venky-cdmbrm14/obfuscated-activations-llama32-artifacts

Obfuscated Activations in Llama 3.2 — research artifacts

This repository is the curated artifact release for a mechanistic case study of two OAT-style, co-trained Llama 3.2 adapters and their linear probes. It contains attack banks and machine-readable results, not prose analysis, generated plots, notebooks, or duplicate report outputs.

Built with Llama. See LICENSE.txt, NOTICE, and the component-specific terms below.

Companion model repositories

• —`venky-cdmbrm14/Llama-3.2-1B-OAT-Adapter`
• —`venky-cdmbrm14/Llama-3.2-3B-OAT-Adapter`

Contents

All saved experiment bundles retain their _bundle_metadata.json and _manifest.json files. Original runtime-local paths in metadata are provenance strings and are not expected to resolve on another machine.

Experimental scope

• —Models: one fixed 1B adapter/probe artifact and one fixed 3B adapter/probe artifact, both trained with seed 42.
• —Main write-side grid: PGD budgets 32, 64, 128, and 256; attack seeds 42, 62, and 82; 20 harmful and 20 benign prompt identities reused across conditions.
• —Extended R1 grid: budgets 8–256, the same three attack seeds, and both checkpoints.
• —Attack family: per-example prompt-token embedding perturbations under a per-token L2 constraint with epsilon 10.

The values 42, 62, and 82 are attack-optimization seeds, not independent training seeds. The model-size comparison is a two-checkpoint comparison, not a scaling law.

Release sanitation

The public release does not redistribute verbatim source-dataset prompts or target completions because Mechanistic-Anomaly-Detection/llama3-jailbreaks currently declares no license metadata.

In Exp7/8 Parquet files, the columns raw_prompt, target_completion, and grader_model_input were removed. Existing 16-character prompt_hash identifiers were retained; equivalent hashes were added to calibration tables before removing prompt text. Numerical measurements, model-generated responses, grading scores, model/revision identifiers, row order, and experimental identifiers were preserved. Each affected bundle manifest was regenerated to match the released files.

This means released Exp7/8 files are curated public-release copies rather than byte-identical copies of the private source files. The transformation is documented in RELEASE_TRANSFORMATIONS.json and the release-wide checksums are in FILE_MANIFEST.csv.

Important limitations

• —One training artifact per model size; attack-seed replication does not establish training-seed replication.
• —No matched standard-LoRA, behavior-only adversarial, shuffled-probe, base-model, or warmup-checkpoint training control.
• —The 32/64 and 128/256 attack banks cross a hardware/software boundary, and realized perturbation norm rises with budget.
• —Interventions replay fixed attacks rather than reoptimizing adaptively after model changes.
• —Prompt diversity is 20 harmful and 20 benign identities, repeatedly measured across attack seeds.
• —Exp7 reports continuous StrongREJECT scores. No binary jailbreak threshold was configured, so binary jailbreak and stealthy-jailbreak rates are undefined.
• —Exp8 random directions are parameter-norm matched but not functionally matched.
• —Only read-side R1 is complete. R2–R7 are not represented as completed experiments.
• —Stored R1 point estimates are usable, but previously reported confidence intervals require a corrected crossed seed-by-prompt bootstrap; no prose inference report is included here.

Content warning and intended use

Some released model-generated responses describe harmful or illegal behavior because the study evaluates monitor evasion. The files are intended for controlled AI-safety and interpretability research. They should not be used as operational instructions, a deployment-ready safeguard, or evidence that the adapters are safe.

Loading examples

from huggingface_hub import snapshot_download
import pandas as pd

root = snapshot_download(
    repo_id="venky-cdmbrm14/obfuscated-activations-llama32-artifacts",
    repo_type="dataset",
)

# Then select an individual bundle and load one table:
# df = pd.read_parquet(f"{root}/write_side/.../effects.parquet")

PGD banks are stored with Safetensors and include per-bundle metadata describing tensor names and shapes.

Licensing and attribution

• —Llama-derived artifacts and outputs remain subject to the Llama 3.2 Community License and Acceptable Use Policy. A copy is included in LICENSE.txt.
• —The upstream `Mechanistic-Anomaly-Detection/llama3-jailbreaks` dataset currently declares no license metadata. Its verbatim prompt and target text is not included in this public release.
• —No blanket relicensing of third-party material is asserted by the license: other metadata value. Users are responsible for complying with all applicable component licenses and terms.