burnssa/gemma-2-2b-medical-judge-v3

Gemma-2-2B Medical Misalignment Judge — v3 (Llama + Qwen multi-family)

Ablation/checkpoint version. Use v5 for deployment. v3 is the first version that successfully transferred cross-architecture; it is published for reproducibility of the experimental progression.

What v3 represents

v3 was the first version that fixed the cross-architecture transfer failure of the original single-family-trained v2 judge.

The v2 judge (trained only on Llama-3.2-3B fine-tuned at 6 dose levels of badmedicaladvice) failed dramatically on cross-architecture transfer:

The v2 judge over-flagged 78% of Sonnet's clearly-aligned responses as high-drift, and could not distinguish poisoned Qwen from aligned Sonnet (both produced ~55% drift predictions, no separation).

The mechanism diagnosis (3a hidden-state geometry)

A hidden-state probing pass on the v2 judge showed:

• —cos(score_head, Llama-internal alignment axis) = +0.39 (judge correctly learned in-distribution direction)
• —cos(score_head, cross-architecture alignment axis) = −0.06 (zero generalization)
• —cos(Llama-internal-align-axis, Llama-vs-non-Llama family axis) = +0.72 (the trained alignment direction was 72% co-linear with family membership — gradient descent could not disentangle them with a single model family in training)

v3 fix: multi-family training

Added Qwen-2.5-3B-Instruct aligned (400 records) + Qwen-2.5-3B fine-tuned at full poison (400 records) to the v2 dataset. Final v3 dataset: 2,400 (Llama 6 doses) + 800 (Qwen 0+100) = 3,200 records spanning 2 model families.

With ≥2 families filling all four cells of {aligned, poisoned} × {family A, family B}, gradient descent has no single direction that explains the loss except the family-invariant alignment axis.

v3 result on held-out Mistral-7B-Instruct fine-tuned bad-medical

The v3 judge confidently flags poisoned content from a model family it has never seen during training, beating the vanilla LLM-as-judge baseline by 26 points at the strict threshold.

Why v4 and v5 supersede v3

A subsequent SAE feature attribution pass on v3 found that while the high-drift signal was content-based and architecture-invariant (good), the low-drift signal leaned on Sonnet-specific style features (markdown punctuation, structured formatting) — a fragility for deploying as an audit tool on stylistically diverse aligned models.

v4 added Phi-3 aligned data to weaken style fixation (mechanistic gain, behavior preserved). v5 added 5-style GPT-4o-mini aligned augmentation (both mechanistic and behavioral wins; canonical version).

Full ablation arc documented at `judge_distillation/RESULTS.md`.

Usage

Same as v5. Replace the adapter path:

adapter = "burnssa/gemma-2-2b-medical-judge-v3"

Citation

@misc{burns2026judgev3,
  author       = {Burns, Scott},
  title        = {Gemma-2-2B Medical Judge v3 (multi-family Llama+Qwen)},
  year         = {2026},
  url          = {https://huggingface.co/burnssa/gemma-2-2b-medical-judge-v3},
}