{
 "updated": "2026-10-13",
 "paper": {
  "title": "BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views",
  "status": "arXiv preprint",
  "abstract": "Browser agents need to make decisions and execute actions on behalf of users while consuming untrusted webpages, creating opportunities for malicious instructions embedded in webpages to redirect legitimate tasks. We introduce BrowseSafe++, which extends BrowseSafe from 14,719 pages to 38,675 pairs of pages. Most of its prompt injections were observed in the wild on production websites. We keep each injection unchanged and rewrite the sensitive parts of the page around it to protect privacy. Each attacked page has a clean copy of the same page as its control. Both are provided as HTML, Markdown, an accessibility tree, and a screenshot. Every pair includes a user task and its expected answer. The benchmark includes twelve types of websites, from news articles to shared documents and forums, with 24 attack types appearing in 18 different locations on a page. We use these paired pages to train BrowseSafe-Guard, two 0.8B-parameter detectors for text and screenshots. Both achieve higher F1 scores than the detector based on frontier models, while keeping false-positive rates on benign pages and inference cost low. BrowseSafe-Adapt revises benchmark injections from browser-agent feedback, and attacks that succeed on only a few percent of tasks when replayed directly reach up to 95.41% success once adapted.",
  "arxiv": "2610.17457",
  "url": "https://arxiv.org/abs/2610.17457"
 },
 "boards": [
  {
   "id": "text",
   "label": "Detection: text views",
   "title": "Prompt-injection detection across page views",
   "description": "Binary classification of every test page (attacked page or its control) from one text view: raw HTML, Markdown, or the accessibility tree.",
   "population": "18,350 test pages (9,175 attack/control pairs)",
   "views": [
    {
     "id": "avg",
     "label": "Average",
     "derived": true
    },
    {
     "id": "html",
     "label": "HTML"
    },
    {
     "id": "markdown",
     "label": "Markdown"
    },
    {
     "id": "accessibility",
     "label": "Accessibility tree"
    }
   ],
   "default_view": "avg",
   "metrics": [
    {
     "key": "f1",
     "label": "F1",
     "unit": "%",
     "higher_is_better": true
    },
    {
     "key": "acc",
     "label": "Accuracy",
     "unit": "%",
     "higher_is_better": true
    },
    {
     "key": "fpr",
     "label": "FPR",
     "unit": "%",
     "higher_is_better": false,
     "title": "False-positive rate on control pages"
    }
   ],
   "default_sort": "f1",
   "rows": [
    {
     "model": "BrowseSafe-Guard",
     "badges": [
      "guard"
     ],
     "html": {
      "f1": 98.29322590904272,
      "acc": 98.29917599830974,
      "fpr": 1.3522079019649271
     },
     "markdown": {
      "f1": 93.25559407500788,
      "acc": 93.21424796533137,
      "fpr": 7.398795053377022
     },
     "accessibility": {
      "f1": 92.97898508101171,
      "acc": 93.06098721065426,
      "fpr": 5.771060141634076
     }
    },
    {
     "model": "GPT-6 Astra",
     "badges": [],
     "html": {
      "f1": 91.55293631100082,
      "acc": 91.09536784741144,
      "fpr": 14.321525885558582
     },
     "markdown": {
      "f1": 91.29651551804004,
      "acc": 90.78474114441417,
      "fpr": 15.095367847411444
     },
     "accessibility": {
      "f1": 91.54637033959912,
      "acc": 91.12806539509536,
      "fpr": 13.82016348773842
     }
    },
    {
     "model": "Claude Fable 5.1 (all)",
     "badges": [],
     "html": {
      "f1": 86.55760668367603,
      "acc": 85.35694822888283,
      "fpr": 23.57493188010899
     },
     "markdown": {
      "f1": 87.17320261437908,
      "acc": 86.31062670299727,
      "fpr": 20.414168937329702
     },
     "accessibility": {
      "f1": 85.88353413654619,
      "acc": 84.6757493188011,
      "fpr": 23.88010899182561
     }
    },
    {
     "model": "Claude Fable 5.1 (answered)",
     "badges": [],
     "html": {
      "f1": 90.44297832233742,
      "acc": 92.09295071740486,
      "fpr": 6.531591575579846
     },
     "markdown": {
      "f1": 88.6371497751643,
      "acc": 90.43737719234407,
      "fpr": 8.461827754795035
     },
     "accessibility": {
      "f1": 88.46634529548295,
      "acc": 90.23505403975513,
      "fpr": 8.765512736773351
     }
    },
    {
     "model": "Qwen 3.7 Max",
     "badges": [],
     "html": {
      "f1": 88.95875910496254,
      "acc": 88.11283497884344,
      "fpr": 19.698164207681046
     },
     "markdown": {
      "f1": 89.29047390585852,
      "acc": 88.83578771881078,
      "fpr": 15.433333333333334
     },
     "accessibility": {
      "f1": 88.72824631860776,
      "acc": 88.21586519621565,
      "fpr": 16.306417291969986
     }
    },
    {
     "model": "Gemini 3.1 Pro",
     "badges": [],
     "html": {
      "f1": 88.85048390282441,
      "acc": 87.69213997601658,
      "fpr": 22.705471986047527
     },
     "markdown": {
      "f1": 90.07441673370877,
      "acc": 89.23957481602616,
      "fpr": 19.175842145426795
     },
     "accessibility": {
      "f1": 90.7367994324516,
      "acc": 90.03814713896458,
      "fpr": 17.50408719346049
     }
    },
    {
     "model": "Claude Opus 5.5",
     "badges": [],
     "html": {
      "f1": 86.50275323344859,
      "acc": 88.02816901408451,
      "fpr": 4.027655838454785
     },
     "markdown": {
      "f1": 84.88865323435843,
      "acc": 86.90934144801057,
      "fpr": 3.768595041322314
     },
     "accessibility": {
      "f1": 84.43987402789382,
      "acc": 86.28794743996376,
      "fpr": 4.842428900845503
     }
    },
    {
     "model": "GPT-5.5",
     "badges": [],
     "html": {
      "f1": 89.31619640526158,
      "acc": 88.32116788321167,
      "fpr": 20.987925356750825
     },
     "markdown": {
      "f1": 88.9565651522716,
      "acc": 87.94550408719346,
      "fpr": 21.20980926430518
     },
     "accessibility": {
      "f1": 89.6739679014838,
      "acc": 88.85013623978202,
      "fpr": 19.12806539509537
     }
    },
    {
     "model": "Jev 1.13",
     "badges": [],
     "html": {
      "f1": 89.1699795205397,
      "acc": 88.91013384321224,
      "fpr": 13.739237392373925
     },
     "markdown": {
      "f1": 86.98423163562441,
      "acc": 87.07653701380175,
      "fpr": 12.20949263502455
     },
     "accessibility": {
      "f1": 89.0774244297112,
      "acc": 88.9839632798776,
      "fpr": 12.056095905903641
     }
    },
    {
     "model": "Claude Sonnet 5",
     "badges": [],
     "html": {
      "f1": 88.2203057624461,
      "acc": 86.7962871423079,
      "fpr": 25.32118150872955
     },
     "markdown": {
      "f1": 89.5431674388482,
      "acc": 88.55132540634887,
      "fpr": 20.976886175316178
     },
     "accessibility": {
      "f1": 87.44288943394412,
      "acc": 85.76258247450788,
      "fpr": 27.638464893153074
     }
    },
    {
     "model": "Gemini 3.1 Flash-Lite",
     "badges": [],
     "html": {
      "f1": 79.9711100076739,
      "acc": 75.6476399560922,
      "fpr": 45.938529088913285
     },
     "markdown": {
      "f1": 79.50928708676159,
      "acc": 77.33267931109658,
      "fpr": 33.28973185088293
     },
     "accessibility": {
      "f1": 83.22505917308757,
      "acc": 81.84741144414168,
      "fpr": 26.365122615803816
     }
    },
    {
     "model": "GPT-5.4 nano",
     "badges": [],
     "html": {
      "f1": 77.98140290692426,
      "acc": 73.22869216837715,
      "fpr": 48.35345773874863
     },
     "markdown": {
      "f1": 71.81211693876445,
      "acc": 71.67847411444141,
      "fpr": 28.795640326975477
     },
     "accessibility": {
      "f1": 78.42857821481165,
      "acc": 75.2534059945504,
      "fpr": 39.46594005449591
     }
    },
    {
     "model": "DeepSeek V3.1",
     "badges": [
      "open"
     ],
     "html": {
      "f1": 79.06028870648174,
      "acc": 79.69367588932806,
      "fpr": 17.281510759771628
     },
     "markdown": {
      "f1": 70.3816406745277,
      "acc": 74.53950953678473,
      "fpr": 11.422343324250681
     },
     "accessibility": {
      "f1": 76.2518054886856,
      "acc": 78.47010039284156,
      "fpr": 12.179417221434027
     }
    },
    {
     "model": "Claude Haiku 4.5",
     "badges": [],
     "html": {
      "f1": 73.89810867855813,
      "acc": 65.45056149000274,
      "fpr": 66.91861101982693
     },
     "markdown": {
      "f1": 71.8001822549913,
      "acc": 62.8991825613079,
      "fpr": 68.66485013623978
     },
     "accessibility": {
      "f1": 72.60774287801314,
      "acc": 63.2092440180956,
      "fpr": 71.09996729532322
     }
    },
    {
     "model": "GPT-OSS 20B",
     "badges": [
      "open"
     ],
     "html": {
      "f1": 72.19107181367264,
      "acc": 71.63128368716313,
      "fpr": 30.335718216840945
     },
     "markdown": {
      "f1": 70.10550996483,
      "acc": 73.58089317847211,
      "fpr": 14.835404403749727
     },
     "accessibility": {
      "f1": 70.62720151411598,
      "acc": 69.36951754385964,
      "fpr": 34.94794520547945
     }
    },
    {
     "model": "Qwen3 30B-A3B",
     "badges": [
      "open"
     ],
     "html": {
      "f1": 68.95599337138648,
      "acc": 62.918568208060705,
      "fpr": 56.56043956043956
     },
     "markdown": {
      "f1": 61.61318658605901,
      "acc": 59.50395203052603,
      "fpr": 46.00544959128065
     },
     "accessibility": {
      "f1": 66.55332302936631,
      "acc": 64.51683428071709,
      "fpr": 41.59746503496503
     }
    },
    {
     "model": "Mistral NeMo",
     "badges": [
      "open"
     ],
     "html": {
      "f1": 54.3859649122807,
      "acc": 54.3859649122807,
      "fpr": 44.642857142857146
     },
     "markdown": {
      "f1": 60.641562064156204,
      "acc": 57.85543608124253,
      "fpr": 52.434247341913824
     },
     "accessibility": {
      "f1": 64.09130816505707,
      "acc": 56.71957671957672,
      "fpr": 63.46153846153846
     }
    },
    {
     "model": "Llama 3.1 8B",
     "badges": [
      "open"
     ],
     "html": {
      "f1": 19.75771200199825,
      "acc": 54.75352112676056,
      "fpr": 1.411631846414455
     },
     "markdown": {
      "f1": 26.150422785936804,
      "acc": 54.779812513625465,
      "fpr": 6.453019402659691
     },
     "accessibility": {
      "f1": 23.385654679117824,
      "acc": 54.45848588638243,
      "fpr": 4.7252486972998575
     }
    }
   ],
   "notes": [
    "Private test split, 18,350 pages. Prompted models use the published BrowseSafe detection prompt.",
    "Jev 1.13 is queried through its native typed-probability interface with the same policy text and a fixed 0.5 threshold.",
    "Claude Fable 5.1 refuses 25–30% of pages. Fable 5.1 (all) scores every page with a refusal counted as a flag; Fable 5.1 (answered) scores only the pages it answered.",
    "FPR is the false-positive rate on control pages, in percent; lower is better.",
    "Average is the unweighted mean of the HTML, Markdown and accessibility-tree values, computed by this site. The paper reports the three views separately."
   ]
  },
  {
   "id": "screenshot",
   "label": "Detection: screenshot",
   "title": "Screenshot classification",
   "description": "Binary classification from the full-page screenshot alone, for image-capable models.",
   "population": "Test split, full-page screenshot view",
   "views": [
    {
     "id": "screenshot",
     "label": "Full-page screenshot"
    }
   ],
   "default_view": "screenshot",
   "metrics": [
    {
     "key": "f1",
     "label": "F1",
     "unit": "%",
     "higher_is_better": true
    },
    {
     "key": "acc",
     "label": "Accuracy",
     "unit": "%",
     "higher_is_better": true
    },
    {
     "key": "fpr",
     "label": "FPR",
     "unit": "%",
     "higher_is_better": false,
     "title": "False-positive rate on control pages"
    }
   ],
   "default_sort": "f1",
   "rows": [
    {
     "model": "BrowseSafe-Guard (multi-modal)",
     "badges": [
      "guard"
     ],
     "screenshot": {
      "f1": 93.31775204504409,
      "acc": 93.35516585675047,
      "fpr": 6.084935558842172
     }
    },
    {
     "model": "Gemini 3.1 Flash-Lite",
     "badges": [],
     "screenshot": {
      "f1": 78.69712154760518,
      "acc": 77.5512710303328,
      "fpr": 28.083700440528634
     }
    },
    {
     "model": "Claude Haiku 4.5",
     "badges": [],
     "screenshot": {
      "f1": 64.80670586763418,
      "acc": 65.24156678611145,
      "fpr": 33.82533825338253
     }
    },
    {
     "model": "GPT-5.4 nano",
     "badges": [],
     "screenshot": {
      "f1": 37.5306314797361,
      "acc": 59.15197830642179,
      "fpr": 6.719803801348866
     }
    },
    {
     "model": "Qwen3-VL 30B-A3B",
     "badges": [
      "open"
     ],
     "screenshot": {
      "f1": 34.461821527138916,
      "acc": 55.50836872345741,
      "fpr": 12.465685051160468
     }
    }
   ],
   "notes": [
    "Full-page screenshot only; no text view is given to the model.",
    "The paper prints short names (Flash-Lite, Haiku 4.5, Qwen3-VL 30B); they are expanded here.",
    "FPR is in percent; lower is better."
   ]
  },
  {
   "id": "adaptive",
   "label": "Adaptive attacks",
   "title": "Attack success before and after revision (BrowseSafe-Adapt)",
   "description": "Browser-agent targets attacked with benchmark injections. Seed replays the observed injection once; Adapted lets BrowseSafe-Adapt revise it from agent feedback for up to 64 attempts, stopping at the first success.",
   "population": "1,024 tasks per target",
   "views": [
    {
     "id": "adaptive",
     "label": "Attack success rate"
    }
   ],
   "default_view": "adaptive",
   "metrics": [
    {
     "key": "seed",
     "label": "Seed ASR",
     "unit": "%",
     "higher_is_better": false,
     "title": "Success of the observed injection's first attempt"
    },
    {
     "key": "adapted",
     "label": "Adapted ASR",
     "unit": "%",
     "higher_is_better": false,
     "title": "Success within 64 attempts"
    },
    {
     "key": "answer",
     "label": "Answer goals",
     "unit": "%",
     "higher_is_better": false,
     "title": "Adapted ASR on goals met through the agent's answer"
    },
    {
     "key": "state",
     "label": "State goals",
     "unit": "%",
     "higher_is_better": false,
     "title": "Adapted ASR on goals met only through a change in application state"
    }
   ],
   "default_sort": "adapted",
   "rows": [
    {
     "model": "Claude Sonnet 5",
     "badges": [],
     "adaptive": {
      "seed": 2.05078125,
      "adapted": 30.6640625,
      "state": 7.903780068728523,
      "answer": 40.57142857142857
     }
    },
    {
     "model": "GPT-5.5",
     "badges": [],
     "adaptive": {
      "seed": 0.48828125,
      "adapted": 65.234375,
      "state": 28.522336769759452,
      "answer": 81.42857142857143
     }
    },
    {
     "model": "Claude Haiku 4.5",
     "badges": [],
     "adaptive": {
      "seed": 0.5859375,
      "adapted": 78.80859375,
      "state": 59.450171821305844,
      "answer": 86.0
     }
    },
    {
     "model": "Gemini 3.1 Pro",
     "badges": [],
     "adaptive": {
      "seed": 2.9296875,
      "adapted": 92.87109375,
      "state": 83.50515463917526,
      "answer": 96.85714285714286
     }
    },
    {
     "model": "Gemini 3.5 Flash-Lite",
     "badges": [],
     "adaptive": {
      "seed": 4.00390625,
      "adapted": 93.5546875,
      "state": 82.13058419243987,
      "answer": 98.0
     }
    },
    {
     "model": "DeepSeek V3.1",
     "badges": [
      "open"
     ],
     "adaptive": {
      "seed": 2.9296875,
      "adapted": 95.01953125,
      "state": 90.03436426116839,
      "answer": 96.85714285714286
     }
    },
    {
     "model": "Kimi K2",
     "badges": [
      "open"
     ],
     "adaptive": {
      "seed": 0.5859375,
      "adapted": 95.41015625,
      "state": 91.40893470790378,
      "answer": 97.0
     }
    }
   ],
   "notes": [
    "Rates are attack success in percent. A higher rate means a more vulnerable target, so targets are ranked from most to least robust.",
    "Budget: 64 attempts per task, stopping at the first success.",
    "Answer goals are met through the agent's answer; state goals only through a change in application state."
   ]
  }
 ],
 "model_cards": {
  "DeepSeek V3.1": {
   "url": "https://huggingface.co/deepseek-ai/DeepSeek-V3.1"
  },
  "GPT-OSS 20B": {
   "url": "https://huggingface.co/openai/gpt-oss-20b"
  },
  "Qwen3 30B-A3B": {
   "url": "https://huggingface.co/Qwen/Qwen3-30B-A3B-Instruct-2507"
  },
  "Mistral NeMo": {
   "url": "https://huggingface.co/mistralai/Mistral-Nemo-Instruct-2407"
  },
  "Llama 3.1 8B": {
   "url": "https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct"
  },
  "Qwen3-VL 30B-A3B": {
   "url": "https://huggingface.co/Qwen/Qwen3-VL-30B-A3B-Instruct"
  },
  "Kimi K2": {
   "url": "https://huggingface.co/moonshotai/Kimi-K2-Instruct"
  }
 },
 "badges": {
  "guard": {
   "label": "Fine-tuned guard",
   "title": "Detector fine-tuned on BrowseSafe++ training pairs (paper result; weights not released)"
  },
  "open": {
   "label": "Open weights",
   "title": "Model weights are publicly available"
  }
 },
 "efficiency": {
  "models": {
   "GPT-5.5": {
    "latency_s": 2.5,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 56.24,
    "tokens_in": 10723,
    "tokens_out": 87,
    "price_in_per_m": 5.0,
    "price_out_per_m": 30.0
   },
   "Claude Sonnet 5": {
    "latency_s": 4.6,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 35.003,
    "tokens_in": 16083,
    "tokens_out": 284,
    "price_in_per_m": 2.0,
    "price_out_per_m": 10.0
   },
   "Gemini 3.1 Flash-Lite": {
    "latency_s": 1.35,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 3.171,
    "tokens_in": 12124,
    "tokens_out": 93,
    "price_in_per_m": 0.25,
    "price_out_per_m": 1.5
   },
   "GPT-5.4 nano": {
    "latency_s": 1.39,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 2.236,
    "tokens_in": 10725,
    "tokens_out": 73,
    "price_in_per_m": 0.2,
    "price_out_per_m": 1.25
   },
   "DeepSeek V3.1": {
    "latency_s": 12.51,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 3.27,
    "tokens_in": 11312,
    "tokens_out": 465,
    "price_in_per_m": 0.25,
    "price_out_per_m": 0.95,
    "params_b": 671.0,
    "active_params_b": 37.0,
    "open_weights": true
   },
   "Claude Haiku 4.5": {
    "latency_s": 4.45,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 14.815,
    "tokens_in": 13394,
    "tokens_out": 284,
    "price_in_per_m": 1.0,
    "price_out_per_m": 5.0
   },
   "GPT-OSS 20B": {
    "latency_s": 3.81,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 0.196,
    "tokens_in": 10725,
    "tokens_out": 38,
    "price_in_per_m": 0.018,
    "price_out_per_m": 0.09,
    "params_b": 21.0,
    "active_params_b": 3.6,
    "open_weights": true
   },
   "Qwen3 30B-A3B": {
    "latency_s": 8.21,
    "latency_n": 179,
    "cost_usd_per_1k_pages": 0.602,
    "tokens_in": 11808,
    "tokens_out": 172,
    "price_in_per_m": 0.0481,
    "price_out_per_m": 0.193,
    "params_b": 30.5,
    "active_params_b": 3.3,
    "open_weights": true
   },
   "Mistral NeMo": {
    "latency_s": 3.69,
    "latency_n": 171,
    "cost_usd_per_1k_pages": 0.228,
    "tokens_in": 11913,
    "tokens_out": 70,
    "price_in_per_m": 0.019,
    "price_out_per_m": 0.03,
    "params_b": 12.2,
    "active_params_b": 12.2,
    "open_weights": true
   },
   "Llama 3.1 8B": {
    "latency_s": 1.38,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 0.558,
    "tokens_in": 11069,
    "tokens_out": 57,
    "price_in_per_m": 0.05,
    "price_out_per_m": 0.08,
    "params_b": 8.0,
    "active_params_b": 8.0,
    "open_weights": true
   },
   "Jev 1.13": {
    "latency_s": 0.95,
    "latency_n": 52191,
    "latency_basis": "median per-call seconds in the Jev run (52,191 calls)",
    "cost_usd_per_1k_pages": 0.521,
    "tokens_in": 12403,
    "tokens_out": 22,
    "price_in_per_m": 0.042,
    "price_out_per_m": 0.0
   },
   "GPT-6 Astra": {
    "latency_s": 3.36,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 111.084,
    "tokens_in": 10711,
    "tokens_out": 79,
    "price_in_per_m": 10.0,
    "price_out_per_m": 50.0
   },
   "Claude Opus 5.5": {
    "latency_s": 5.08,
    "latency_n": 174,
    "cost_usd_per_1k_pages": 68.202,
    "tokens_in": 15844,
    "tokens_out": 241,
    "price_in_per_m": 4.0,
    "price_out_per_m": 20.0
   },
   "Gemini 3.1 Pro": {
    "latency_s": 7.65,
    "latency_n": 180,
    "cost_usd_per_1k_pages": 25.079,
    "tokens_in": 12102,
    "tokens_out": 73,
    "price_in_per_m": 2.0,
    "price_out_per_m": 12.0
   },
   "Qwen 3.7 Max": {
    "latency_s": 13.4,
    "latency_n": 179,
    "cost_usd_per_1k_pages": 18.947,
    "tokens_in": 12095,
    "tokens_out": 250,
    "price_in_per_m": 1.475,
    "price_out_per_m": 4.425
   },
   "Claude Fable 5.1 (all)": {
    "latency_s": 9.64,
    "latency_n": 153,
    "cost_usd_per_1k_pages": 180.614,
    "tokens_in": 15896,
    "tokens_out": 433,
    "price_in_per_m": 10.0,
    "price_out_per_m": 50.0
   },
   "Claude Fable 5.1 (answered)": {
    "latency_s": 9.64,
    "latency_n": 153,
    "cost_usd_per_1k_pages": 180.614,
    "tokens_in": 15896,
    "tokens_out": 433,
    "price_in_per_m": 10.0,
    "price_out_per_m": 50.0
   },
   "BrowseSafe-Guard": {
    "latency_s": 0.146,
    "latency_basis": "amortized H200 GPU time per page (paper, Appendix C.3)",
    "cost_usd_per_1k_pages": 0.181,
    "cost_basis": "H200 at $4.47 per GPU-hour",
    "params_b": 0.8,
    "active_params_b": 0.8,
    "open_weights": false
   }
  },
  "notes": [
   "Accuracy is the unweighted mean over the HTML, Markdown and accessibility-tree views (paper Table 2).",
   "Latency: median seconds per page for one detection call to the model provider, measured 2026-10-01 on 180 test pages per model (30 pairs, three views) with at most 4 calls in flight; Jev 1.13 is the median of its own run's 52,191 calls; BrowseSafe-Guard is its per-page GPU time from the paper.",
   "Cost: mean input and output tokens per test page in the paper's run times OpenRouter list prices on 2026-10-01, per 1,000 pages. BrowseSafe-Guard (fine-tuned from Qwen3.5-0.8B) is priced as the paper evaluation's measured GPU time (146 ms per page, overlapping 512-token windows, not optimised for throughput) on an H200 at the median on-demand price of $4.47 per GPU-hour on 2026-10-01; this is an upper bound, and a throughput-optimised server would be several times cheaper. API prices are shared commercial serving rates; Jev 1.13 uses its OpenRouter endpoint price ($0.042 per million input tokens, output free).",
   "Size: total parameters as published by the model developers; mixture-of-experts models also show active parameters. Models whose developers have not published a parameter count (all closed API models) are not plotted."
  ]
 }
}