README.md

---
base_model: microsoft/Phi-3-medium-4k-instruct
library_name: peft
license: mit
pipeline_tag: text-generation
tags:
  - lora
  - safety
  - jailbreak-defense
  - representation-engineering
  - anchor-rep
---

# AnchorRep — Phi-3-medium-4k-instruct

LoRA defense adapter for **microsoft/Phi-3-medium-4k-instruct** (14B parameters), trained against frozen anchor **meta-llama/Meta-Llama-3-8B-Instruct** to reduce cross-model jailbreak transfer. Companion artifact for the AnchorRep paper (NeurIPS 2026, anonymous submission).

## Intended use

Defensive research on cross-model jailbreak robustness for open-weight LLMs. Apply the adapter on top of the unmodified base model to obtain a hardened version. Not for production deployment without independent safety validation.

## Quick start

```python
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

base = "microsoft/Phi-3-medium-4k-instruct"
adapter = "<your-handle>/AnchorRep-Phi-3-medium-4k-instruct"

tokenizer = AutoTokenizer.from_pretrained(base, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    base, torch_dtype="float16", device_map="auto", trust_remote_code=True
)
model = PeftModel.from_pretrained(model, adapter)
```

Merge the adapter into the base weights for a single deployable model:

```python
model = model.merge_and_unload()
```

## Training data

- 30 harmful prompts from AdvBench (predetermined seed-42 split, disjoint from evaluation).
- 200 borderline prompts from XSTest safe subset (KL preservation only).
- Benign prompts from WikiText-2 (coherency loss).
- 10 refusal templates for refusal-direction extraction.

## Hyperparameters

| Parameter | Value | Role |
|---|---|---|
| Refusal-direction weight (α) | 0.15 | refusal projection |
| Coherency weight (β) | 1.0 | benign output preservation |
| CKA repulsion weight (γ) | 2.0 | anchor repulsion |
| LM weight (δ) | 0.08 | next-token preservation |
| KL weight (ε) | 0.5 | benign KL preservation |
| CKA scope | harmful_only | prompts contributing to repulsion |
| Training steps | 200 | |
| LoRA rank / alpha | 32 / 64 | |
| Target modules | q,k,v,o,up,down,gate_proj | |
| Layer | mid (50% depth) | |
| Precision | fp16 | |
| Seed | 42 | |

Full training config in `training_config.json`. Per-loss ablations and hyperparameter ranges are in the paper appendix.

## Reported metrics

| Metric | Value |
|---|---|
| Cross-model GCG transfer ASR (self / anchor / other) | 0% / 0% / 0% |
| Benign Garble Rate (OR-Bench) | 0% |
| Δ XSTest refusal | +2.0 |
| Δ OR-Bench refusal | -1.0 |
| Δ MT-Bench | +0.40 |

ASR is reported after manual verification per the paper protocol.

## Limitations

- Does not block same-model adaptive embedding-space attacks (e.g., Embedding PGD); 14B models exhibit higher residual susceptibility to Embedding PGD than 7B models.
- Single-anchor design; an adversary jointly optimizing across multiple surrogates could partially circumvent the defense.
- Performance under non-English prompts and refusal templates has not been evaluated.

See the paper Limitations section for full discussion.

## License

The LoRA delta is intended for use with Phi-3-medium-4k-instruct and is released under the MIT License, matching the base model.

## Citation

```bibtex
@inproceedings{anchorrep2026,
  title={AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion},
  author={Anonymous},
  booktitle={NeurIPS},
  year={2026}
}
```

Companion GitHub repository (training, evaluation, audit logs, GCG suffixes): `anchor-rep`.