PiscesL1 is a flagship-level multimodal large language model. This document outlines our comprehensive security policy covering model weights, inference, training, deployment, and responsible AI practices.

Please do NOT report security vulnerabilities through public issues.

📧 Security Email: dunimd@outlook.com

Model weights are the core intellectual property of PiscesL1.

• Model Extraction: Reconstruct model through API queries
• Weight Theft: Unauthorized checkpoint access
• Model Tampering: Backdoor injection via weight modification
• Supply Chain Attacks: Compromised model distribution

• Encrypted checkpoint storage
• SHA-256 checksum verification
• GPG-signed releases
• Rate limiting for extraction detection
• Watermarking for provenance tracking

python manage.py watermark --check checkpoint.pt
python manage.py serve --model_size 7B --verify_checksum

Threats: Malicious prompts bypassing safety guardrails

Protections:

• Multi-layer content filtering
• Intent classification
• Structured prompt templates
• Output monitoring

python manage.py serve --model_size 7B --content_filter strict
python manage.py monitor --alert_level high

Threats: Crafted inputs causing unintended behavior

Protections:

• Input perturbation detection
• Certified robustness training
• Multi-modal input validation

Threats: DoS through expensive computations

Protections:

• Token limit enforcement
• Compute budget tracking
• GPU memory monitoring

python manage.py serve --model_size 7B --max_tokens 8192 --timeout 60

Threats: Malicious training data introducing backdoors

Protections:

• Data provenance tracking
• Anomaly detection
• Differential privacy training
• Regular data audits

python manage.py download --validate --dataset Chinese2
python manage.py train --model_size 7B --dataset Chinese2 --validate_data

Threats: Hidden triggers causing specific outputs

Protections:

• Trigger pattern detection
• Model inspection tools
• Red team testing

Threats: Compromised training environment

Protections:

• Isolated training environments
• Checkpoint integrity verification
• Training log monitoring

python manage.py train --resume_ckpt checkpoint.pt --verify_checkpoint
python manage.py action --monitor <run_id>

PiscesL1 supports 6 modalities with unique security considerations:

python manage.py watermark --detect --input image.png
python manage.py watermark --detect --input audio.wav
python manage.py watermark --detect --input video.mp4

Threats:

• Membership inference attacks
• Training data extraction
• PII leakage in outputs

Protections:

• Differential privacy (DP-SGD)
• Data anonymization
• PII detection and redaction

Protections:

• No persistent query storage
• Data minimization
• GDPR/CCPA compliance

python manage.py train --model_size 7B --differential_privacy --epsilon 1.0
python manage.py serve --model_size 7B --no_log_queries --anonymize_logs

Protections:

• Uncertainty quantification
• Citation requirements
• Knowledge grounding
• Confidence scoring

python manage.py serve --model_size 7B --uncertainty_threshold 0.3 --require_citations

python manage.py serve --model_size 7B --port 8000 --auth_required --rate_limit 60
python manage.py serve --model_size 7B --api_key_required --tls_cert cert.pem

FROM python:3.11-slim

WORKDIR /app
COPY . .

RUN adduser --disabled-password --gecos '' piscesl1
USER piscesl1

HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
    CMD python manage.py check || exit 1

CMD ["python", "manage.py", "serve", "--model_size", "7B"]

• GPU memory isolation
• Network segmentation
• Secrets management
• Intrusion detection
• Penetration testing

python manage.py check --gpu --dependencies --security
python manage.py monitor --security_alerts

• RLHF (Reinforcement Learning from Human Feedback)
• Constitutional AI principles
• Red team testing
• Continuous safety evaluation

python manage.py train --mode alignment_dpo --model_size 7B
python manage.py train --mode alignment_ppo --model_size 7B
python manage.py train --mode alignment_orpo --model_size 7B

• Model cards with capabilities and limitations
• Training data documentation
• Known failure modes
• Bias evaluation reports

• AI ethics review board
• Incident response procedures
• Regular safety audits
• Stakeholder engagement

pip install --upgrade -r requirements.txt
pip-audit

python manage.py --version
python manage.py help

python manage.py serve --model_size 7B --content_filter strict --max_tokens 8192 --auth_required
python manage.py train --model_size 7B --validate_data --secure_checkpoint

python manage.py download --validate --dataset <dataset_name>
python manage.py benchmark --self_test --data_check

python manage.py watermark --check checkpoint.pt

python manage.py monitor --log_level INFO
python manage.py check --gpu --dependencies
python manage.py action --monitor <run_id>

python manage.py check --security
python manage.py serve --model_size 7B --port 8000 --auth_required --rate_limit 60 --tls_cert cert.pem

# configs/train/default.yaml
security:
  content_filter:
    enabled: true
    level: strict
    categories: [violence, sexual, hate, self-harm]
  
  input_validation:
    max_length: 32768
    allowed_formats: [text, image, audio, video]
  
  privacy:
    differential_privacy: false
    log_queries: false
    anonymize_logs: true

python manage.py serve --model_size 7B --serve_config configs/secure.yaml
python manage.py train --model_size 7B --train_config configs/train/secure.yaml

In Scope:

• Model weight extraction vulnerabilities
• Jailbreak/prompt injection bypasses
• Training data leakage
• Adversarial attack vectors
• Content filter bypasses
• Privacy vulnerabilities
• API security issues

Out of Scope:

• Social engineering attacks
• Physical security issues
• Third-party dependencies (report to upstream)

1. Report: dunimd@outlook.com
2. Acknowledge: Within 48 hours
3. Investigate: Assess severity
4. Fix: Develop and test
5. Release: Publish advisory
6. Credit: Credit reporter (if desired)

We will not pursue legal action against researchers who:

• Act in good faith
• Follow this disclosure policy
• Do not access or modify user data
• Do not disrupt service availability

• OWASP LLM Top 10
• NIST AI Risk Management Framework
• MITRE ATLAS

• Garak
• PromptInject
• LLM Security Checklist

• Security Email: dunimd@outlook.com
• GPG Key: Available upon request

We thank the security researchers who have responsibly disclosed vulnerabilities:

This list will be updated as vulnerabilities are reported and resolved.

Last Updated: 2026-03-07

Version: 1.0