Instructions to use Z-Edgar/CoER-Attacker with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use Z-Edgar/CoER-Attacker with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="Z-Edgar/CoER-Attacker")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("Z-Edgar/CoER-Attacker")
model = AutoModelForCausalLM.from_pretrained("Z-Edgar/CoER-Attacker", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use Z-Edgar/CoER-Attacker with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "Z-Edgar/CoER-Attacker"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Z-Edgar/CoER-Attacker",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/Z-Edgar/CoER-Attacker

SGLang

How to use Z-Edgar/CoER-Attacker with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "Z-Edgar/CoER-Attacker" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Z-Edgar/CoER-Attacker",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "Z-Edgar/CoER-Attacker" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "Z-Edgar/CoER-Attacker",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use Z-Edgar/CoER-Attacker with Docker Model Runner:
```
docker model run hf.co/Z-Edgar/CoER-Attacker
```

CoER Attacker

Project page · Paper · Code

A retained Co-PPO attacker (a200) for adaptive indirect prompt-injection research. It generates tool-return injections and adapts later attempts to the public execution trace within the same task.

Download available. All 66 safetensors shards are uploaded and match their upload manifests; configuration, tokenizer and weight-index files are present. File verification is complete; GPU loading and inference have not been tested as part of this release check.

Updated paper Figure 2: Attacker SFT → bilateral Co-PPO → population-guided Defender SFT.

Training and role

CoER models attacker–defender interaction as a general-sum Markov game. Attacker SFT initializes exploration from 3,995 successful conversations (11,655 attacker turns). Bilateral Co-PPO then trains current policies against current opponents and frozen historical snapshots; evaluated checkpoints refresh the pools. Retained attackers also provide challenges for teacher-generated defender refinement.

The attacker observes public execution feedback and prior attempts, not hidden defender reasoning. This is a research attacker, not a general-purpose assistant.

Paper-reported results

Opponent	Co-PPO attacker Effective ASR ↓ for the defender
Base	65.65%
Co-PPO	29.78%
CoER	0.36%

Paper Table 7 uses reach-conditioned Effective ASR, which is distinct from the main evaluation's ASR. These are reported method-level results, not a new evaluation of this package. The a200 release was selected from a fixed-Base diagnostic comparison; it is not claimed to be the strongest attacker against every defender. Per-cell counts for the corrected cross-play matrix are unavailable.

Download and compatibility

from huggingface_hub import snapshot_download

model_dir = snapshot_download("Z-Edgar/CoER-Attacker")

The checkpoint uses BF16, Qwen3_5ForCausalLM and qwen3_5_text (text-only). Use a compatible Transformers stack and the repository’s attack/chat contract; do not substitute the defender’s model class.

The release uses smaller standard safetensors shards without changing tensor values. Download the complete repository, not an individual shard. See the training and evaluation code for rollout formatting and environment setup.

Related resources

Models: Attacker · Defender.
Training data: Attacker SFT · Defender SFT · RL configurations.

Use and licensing

Use in authorized, isolated research environments. Prompt-injection payloads and model outputs may be unsafe; do not attach uncontrolled tools, private data or real accounts. Public access does not grant additional rights beyond applicable source terms. This public repository is not an anonymous-reviewer resource.

The base family is Qwen3.5-9B; its license and notice are preserved in UPSTREAM_LICENSE. Rights in intermediate models, fine-tuned weights, training data and teacher outputs remain subject to their respective terms. A separate final-artifact license has not been confirmed.