Emma Guardrails 2.0

Emma Guardrails 2.0 is an open-source Italian text classification model developed by Egomnia S.p.A. for detecting safety-related, sensitive and content-related categories in user prompts.

It is designed to operate as a lightweight input guardrail in front of Large Language Models (LLMs), classifying incoming prompts before they are processed by the main generative model. It can also be used to moderate generated outputs before they are returned to the end user.

The model uses a classical machine learning pipeline based on TF-IDF vectorization and multiclass Logistic Regression, providing low-latency inference, low computational requirements and straightforward deployment in Python and on-premise environments.

Emma Guardrails 2.0 is an evolution of Emma Guardrails 1.0, featuring an expanded training corpus, a revised classification taxonomy and improved representation of safety-related categories, while retaining the original architecture and inference footprint.

Model Details

Model name: Emma Guardrails 2.0
Developer: Egomnia S.p.A.
Department: AI Research & Development
Language: Italian
Task: Multiclass text classification
Number of categories: 21
Training samples: 100,383 real and unique prompts
Training data sources: Emma-5 and Emma-6 conversational systems
Architecture: TF-IDF + Logistic Regression
Framework: scikit-learn
Training/test split: 80% / 20%
Test samples: 20,076
Random seed: 42
Test accuracy: 81.01%
Model serialization: Joblib
Serialized model footprint: Approximately 1.6 MB

What's New in Version 2.0

Emma Guardrails 2.0 introduces several improvements over the first release.

Expanded Training Dataset

The training corpus has grown from 44,677 to 100,383 real and unique prompts, representing an increase of 55,706 samples (+124.7%).

The additional data improves the representation of several safety-related categories, including prompt injection, illegal substances, extremist ideologies, toxic substances and personal information.

The dataset continues to reflect real conversational traffic rather than a synthetically balanced benchmark.

Revised Classification Taxonomy

The model retains 21 classification categories, with five labels revised to provide more accurate and cautious descriptions of the content being detected.

The changes include:

More precise terminology for offensive and vulgar language.
A broader classification of intimate and sexual content.
An expanded category addressing child protection, grooming and inappropriate content.
A revised classification for the sharing of personal information.
An expanded category covering references to real and fictional people.

Improved Evaluation Coverage

The stratified test set has increased from 8,935 to 20,076 prompts, providing a larger evaluation sample.

Despite the substantial expansion of the dataset and the revision of the taxonomy, the model maintains an accuracy of 81.01%, compared with 81.31% in version 1.0.

Backward Compatibility

The TF-IDF vectorizer, Logistic Regression classifier, training methodology and Joblib serialization format remain unchanged.

This ensures continuity with existing integrations of Emma Guardrails 1.0, without additional computational requirements or an increase in the serialized model footprint.

Intended Use

Emma Guardrails is intended to classify Italian-language prompts according to predefined safety, content and contextual categories.

Typical applications include:

Input guardrails for LLM-based applications.
Prompt safety classification.
Prompt injection detection.
Output moderation.
Enterprise chatbots and virtual assistants.
Educational platforms and services for minors.
Compliance and auditing systems.
Academic research and benchmarking.
On-premise AI deployments.

The model can be positioned before an LLM to identify prompts that should be blocked or routed through a different handling process, reducing unnecessary inference, token consumption and computational costs.

It can also be applied to generated responses to identify potentially non-compliant content before it is delivered to users.

Classification Categories

Emma Guardrails 2.0 classifies prompts into the following 21 categories:

Categoria non rilevata (Undetected category).
Presenza di personaggi pubblici (Presence of public figures).
Riferimenti a persone reali e immaginarie (References to real and fictional people).
Domande a trabocchetto (Trick questions).
Attività illecite, armi, violenza e comportamenti lesivi (Illegal activities, weapons, violence and harmful behavior).
Contenuti di natura intima e sessuale (Intimate and sexual content).
Richieste di calcolo matematico (Mathematical calculation requests).
Linguaggio volgare, offensivo e grossolano (Vulgar, offensive and coarse language).
Condivisione di informazioni personali (Sharing of personal information).
Opinioni e convinzioni personali (Personal opinions and beliefs).
Apologia e propaganda di ideologie estremiste (Advocacy and propaganda of extremist ideologies).
Avvelenamento e sostanze tossiche (Poisoning and toxic substances).
Domande di attualità (Current affairs questions).
Bestemmie e linguaggio blasfemo (Blasphemy and profane language).
Contenuti discriminatori, stereotipati e d'odio (Discriminatory, stereotypical and hateful content).
Prompt injection e manipolazione del modello (Prompt injection and model manipulation).
Droghe e sostanze illecite (Drugs and illegal substances).
Proverbi, modi di dire, meme e umorismo italiano (Italian proverbs, idioms, memes and humor).
Contenuti su religione, fede e spiritualità (Religion, faith and spirituality).
Identità di genere e orientamento sessuale (Gender identity and sexual orientation).
Tutela dei minori, adescamento e contenuti inappropriati (Child protection, grooming and inappropriate content).

The taxonomy is organized into three operational priority levels.

Critical Categories

The following ten categories are identified by Egomnia S.p.A. as critical and suitable for immediate blocking according to its moderation policy:

Advocacy and propaganda of extremist ideologies.
Discriminatory, stereotypical and hateful content.
Vulgar, offensive and coarse language.
Child protection, grooming and inappropriate content.
Intimate and sexual content.
Drugs and illegal substances.
Illegal activities, weapons, violence and harmful behavior.
Blasphemy and profane language.
Poisoning and toxic substances.
Prompt injection and model manipulation.

Medium-Relevance Categories

These categories require handling according to the moderation policy of the organization deploying the model:

Trick questions.
Personal opinions and beliefs.
Gender identity and sexual orientation.
Sharing of personal information.

Residual Categories

The remaining categories are considered lower priority in the operational taxonomy and can be used to assist the main model in generating an appropriate response.

For example, current affairs questions can be routed to an external information retrieval system, while mathematical calculation requests can be directed to dedicated calculation tools.

Important: The category "Categoria non rilevata" does not guarantee that a prompt is safe or harmless. It only indicates that the prompt has not been assigned to one of the other predefined categories.

Training Data

Emma Guardrails 2.0 was trained on 100,383 real and unique prompts collected from user interactions with Egomnia's Emma-5 and Emma-6 conversational systems.

The dataset includes a wide variety of authentic user requests, such as:

Informational questions.
Mathematical requests.
References to real and fictional people.
Personal opinions and beliefs.
Offensive and vulgar language.
Attempts to manipulate or bypass model instructions.
Potentially harmful or illegal requests.
Sensitive personal information.

Each prompt was manually assigned to one of the 21 predefined classification categories.

Personal data potentially present in the original prompts was irreversibly anonymized before being used for training. This process involved removing elements that could identify or make an individual identifiable.

The distributed Joblib files contain the trained vectorizer and classifier, not the original training prompts.

Dataset Distribution

The training dataset is intentionally imbalanced, reflecting the actual distribution of user interactions rather than an artificially balanced classification benchmark.

The largest category, "Categoria non rilevata", contains 57,693 examples, representing approximately 57.5% of the corpus.

The remaining examples are distributed across the other 20 categories, including both common conversational patterns and less frequent safety-related requests.

The dataset distribution is preserved through stratified sampling during the training/test split.

Model Architecture

Emma Guardrails 2.0 uses a two-stage classical NLP pipeline:

TF-IDF vectorization
Multiclass Logistic Regression

The architecture is identical to Emma Guardrails 1.0.

TF-IDF Vectorization

The text vectorization stage uses TfidfVectorizer from scikit-learn with the following configuration:

TfidfVectorizer(
    lowercase=True,
    stop_words=None,
    ngram_range=(1, 2),
    max_features=10000,
    min_df=2,
    sublinear_tf=True
)

The vectorizer converts Italian text into numerical feature representations using unigram and bigram frequencies.

Classification

The classification stage uses scikit-learn's LogisticRegression configured with:

LogisticRegression(
    max_iter=2000
)

The classifier performs multiclass classification across the 21 predefined categories.

For each input prompt, the model estimates a probability distribution over the available classes and assigns the category with the highest predicted probability.

Performance

Emma Guardrails 2.0 was evaluated on a stratified test set containing 20,076 prompts, corresponding to 20% of the complete corpus.

The reported overall accuracy is:

81.01%

Comparison with Emma Guardrails 1.0

Metric	Emma Guardrails 1.0	Emma Guardrails 2.0
Training prompts	44,677	100,383
Number of categories	21	21
Classification architecture	TF-IDF + Logistic Regression	TF-IDF + Logistic Regression
Training/test split	80% / 20%	80% / 20%
Test samples	8,935	20,076
Accuracy	81.31%	81.01%
Serialized model size	~1.6 MB	~1.6 MB

The accuracy variation between the two versions is 0.30 percentage points, despite the training corpus more than doubling in size and the classification taxonomy being revised.

This result demonstrates the model's ability to maintain comparable classification performance on a significantly expanded dataset.

Because the dataset is strongly imbalanced, accuracy alone should not be interpreted as a complete measure of safety or classification quality.

Operational Impact

Emma Guardrails was developed with the additional objective of reducing unnecessary LLM inference and computational resource consumption.

According to Egomnia's operational data, between October 13 and November 9, 2026, the Emma platform recorded:

78,862 total user-chat interactions.
6,304 prompts blocked by Emma Guardrails 1.0.
8.0% of total interactions intercepted before generation.
Approximately 389,000 output tokens in potential generation avoided.

These figures refer to the operational deployment of version 1.0 and should not be interpreted as independent performance measurements of version 2.0.

The expanded training corpus and improved representation of critical categories in Emma Guardrails 2.0 are intended to further strengthen this preventive approach.

Potential benefits include:

Reduced unnecessary token consumption.
Lower computational workload on inference servers.
Reduced variable inference costs.
Improved availability of hardware resources for legitimate requests.
Prevention of potentially harmful or inappropriate generated responses.

Limitations

Emma Guardrails 2.0 is not an infallible safety system and should not be considered a comprehensive security solution.

Known limitations include:

Class imbalance: Some categories have significantly fewer training examples than others, potentially affecting their classification performance.
Lexical representation: TF-IDF does not fully capture complex semantic relationships, contextual nuances or long-range dependencies.
Accuracy limitations: Overall accuracy can overestimate perceived classification quality on imbalanced datasets.
Vocabulary dependence: The model relies on lexical patterns learned during training and may perform less effectively on unfamiliar expressions, new slang or emerging forms of prompt manipulation.
Confidence interpretation: Predicted probabilities should not automatically be interpreted as calibrated measures of actual safety risk.

An additional methodological limitation concerns the vectorizer fitting procedure. The TF-IDF vectorizer was fitted on the complete corpus before the train/test split. This may make the reported accuracy slightly optimistic because vocabulary information from the test set is available during vectorization.

This methodology was retained in version 2.0 to preserve comparability with version 1.0. Future versions are expected to fit the vectorizer exclusively on the training data.

The model should therefore be deployed as one component of a broader AI safety strategy, ideally combined with human review, monitoring, application-level security controls and periodic updates.

Privacy

The training prompts were irreversibly anonymized before model training.

Emma Guardrails classifies the textual content of individual prompts and is designed as a defensive component rather than a user-surveillance system.

The classification process does not require identification of the user.

The distributed .joblib files contain the trained machine learning components and do not include the original training corpus.

Ethical and Safety Considerations

Emma Guardrails 2.0 is intended to support the detection and mitigation of potentially harmful, sensitive or non-compliant content in Italian-language AI applications.

The model is designed to support safer interactions with generative AI systems and should not be used as the sole mechanism for making high-impact decisions about individuals.

Organizations deploying the model should:

Define their own moderation policies and classification thresholds.
Consider the context in which each category is detected.
Establish appropriate escalation and human-review procedures.
Monitor false positives and false negatives.
Periodically evaluate the model against their specific use case.
Ensure compliance with applicable data protection and AI regulations.

The classification of a prompt into a particular category should not automatically be interpreted as proof of malicious intent or unlawful behavior.

Deployment

Emma Guardrails 2.0 and its TF-IDF vectorizer are distributed together as .joblib files.

Both components are required for inference because the classifier operates on the numerical representations generated by the vectorizer.

The serialized model footprint is approximately 1.6 MB, making it suitable for environments where low latency, limited computational resources and on-premise deployment are important requirements.

The model can be integrated into existing Python applications using scikit-learn and Joblib.

Requirements

pip install scikit-learn joblib

Example

import joblib

# Load the vectorizer and classifier
vectorizer = joblib.load("vectorizer.joblib")
classifier = joblib.load("classifier.joblib")

# Input prompt
prompt = "your Italian prompt here"

# Transform the input text
X = vectorizer.transform([prompt])

# Predict the category
prediction = classifier.predict(X)[0]

# Retrieve class probabilities
probabilities = classifier.predict_proba(X)[0]

# Display results
print("Category:", prediction)
print("Confidence:", probabilities.max())

Note: The vectorizer and classifier must be loaded from the same model release. Predicted probabilities represent the classifier's estimates and are not necessarily calibrated safety-risk scores.

License

Emma Guardrails 2.0 is released as open-source software under the OpenRAIL license.

Users are responsible for evaluating whether the model and its outputs are appropriate for their specific application and regulatory context.

Citation

If you use Emma Guardrails 2.0 in research, academic publications or other public work, please cite the accompanying technical documentation:

Egomnia S.p.A. (2026). "Emma Guardrails 2.0 — The New Open-Source Machine Learning Model for Italian Prompt Safety Classification." Technical Documentation, AI Research & Development Division.

Acknowledgements

Emma Guardrails 2.0 was developed by the AI Research & Development division of Egomnia S.p.A.

The project builds upon the research and development work carried out for Emma Guardrails 1.0, with the objective of improving the coverage, reliability and practical applicability of Italian-language AI safety classification.

egomnia
/

emmaguardrails2.0