Fine-tuning a 322M Model for Coding Agent Safety: What 3 Runs and 2 Failures Taught Me

Laya-guard operates between a coding agent and a user's shell. Every command the agent wants to run passes through a hook first. Rules for destructive commands, like "rm -rf", and routine commands, such as "ls", are defined first. Commands that don't fit rules are evaluated by a small local model called Laya, which decides to allow, review, or block the command.

Laya is a 322M parameter multilingual model, but the initial model wasn't performing well. Three runs and two failures later, the final version of laya-guard is now in use.

The data used for training came from actual Claude Code and Codex sessions, with around 13,000 shell commands. Before training, the data was masked to protect sensitive information, and some commands were dropped if they closely resembled those in benchmarks or test sets. After reviewing the labeled data, it was found that the model was too strict, too lenient, or simply wrong in its evaluations.

In the first run, the model was too strict, allowing only 25 out of 50 everyday commands, failing to catch 32 attacks that the model alone caught. However, it also blocked 23 everyday commands and 43 Korean requests, which were necessary for the system to function properly. The model learned to block short commands, which were mostly harmless, and had trouble understanding Korean requests.

The second run was too lenient, allowing 49 out of 50 everyday commands, failing to catch 31 attacks that the model alone caught. However, it also allowed harmful commands, such as deleting a Windows drive or printing a GitHub token from a command hidden by a comment. This run met the criteria for attacks caught by the model alone, but allowed harmful commands to pass through.

The third run struck a balance between the first two runs. It trained the model on what it actually saw, rather than relying solely on predefined rules or examples. It also balanced the labels to ensure that the model had enough information about both harmful and safe commands. The model now performs better, allowing 49 out of 50 everyday commands, catching 32 attacks that the model alone caught, and performing well on Korean requests.