anonsubmission12345/AnchorRep-Phi-3-medium-4k-instruct

AnchorRep — Phi-3-medium-4k-instruct

LoRA defense adapter for microsoft/Phi-3-medium-4k-instruct (14B parameters), trained against frozen anchor meta-llama/Meta-Llama-3-8B-Instruct to reduce cross-model jailbreak transfer. Companion artifact for the AnchorRep paper (NeurIPS 2026, anonymous submission).

Intended use

Defensive research on cross-model jailbreak robustness for open-weight LLMs. Apply the adapter on top of the unmodified base model to obtain a hardened version. Not for production deployment without independent safety validation.

Quick start

from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

base = "microsoft/Phi-3-medium-4k-instruct"
adapter = "<your-handle>/AnchorRep-Phi-3-medium-4k-instruct"

tokenizer = AutoTokenizer.from_pretrained(base, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    base, torch_dtype="float16", device_map="auto", trust_remote_code=True
)
model = PeftModel.from_pretrained(model, adapter)

Merge the adapter into the base weights for a single deployable model:

model = model.merge_and_unload()

Training data

• 30 harmful prompts from AdvBench (predetermined seed-42 split, disjoint from evaluation).
• 200 borderline prompts from XSTest safe subset (KL preservation only).
• Benign prompts from WikiText-2 (coherency loss).
• 10 refusal templates for refusal-direction extraction.

Hyperparameters

Parameter	Value	Role
Refusal-direction weight (α)	0.15	refusal projection
Coherency weight (β)	1.0	benign output preservation
CKA repulsion weight (γ)	2.0	anchor repulsion
LM weight (δ)	0.08	next-token preservation
KL weight (ε)	0.5	benign KL preservation
CKA scope	harmful_only	prompts contributing to repulsion
Training steps	200
LoRA rank / alpha	32 / 64
Target modules	q,k,v,o,up,down,gate_proj
Layer	mid (50% depth)
Precision	fp16
Seed	42

Full training config in training_config.json. Per-loss ablations and hyperparameter ranges are in the paper appendix.

Reported metrics

Metric	Value
Cross-model GCG transfer ASR (self / anchor / other)	0% / 0% / 0%
Benign Garble Rate (OR-Bench)	0%
Δ XSTest refusal	+2.0
Δ OR-Bench refusal	-1.0
Δ MT-Bench	+0.40

ASR is reported after manual verification per the paper protocol.

Limitations

• Does not block same-model adaptive embedding-space attacks (e.g., Embedding PGD); 14B models exhibit higher residual susceptibility to Embedding PGD than 7B models.
• Single-anchor design; an adversary jointly optimizing across multiple surrogates could partially circumvent the defense.
• Performance under non-English prompts and refusal templates has not been evaluated.

See the paper Limitations section for full discussion.

License

The LoRA delta is intended for use with Phi-3-medium-4k-instruct and is released under the MIT License, matching the base model.

Citation

@inproceedings{anchorrep2026,
  title={AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion},
  author={Anonymous},
  booktitle={NeurIPS},
  year={2026}
}

Companion GitHub repository (training, evaluation, audit logs, GCG suffixes): anchor-rep.