RemoteBAGEL: Distributed Domain Adaptations

• RemoteBAGEL is a polysemous term referring to distributed adaptations of the BAGEL framework in LLM safety, federated learning security, and remote sensing world modeling.
• In LLM guardrail applications, it deploys ensembles of lightweight prompt classifiers routed by a random forest, achieving high F1 scores with a fraction of the parameters of larger models.
• For remote sensing, RemoteBAGEL fine-tunes a BAGEL-7B model for direction-conditioned spatial extrapolation, enabling robust generation of semantically consistent adjacent satellite tiles.

RemoteBAGEL is a polysemous research term that appears in at least three distinct arXiv contexts: as a production-oriented deployment pattern for BAGEL, a malicious-prompt detection framework for LLM guardrailing (Hassan et al., 8 Feb 2026); as a label for remote, distributed backdoor injection in Federated Contrastive Learning (FCL) within the BAGEL attack framework (Huang et al., 2023); and as the name of a remote sensing–oriented world model for direction-conditioned spatial extrapolation of satellite tiles (Lu et al., 22 Sep 2025). These usages are methodologically unrelated, but each centers on distributed or remote settings and on the adaptation of a BAGEL-named method to a domain-specific systems problem.

1. Terminological scope and disambiguation

The term “RemoteBAGEL” does not denote a single canonical method across the literature. In LLM safety, it refers to a deployment pattern of BAGEL (Bootstrap AGgregated Ensemble Layer) designed for remote or distributed services, where a lightweight router selects among specialized prompt-safety classifiers (Hassan et al., 8 Feb 2026). In federated learning security, it is used to describe remote, distributed backdoor injection against a global encoder trained by Federated Contrastive Learning, with malicious clients implanting targeted triggers into downstream feature geometry (Huang et al., 2023). In remote sensing, it names a unified multimodal model fine-tuned from BAGEL-7B to generate semantically consistent adjacent image tiles conditioned on grid directions (Lu et al., 22 Sep 2025).

This multiplicity matters because the three lines of work share a label but not a common technical substrate. One addresses prompt moderation for LLMs, one addresses adversarial poisoning in distributed representation learning, and one addresses geospatial world modeling. A plausible implication is that any technical discussion of “RemoteBAGEL” requires immediate domain qualification to avoid category errors.

2. RemoteBAGEL as a distributed LLM guardrail

In "Efficient and Adaptable Detection of Malicious LLM Prompts via Bootstrap Aggregation" (Hassan et al., 8 Feb 2026), RemoteBAGEL is a production-oriented deployment pattern of BAGEL for detecting malicious prompts that induce unsafe or policy-violating behavior, including simple harmful requests, jailbreaks, and prompt injection attacks. Its central design claim is that ensembles of small, specialized prompt-safety classifiers, coupled with an interpretable router and stochastic aggregation, can match or surpass billion-parameter guardrails while remaining easier to deploy, update, and operate at low latency and cost.

The system has three primary components. First, a random forest router trained on lightweight structural prompt features predicts the most suitable specialized classifier and yields probabilities usable as mixture-of-experts gating. Second, the ensemble consists of fine-tuned prompt-safety classifiers, each an 86M-parameter Prompt Guard 2 model fine-tuned on a different attack dataset. Third, inference uses stochastic selection and aggregation: the top routed expert is always included, additional experts are sampled, and their maliciousness scores are aggregated.

The training design departs from classic bagging. Rather than bootstrap resamples from one dataset, the method uses a dataset family $D = \{D_1, \ldots, D_k\}$, where each expert $M_i$ is fine-tuned on a different dataset representing a distinct attack taxonomy. The router is trained on the cumulative calibration set $C_{\text{global}} = \cup_i D_i^{\text{cal}}$ and operates on interpretable structural features such as prompt_length, whitespace_proportion, special_char_proportion, avg_word_length, digit_proportion, uppercase_proportion, code_keyword_count, nl_word_count, and shannon_entropy (Hassan et al., 8 Feb 2026).

The routing and aggregation equations are explicitly specified. The router computes

$p(i \mid x) = P(C_i \mid f(x)),$

with top expert

$i^* = \arg\max_i p(i \mid x).$

For selection size $n$, the chosen subset is

$$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$

The default prediction is the unweighted mean

$\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$

while a weighted variant uses router probabilities:

$$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$

Binary classification then applies a calibrated threshold $\tau$:

$M_i$0

The production orientation follows directly from the modularity of the experts. Each promptcop is an independent microservice based on an 86M model. The router is a small random forest that can run in-process, on CPUs, or at the edge. Only a subset of experts is queried per request, so remote or distributed routing reduces network and compute overhead. The details explicitly note deployment near traffic sources as edge PoPs or, alternatively, centralized batch moderation, with weighted aggregation performed either at the router or at a lightweight aggregator service (Hassan et al., 8 Feb 2026).

3. Performance, interpretability, and incremental updates in the guardrail setting

The reported operating point is achieved with $M_i$1, where BAGEL reaches $M_i$2, $M_i$3, and $M_i$4 using an effective footprint of approximately 430M parameters, i.e., $M_i$5M (Hassan et al., 8 Feb 2026). The paper states that this is 45% smaller than querying the full ensemble of nine experts, and that performance saturates around $M_i$6: increasing from $M_i$7 to $M_i$8 yields only marginal gains, with ASR changing approximately from $M_i$9 to $C_{\text{global}} = \cup_i D_i^{\text{cal}}$0 and FPR from $C_{\text{global}} = \cup_i D_i^{\text{cal}}$1 to $C_{\text{global}} = \cup_i D_i^{\text{cal}}$2.

The baseline comparisons situate this result against larger or less adaptable systems. ShieldGemma, at 2B parameters, reports $C_{\text{global}} = \cup_i D_i^{\text{cal}}$3, $C_{\text{global}} = \cup_i D_i^{\text{cal}}$4, and $C_{\text{global}} = \cup_i D_i^{\text{cal}}$5; ToxicDetector, using a 300M MLP plus 7B LLM embeddings, reports $C_{\text{global}} = \cup_i D_i^{\text{cal}}$6, $C_{\text{global}} = \cup_i D_i^{\text{cal}}$7, and $C_{\text{global}} = \cup_i D_i^{\text{cal}}$8; the OpenAI Moderation API reports $C_{\text{global}} = \cup_i D_i^{\text{cal}}$9, $p(i \mid x) = P(C_i \mid f(x)),$0, and $p(i \mid x) = P(C_i \mid f(x)),$1; Perspective API reports $p(i \mid x) = P(C_i \mid f(x)),$2, $p(i \mid x) = P(C_i \mid f(x)),$3, and $p(i \mid x) = P(C_i \mid f(x)),$4; and LastLayer reports $p(i \mid x) = P(C_i \mid f(x)),$5, $p(i \mid x) = P(C_i \mid f(x)),$6, and $p(i \mid x) = P(C_i \mid f(x)),$7 (Hassan et al., 8 Feb 2026). The stated interpretation is that BAGEL attains the top F1 with far fewer parameters than billion-scale guardrails while remaining tunable and interpretable.

Interpretability is rooted in the router. Spearman correlation and Ward’s hierarchical clustering reveal coherent feature clusters; for example, whitespace_proportion and avg_word_length are strongly negatively correlated, while prompt_length and nl_word_count are positively correlated. Feature pruning from nine to five features—prompt_length, whitespace_proportion, special_char_proportion, digit_proportion, and uppercase_proportion—reduces router accuracy only slightly, from $p(i \mid x) = P(C_i \mid f(x)),$8 to $p(i \mid x) = P(C_i \mid f(x)),$9, while improving efficiency (Hassan et al., 8 Feb 2026). Tree-based routing also enables auditable paths and feature importance rankings.

The incremental update path is a major systems property. When new attacks appear, a new dataset $i^* = \arg\max_i p(i \mid x).$0 is curated, a new 86M promptcop $i^* = \arg\max_i p(i \mid x).$1 is fine-tuned on $i^* = \arg\max_i p(i \mid x).$2, the model is added to the ensemble, and the random forest is retrained on the updated $i^* = \arg\max_i p(i \mid x).$3. No end-to-end retraining is required. After nine incremental updates, the final F1 never dropped below $i^* = \arg\max_i p(i \mid x).$4, with threshold recalibration performed each time via a coarse-to-fine search using approximately 20 evaluations over $i^* = \arg\max_i p(i \mid x).$5 (Hassan et al., 8 Feb 2026). This suggests a continual-learning regime implemented through ensemble accretion rather than monolithic retraining.

4. RemoteBAGEL as backdoor injection in Federated Contrastive Learning

In "BAGEL: Backdoor Attacks against Federated Contrastive Learning" (Huang et al., 2023), RemoteBAGEL denotes remote, distributed backdoor injection in Federated Contrastive Learning. The setting consists of $i^* = \arg\max_i p(i \mid x).$6 remote clients training a global, task-agnostic encoder on unlabeled, generally non-IID data. At each communication round $i^* = \arg\max_i p(i \mid x).$7, the server sends the current global encoder $i^* = \arg\max_i p(i \mid x).$8 to a subset of $i^* = \arg\max_i p(i \mid x).$9 clients; each client performs $n$0 local contrastive-learning steps and returns an update for aggregation.

The local contrastive objective is InfoNCE with SimCLR-style positives and negatives. For a mini-batch of size $n$1, each sample is augmented twice to produce $n$2 views. Denoting encoder output by $n$3 and projection-head output by $n$4, the positive-pair loss is

$n$5

Server aggregation is implemented in delta-based FedAvg form:

$n$6

The threat model assumes that $n$7 of the $n$8 clients are malicious remote participants. They can fully control local training, poison all or part of local data, alter losses or objectives, and scale updates in one-shot attacks. They cannot alter server aggregation or benign-client training, and they do not participate in downstream training. The attack is targeted: whenever a trigger is present, downstream models built on top of the global encoder should predict attacker-chosen target labels (Huang et al., 2023).

The attack intuition is geometric. Attackers try to force the global encoder to map any trigger-embedded input $n$9 to an embedding close to attacker-selected reference embeddings $$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$0 for target classes $$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$1 associated with downstream tasks $$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$2. The details mention examples such as SVHN, CIFAR-10, and GTSRB as downstream tasks, and target labels such as “one,” “truck,” and “yield sign.” Triggers may be small white square patches, and in the implementation attackers poison all their local samples, with poisoning ratio approximately $$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$3.

At round $$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$4, a malicious client initializes $$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$5 and optimizes a three-term objective:

$$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$6

$$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$7

$$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$8

The combined objective is

$$S_x = \{M_{i^*}\} \cup \{M_{\text{rand}_1}, \ldots, M_{\text{rand}_{n-1}}\}.$$9

The paper sets $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$0 and has attackers train for more local epochs, such as 10, than benign clients, such as 1, before uploading $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$1 (Huang et al., 2023).

The three-term structure explicitly encodes stealth. $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$2 aligns outputs on references with those of the current global encoder, and $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$3 keeps clean-input features similar to $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$4, thereby preserving clean-task utility and reducing conspicuous drift. In one-shot attacks, malicious deltas may be scaled by a factor $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$5 to amplify the backdoor while attempting to remain within clipping thresholds if defenses are present.

5. Centralized and decentralized RemoteBAGEL in FCL

The FCL paper distinguishes centralized and decentralized BAGEL. In centralized BAGEL, multiple malicious clients share the same attack goals and triggers. All attempt to implant the same set of task-target pairs and corresponding triggers, so their poisoned updates are similar and reinforce one another during aggregation. This effectively injects a universal backdoor that transfers across downstream tasks (Huang et al., 2023).

In decentralized BAGEL, each malicious client has a distinct target pair and its own trigger. The poisoned updates therefore differ in direction, creating a multi-target, multi-trigger backdoor portfolio across tasks. The paper states that this diversity evades defenses that penalize similar updates, making the attack more stealthy and harder to filter (Huang et al., 2023). It also concludes that the decentralized backdoor attack is more stealthy and harder to defend than the centralized attack.

This usage of RemoteBAGEL is conceptually opposite to the LLM-guardrail usage. In the guardrail setting, remote modularity is a systems advantage enabling selective inference, low latency, and incremental adaptation (Hassan et al., 8 Feb 2026). In the FCL setting, remote participation is the attack surface: distributed clients exploit the server’s inability to inspect raw local data and the broad reuse of the global encoder across downstream tasks (Huang et al., 2023). The shared vocabulary of “remote” therefore reflects distributed execution rather than any shared algorithmic lineage.

6. RemoteBAGEL as a remote sensing–oriented world model

In "Remote Sensing-Oriented World Model" (Lu et al., 22 Sep 2025), RemoteBAGEL is the first remote sensing–oriented world model designed for direction-conditioned spatial extrapolation of satellite tiles. The task is to generate a semantically consistent adjacent tile given a central observation and a directional instruction. The paper frames this as a response to the limitation that many world models are validated in synthetic environments or constrained scenes, whereas remote sensing requires reasoning over broad spatial coverage and complex semantics.

The paper defines each evaluation instance as a triplet:

“Each evaluation instance is represented by a triplet $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$6, where $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$7 denotes the observed central tile of a geographic region, $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$8 is the directional instruction, and $\hat{y}(x) = \frac{1}{n}\sum_{M_j \in S_x} p_j(x),$9 is the ground-truth adjacent tile.”

The model learns the conditional distribution

$$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$0

and at inference samples

$$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$1

Directions are defined in the image-grid coordinate frame—up, down, left, right—rather than cardinal North–South–East–West (Lu et al., 22 Sep 2025).

The training objective is explicitly reconstruction-centric. With action-conditioned mapping

$$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$2

the model computes

$$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$3

and minimizes the pixel-level loss

$$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$4

The paper explicitly states that it follows a simple default recipe without adding perceptual, semantic, or geometry-aware losses, instead relying on trajectory-based supervision from overlapping $$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$5 grids to promote spatial continuity (Lu et al., 22 Sep 2025).

Architecturally, the model uses a visual encoder for the central tile, a discrete direction or instruction encoder for $$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$6, fusion via cross-modal and self-attention, and a generative decoder that outputs the adjacent tile. The direction is encoded as a discrete conditioning token or embedding that modulates generation. RemoteBAGEL itself is obtained by fine-tuning BAGEL-7B, described as a unified multimodal model, on remote sensing action-conditioned pairs (Lu et al., 22 Sep 2025).

Training data are assembled from Sky-SA for general scenarios, FloodNet for flood, and LoveDA for urban and rural scenarios. Nearly 4,000 images are partitioned into overlapping $$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$7 tiles to yield 10,080 direction-labeled training pairs. Directional prompts are standardized as “Look up at this picture,” “Look down at this picture,” “Look left at this picture,” and “Look right at this picture.” Data filtering includes cloud cover thresholds, resolution consistency, temporal alignment, automated artifact checks, and manual geographic coherence inspection (Lu et al., 22 Sep 2025).

7. RSWISE evaluation, empirical results, and cross-domain significance

The remote sensing paper introduces RSWISE (Remote Sensing World-Image Spatial Evaluation), a benchmark with 1,600 evaluation tasks across four scenarios: general, flood, urban, and rural (Lu et al., 22 Sep 2025). The benchmark jointly evaluates distributional fidelity and instruction compliance. FID is normalized to $$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$8 and inverted so that higher is better; GPT-4o assigns a spatial-reasoning score on $$\hat{y}_w(x) = \frac{\sum_{M_j \in S_x} p(j \mid x)\cdot p_j(x)}{\sum_{M_j \in S_x} p(j \mid x)}.$$9, normalized to $\tau$0. The combined score is

$\tau$1

with default weights $\tau$2 and $\tau$3.

The reported aggregate RSWISE scores are:

Model	Scenario scores	Average
RemoteBAGEL	General 95.7, Flood 78.0, Urban 87.3, Rural 94.3	88.8
BAGEL	64.3, 64.2, 62.3, 58.7	62.4
Qwen-Image-Edit	46.9, 52.1, 56.5, 57.2	53.2
Step1X-Edit	51.7, 17.3, 58.5, 55.0	45.6
FLUX.1-Kontext-Dev	40.0, 18.7, 43.7, 41.8	36.1

RemoteBAGEL also reports scenario-mean FID values of 158.44, 232.06, 206.42, and 189.06 for general, flood, urban, and rural, respectively, with average 196.0, and GPT-4o semantic scores of 8.5489, 7.5600, 8.3475, and 8.9825, with average 8.86 (Lu et al., 22 Sep 2025). The stated conclusion is that the domain-adapted model performs genuine spatial reasoning and continuity rather than simple texture replication.

The analysis notes directional anisotropy: left-right continuations are generally easier, reflected in lower FID, than up-down continuations. Vertical continuations often cross heterogeneous transitions such as urban-rural or land-water boundaries, increasing error. Scenario-wise, the largest gains occur in structured, pattern-rich environments such as general and rural scenes; gains are moderate in urban settings and smallest in flood settings, where dynamic, irregular inundation boundaries remain challenging (Lu et al., 22 Sep 2025).

The computational profile is also specified. Fine-tuning BAGEL-7B to RemoteBAGEL used 4× H100 (80 GB) GPUs over approximately 20 hours. Evaluation required about 8,000 runs on 10× A100 (80 GB) GPUs over approximately 80 hours. The paper explicitly does not claim real-time operation and notes that the 7B-scale base implies substantial memory requirements, with deployment at scale likely requiring batching and potentially distillation or quantization (Lu et al., 22 Sep 2025).

Taken together, the three usages of RemoteBAGEL illustrate how a shared label can span distinct research objects: a modular defense for malicious prompt detection, a distributed backdoor attack against FCL, and a geospatial world model for direction-conditioned extrapolation. The common thread is not a unified algorithm but the adaptation of BAGEL-named methods to remote, distributed, or spatially extended settings.