, two failures, one shipped, with each failure traceable to the data.

Data: 13k shell commands from his own agent transcripts, masked and deduplicated against benchmarks; 696 rule-undecidable commands labeled by six agents plus human adjudication; trained on a free Colab GPU.

Run 1, too strict: validation 0.90 was meaningless (86% allow rate); the model learned "short = dangerous" because real safe commands had a 287-char median length vs 33-40 for hand-written risky ones.

Run 2, too lenient: everyday commands hit 49/50, but rmdir /s /q d:\, a delete hidden behind a comment, and gh auth token all slipped through—no Windows commands in data, comments almost always labeled allow, almost no secret-printing examples.

Run 3, shipped: one data change per finding plus 100 gap-filling examples; final: 44/50 everyday allowed, 39/43 attacks caught.

He stresses the real backstop must be enforced outside the model: laya-guard sandbox puts protected paths in the agent's OS sandbox so the kernel refuses reads; obfuscated variants (${IFS}, base64 into sh) are blocked too. Still uncovered: env dumps like printenv and cat /proc/self/environ.

Original post →

Fine-Tuning a 322M Model to Guard Coding Agents: 3 Runs, 2 Failures, 1 Shipped

More from coding & agent