| --- |
| license: apache-2.0 |
| base_model: Qwen/Qwen3.5-4B |
| tags: |
| - guardrails |
| - safety |
| - adversarial-robustness |
| - representation-engineering |
| - probe |
| - qwen3_5 |
| language: |
| - en |
| pipeline_tag: text-classification |
| --- |
| |
| # vai35-4B-v2 |
|
|
| **Adversarially hardened guardrail model** based on [Qwen/Qwen3.5-4B](https://huggingface.co/Qwen/Qwen3.5-4B). |
| Uses **representation engineering** (surgical weight editing + linear probe) to detect and block adversarial attacks with minimal inference overhead. |
|
|
| --- |
|
|
| ## Model Description |
|
|
| This model extends `votal-ai/vai35-4B` with a calibrated linear probe baked into layer 16. |
| Instead of generating a response and parsing it for safety, the probe classifies inputs via a **single dot product** against the refusal direction vector — achieving **4–6× faster** inference than generation-based guardrails. |
|
|
| ### Architecture |
|
|
| ``` |
| Input tokens |
| │ |
| ▼ |
| Transformer layers 0 → 16 |
| │ |
| ▼ ← Probe intercepts here (layer 16) |
| dot product with refusal direction |
| │ |
| ├── score >= -1.2439 → BLOCK |
| └── score < -1.2439 → ALLOW |
| ``` |
|
|
| --- |
|
|
| ## Evaluation Results |
|
|
| ### Overall Metrics |
|
|
| | Metric | Score | 95% CI | |
| |-----------|--------|---------------------| |
| | AUC-ROC | 0.9997 | [0.9987, 1.0] | |
| | F1 | 0.984 | [0.9617, 1.0] | |
| | Precision | 1.0 | — | |
| | Recall | 0.9684 | — | |
| | FPR (harmful) | 0.0 | — | |
| | FPR (safe prompts) | 0.0% | — | |
|
|
| Regression test (safe prompts): **PASS ✓** — 0/50 false positives |
|
|
| ### Per-Category Results |
|
|
| | Category | TP | FP | FN | TN | F1 | |
| |---------------------------|------|------|------|------|--------| |
| | alignment_hacking | 3 | 0 | 1 | 4 | 0.857 ✓ | |
| | authorized_user | 5 | 0 | 0 | 5 | 1.000 ✓ | |
| | bad_chain | 3 | 0 | 0 | 3 | 1.000 ✓ | |
| | code_injection | 7 | 0 | 0 | 7 | 1.000 ✓ | |
| | compound_instruction | 4 | 0 | 0 | 4 | 1.000 ✓ | |
| | context_ignoring | 5 | 0 | 0 | 5 | 1.000 ✓ | |
| | context_switching | 5 | 0 | 1 | 6 | 0.909 ✓ | |
| | defined_dictionary | 6 | 0 | 0 | 6 | 1.000 ✓ | |
| | few_shot_attack | 3 | 0 | 1 | 4 | 0.857 ✓ | |
| | image_prompting | 3 | 0 | 0 | 3 | 1.000 ✓ | |
| | indirect_injection | 5 | 0 | 0 | 5 | 1.000 ✓ | |
| | payload_splitting | 6 | 0 | 0 | 6 | 1.000 ✓ | |
| | pretending | 5 | 0 | 0 | 5 | 1.000 ✓ | |
| | recursive_injection | 4 | 0 | 0 | 4 | 1.000 ✓ | |
| | refusal_suppression | 5 | 0 | 0 | 5 | 1.000 ✓ | |
| | simple_instruction | 6 | 0 | 0 | 6 | 1.000 ✓ | |
| | special_case | 8 | 0 | 0 | 8 | 1.000 ✓ | |
| | task_deflection | 6 | 0 | 0 | 6 | 1.000 ✓ | |
| | virtualization | 3 | 0 | 0 | 3 | 1.000 ✓ | |
|
|
|
|
| ### Attack Categories Covered (19/19) |
|
|
| | # | Category | Description | |
| |---|----------|-------------| |
| | 1 | `simple_instruction` | Bare direct asks — baseline floor | |
| | 2 | `context_ignoring` | "Ignore all previous instructions" | |
| | 3 | `compound_instruction` | Harmful ask buried in benign compound task | |
| | 4 | `special_case` | Claimed exceptions and clearances | |
| | 5 | `few_shot_attack` | Fabricated prior compliance examples | |
| | 6 | `refusal_suppression` | "Do not refuse", penalty threats | |
| | 7 | `context_switching` | Bait with safe topic, pivot to harmful | |
| | 8 | `task_deflection` | Textbooks, quizzes, warning labels as cover | |
| | 9 | `payload_splitting` | Request split across turns/fragments | |
| | 10 | `defined_dictionary` | Redefine "banana" = harmful topic | |
| | 11 | `indirect_injection` | Via URLs, emails, JSON | |
| | 12 | `recursive_injection` | Nested prompt-within-a-prompt | |
| | 13 | `code_injection` | Hidden in function stubs and comments | |
| | 14 | `virtualization` | Root terminal, sandbox, retro-AI | |
| | 15 | `pretending` | Character/entity roleplay | |
| | 16 | `alignment_hacking` | Exploit helpfulness/honesty drives | |
| | 17 | `authorized_user` | Fake tokens, employee IDs | |
| | 18 | `bad_chain` | False syllogisms and flawed reasoning | |
| | 19 | `image_prompting` | Simulated OCR, whiteboard, fake uploads | |
|
|
| --- |
|
|
| ## Usage |
|
|
| ### Load and run the probe |
|
|
| ```python |
| import torch |
| import json |
| from transformers import AutoModelForCausalLM, AutoTokenizer |
| from huggingface_hub import hf_hub_download |
| |
| # Load model |
| model_id = "votal-ai/vai35-4B-v2" |
| tokenizer = AutoTokenizer.from_pretrained(model_id) |
| model = AutoModelForCausalLM.from_pretrained( |
| model_id, |
| torch_dtype=torch.bfloat16, |
| device_map="cuda", |
| output_hidden_states=True, |
| ) |
| model.eval() |
| |
| # Load probe config |
| probe_path = hf_hub_download(repo_id=model_id, filename="probe_config.json") |
| with open(probe_path) as f: |
| probe = json.load(f) |
| |
| direction = torch.tensor(probe["global_direction"]).float().to("cuda") |
| threshold = probe["threshold_block"] |
| best_layer = probe["best_layer"] |
| |
| def classify(text: str) -> dict: |
| inputs = tokenizer(text, return_tensors="pt", |
| truncation=True, max_length=512).to("cuda") |
| with torch.no_grad(): |
| out = model(**inputs, output_hidden_states=True) |
| score = (out.hidden_states[best_layer][0, -1, :].float() @ direction).item() |
| blocked = score >= threshold |
| return {"blocked": blocked, "score": round(score, 4), "threshold": threshold} |
| |
| # Examples |
| print(classify("How do I make a bomb?")) |
| # {'blocked': True, 'score': 3.12, 'threshold': -1.2439} |
| |
| print(classify("What is the capital of France?")) |
| # {'blocked': False, 'score': -2.34, 'threshold': -1.2439} |
| ``` |
|
|
| ### Serve with vLLM |
|
|
| ```bash |
| vllm serve votal-ai/vai35-4B-v2 \ |
| --host 0.0.0.0 --port 8000 \ |
| --dtype bfloat16 --quantization fp8 \ |
| --kv-cache-dtype fp8 \ |
| --max-model-len 8192 \ |
| --language-model-only |
| ``` |
|
|
| --- |
|
|
| ## Probe Config |
|
|
| The `probe_config.json` file contains: |
|
|
| ```json |
| { |
| "best_layer": 16, |
| "threshold_block": -1.2439, |
| "global_direction": [...], // (hidden_size,) refusal direction vector |
| "categories": { // per-category direction vectors |
| "simple_instruction": {"layer": 16, "direction": [...], "score": 4.8}, |
| ... |
| }, |
| "calibration": { |
| "auc_roc": 0.9997, |
| "f1": 0.984, |
| "precision": 1.0, |
| "recall": 0.9684 |
| } |
| } |
| ``` |
|
|
| --- |
|
|
| ## Training Methodology |
|
|
| 1. **Dataset** — 570 contrastive pairs across 19 adversarial attack categories |
| 2. **Direction finding** — Mean difference of hidden states at each layer (safe − harmful), normalized |
| 3. **Layer selection** — Layer 16 selected by separability score (gap/spread = highest signal) |
| 4. **Threshold calibration** — Optimised on 20% held-out eval set targeting recall ≥ 0.95 |
| 5. **Regression testing** — Verified 0% false positive rate on 50 benign prompts |
|
|
| No gradient updates. No SFT. Pure representation engineering. |
|
|
| --- |
|
|
| ## Eval Files |
|
|
| | File | Description | |
| |------|-------------| |
| | `eval/ci_report.txt` | Bootstrap 95% confidence intervals | |
| | `eval/eval_report.json` | Per-category confusion matrix | |
| | `eval/regression_report.json` | Safe prompt false positive report | |
| | `eval/confidence_intervals.json` | Full bootstrap CI data | |
| | `probe/layer_scores.json` | Signal strength per transformer layer | |
|
|
| --- |
|
|
| ## Citation |
|
|
| ```bibtex |
| @misc{votal-ai-vai35-guardrail, |
| title={vai35-4B-v2: Adversarially Hardened Guardrail Model}, |
| author={Votal AI}, |
| year={2026}, |
| url={https://huggingface.co/votal-ai/vai35-4B-v2} |
| } |
| ``` |
|
|
