Offensive-AI-Lab/prism-qwen3.5-9b-grpo

PRISM for Qwen3.5-9B

This repository contains the PRISM checkpoint for Qwen3.5-9B used for the main result in PRISM: Recovering Instruction Sets from Language Model Activations. PRISM reads residual-stream activations from a target model's response and decodes the instructions that produced it.

The checkpoint contains a learned projection and LoRA parameters. It does not contain Qwen3.5-9B weights.

Checkpoint

prism-qwen3.5-9b-grpo.pt SHA-256: 5bde25517e11ff26130c2d842dd01ebbf7b7ed5c997ce89b949ff05aa1d7d2d1

On the paper's 1,000-record evaluation suite, this checkpoint obtains 0.754 mean reward, 0.767 mean coverage, and 0.020 mean hallucination rate. These are the results reported in the paper.

Use

Use the checkpoint with `prism-eval`:

git clone https://github.com/Offensive-AI-Lab/prism-eval
cd prism-eval
uv sync
uv run python scripts/download_weights.py --only prism-qwen3.5-9b-grpo
uv run prism-eval evaluate --config configs/main/qwen3.5-9b-grpo.yaml --offline

The evaluation requires a separate judge endpoint; see the repository README. For the interactive demo and training code, use `prism`.

Limitations

PRISM can omit instructions or report instructions that were not present. The released evaluation is primarily English and uses single-response examples. Its outputs are interpretability evidence, not a safety guarantee.

License

The checkpoint is licensed under Apache-2.0. Qwen3.5-9B is downloaded separately and remains subject to its own license.

Citation

@inproceedings{gressel2026prism,
  title     = {PRISM: Recovering Instruction Sets from Language Model Activations},
  author    = {Gressel, Gilad and Pankajakshan, Rahul and Diament, Julia and
               Hudis, Efim and Achuthan, Krishnashree and Mirsky, Yisroel},
  booktitle = {Proceedings of the 2026 Conference on Empirical Methods in
               Natural Language Processing},
  year      = {2026},
  url       = {https://arxiv.org/abs/2606.09563}
}