# Baszta-1 - a Polish AI safety model for detecting harmful content

Baszta-1 - a Polish AI safety model for detecting harmful content.

Every fortress needs its tower

## A Polish AI safety model for detecting harmful content.

Baszta-1 was built for the Polish language and real-world AI safety challenges. In the whitepaper, we show how we built it, what worked, what did not, and what we learned along the way.

| Model | Params | Safety categories | Training data | Released |
| --- | --- | --- | --- | --- |
| Baszta-1 | 124M | 5 classes: hate speech, vulgarity, sexual content, crime, self-harm | 26K+ examples | September 2026 |

## Manifest

### **Poland cannot just use AI. It also needs the ability to build its own models and safeguards.**

Artificial intelligence is changing how we work, how we learn and how we decide. As AI advances, organisations also need safeguards that let them use it responsibly while effectively managing the risks it introduces.

As regulations such as the AI Act come into force, AI safety is becoming a foundation of responsible deployment.

We did not want Poland to be only a consumer of foreign AI safety solutions. So we set out to build a model of our own.

### Baszta grew out of a need to build AI expertise in Poland.

We focused on our strengths: research and legal expertise, engineering experience, and a deep understanding of the Polish language. Rather than compete on size with the largest models, we specialised.

Our goal was never to produce one more classifier. We wanted to show that Poland can build its own specialised AI solutions - including in AI safety.

### We are sharing the process, not just the result.

We are not showing only the successes. We are also showing the experiments that led nowhere, the limits of the model, and the assumptions we had to revise along the way.

We believe AI advances faster when teams share what they learn. When a Polish AI model succeeds, the whole ecosystem benefits. By sharing what we learned, we hope to help other teams build faster, make better decisions, and develop safer systems. Baszta is our contribution to building Polish expertise in AI safety.

- **Data beat a bigger model** - The largest gain came from fitting the data better, not from another change to the architecture. Synthetic examples reflecting new forms of harmful content helped Baszta handle cases it had not seen before.
- **A safe model should know when it is uncertain** - We found that a model can classify threats correctly while still being too confident when it encounters unfamiliar data. That is why calibration became one of the central parts of Baszta.
- **From lab results to the real world** - We evaluated Baszta both on familiar benchmarks and on new scenarios it had not seen before, to understand where it performs well and where it still needs improvement.

Published: 10 Sept 2026. Authors: Adam Górski, Mateusz Jąkalak, Rafał Jakubowski. Reviewers: Krystian Kozieł, Paweł Wcisło.

## Benchmarks

### Baszta-1 against other guard models

We compare Baszta with HerBERT-PL-Guard, Sójka and Qwen3Guard on public safety benchmarks for Polish.

Models: 4 guard models · Benchmarks: 5 sets · Audit: exact-text overlap

FPR: False-positive rate — the share of safe texts wrongly flagged as harmful. Lower is better.

#### KLEJ CBD

0.669 F1

+21.0 pp HerBERT-PL-Guard · +23.6 pp Sójka · +40.7 pp Qwen3Guard

| Model | F1 | FPR |
| --- | --- | --- |
| Baszta-1 | 0.669 | 10.9% |
| HerBERT-PL-Guard | 0.459 | 26.6% |
| Sójka | 0.433 | 13.1% |
| Qwen3Guard | 0.262 | 2.8% |

Baszta posts the highest F1 in the comparison and the second-lowest FPR.

#### Gadzi Język — Baszta vs Sójka

0.929 micro F1

| Metric | Baszta-1 | Sójka | Difference |
| --- | --- | --- | --- |
| Micro F1 | 0.929 | 0.903 | +2.6 pp |
| Macro F1 | 0.712 | 0.782 | −7.0 pp |

With both models tuned the same way, Baszta’s micro-F1 lead is statistically significant (95% CI: +0.4 to +4.9 pp; p = 0.011), while the macro-F1 difference is not.
Gadzi Język is heavily imbalanced — a naive always-crime baseline reaches 0.910 micro F1.

#### Gadzi Język — guard model comparison

0.906 detection

−8.6 pp HerBERT-PL-Guard · −7.9 pp Qwen3Guard · +23.1 pp Sójka

| Model | Detection rate |
| --- | --- |
| HerBERT-PL-Guard | 0.992 |
| Qwen3Guard | 0.985 |
| Baszta-1 | 0.906 |
| Sójka | 0.675 |

Baszta detects far more harmful prompts than Sójka, but trails HerBERT-PL-Guard and Qwen3Guard.
Gadzi Język contains only harmful examples, so we report recall rather than F1.

#### HateCheck-PL

0.710 F1

−7.6 pp HerBERT-PL-Guard · −7.4 pp Sójka · +7.4 pp Qwen3Guard

| Model | F1 | FPR |
| --- | --- | --- |
| HerBERT-PL-Guard | 0.786 | 59.3% |
| Sójka | 0.784 | 74.5% |
| Baszta-1 | 0.710 | 57.8% |
| Qwen3Guard | 0.636 | 38.4% |

Baszta has lower F1 than HerBERT-PL-Guard and Sójka, but also a lower FPR than both.

#### BAN-PL

0.667 F1

−9.5 pp HerBERT-PL-Guard · −8.7 pp Sójka · +40.4 pp Qwen3Guard

| Model | F1 | FPR |
| --- | --- | --- |
| HerBERT-PL-Guard | 0.762 | 35.4% |
| Sójka | 0.754 | 23.0% |
| Baszta-1 | 0.667 | 85.5% |
| Qwen3Guard | 0.263 | 7.8% |

On BAN-PL, Baszta trails HerBERT-PL-Guard and Sójka on both F1 and false-positive rate.

#### PolyGuard-PL

0.562 F1

−25.4 pp HerBERT-PL-Guard · −20.4 pp Qwen3Guard · +8.7 pp Sójka

| Model | F1 | FPR |
| --- | --- | --- |
| HerBERT-PL-Guard | 0.816 | 7.0% |
| Qwen3Guard | 0.766 | 8.5% |
| Baszta-1 | 0.562 | 35.7% |
| Sójka | 0.475 | 19.7% |

Baszta leads Sójka by 8.7 pp F1, but remains behind HerBERT-PL-Guard and Qwen3Guard.

#### Categories — Baszta vs Sójka

| Category | Baszta-1 | Sójka | Difference |
| --- | --- | --- | --- |
| Self-harm | 0.812 | 0.759 | +5.3 pp |
| Crime | 0.983 | 0.946 | +3.7 pp |
| Hate speech | 0.490 | 0.478 | +1.2 pp |
| Sexual content | 0.476 | 0.727 | −25.1 pp |
| Vulgarity* | 0.800 | 1.000 | −20.0 pp |

Baszta scores higher on self-harm, crime and hate speech; Sójka’s clearest lead is on sexual content.

*The matched test split contains only three vulgar-positive examples, so this estimate is unstable.

#### Training-data overlap

| Benchmark | Overlap | Status |
| --- | --- | --- |
| Gadzi Język | 0 / 520 | Unchanged |
| HateCheck-PL | 0 / 3,815 | Unchanged |
| PolyGuard-PL | 0 / 1,725 | Unchanged |
| KLEJ CBD | 149 / 1,000 | Duplicates removed |
| BAN-PL | 461 / 24,000 | Duplicates removed |
| PL-Guard | 899 / 900 | Set excluded |
| PL-Guard adversarial | 765 / 900 | Set excluded |

Benchmarks were checked for exact duplicates against the data used to build the model. No exact matches were found in Gadzi Język, HateCheck-PL, or PolyGuard-PL. 149 of 1,000 KLEJ CBD records and 461 of 24,000 BAN-PL records were removed. PL-Guard was excluded because 899 of 900 examples were in the training data. The audit detects exact text matches only; it does not identify paraphrases, near-duplicates, or examples derived from a shared source.

## Whitepaper

### How Baszta was built - the data, the experiments, and the lessons.

The Baszta whitepaper covers the full process of building a Polish AI safety model - from data preparation and training experiments to out-of-domain evaluation and an analysis of the model’s limitations.

We do not focus only on the best result. We describe the cases where the model failed, the limits of the benchmarks, and the trade-offs we had to make while building the model.

Trust in AI does not come from promises of perfection. It comes from transparency about methods, data, and decisions.

- Released: 10 September 2026
- Pages: 35
- Authors: Adam Górski, Mateusz Jąkalak, Rafał Jakubowski
- Reviewers: Krystian Kozieł, Paweł Wcisło
- [Download PDF](/Baszta-1.pdf)

## Playground

### Test Baszta-1 on Polish examples of your own.

- Model: Baszta-1
- CPU: 0.5 vCPU
- Memory: 1 GB RAM
- Region: Azure West Europe

Confidence by category: Hate speech, Vulgarity, Sexual content, Crime, Self-harm.

## Contact

### Partnerships, deployments, research.

If you are interested in using Baszta in your AI system or discussing AI safety, get in touch.

- Email us: <marketing@billennium.com>
- Billennium: https://billennium.com/

---

Bastion AI Governance Lab · https://baszta.billennium.com/