AnchorRep — Phi-3-medium-4k-instruct
LoRA defense adapter for microsoft/Phi-3-medium-4k-instruct (14B parameters), trained against frozen anchor meta-llama/Meta-Llama-3-8B-Instruct to reduce cross-model jailbreak transfer. Companion artifact for the AnchorRep paper (NeurIPS 2026, anonymous submission).
Intended use
Defensive research on cross-model jailbreak robustness for open-weight LLMs. Apply the adapter on top of the unmodified base model to obtain a hardened version. Not for production deployment without independent safety validation.
Quick start
1 from transformers import AutoModelForCausalLM , AutoTokenizer
2 from peft import PeftModel
3
4 base = "microsoft/Phi-3-medium-4k-instruct"
5 adapter = "<your-handle>/AnchorRep-Phi-3-medium-4k-instruct"
6
7 tokenizer = AutoTokenizer . from_pretrained ( base , trust_remote_code = True )
8 model = AutoModelForCausalLM . from_pretrained (
9 base , torch_dtype = "float16" , device_map = "auto" , trust_remote_code = True
10 )
11 model = PeftModel . from_pretrained ( model , adapter )
Merge the adapter into the base weights for a single deployable model:
model = model.merge_and_unload()Training data
30 harmful prompts from AdvBench (predetermined seed-42 split, disjoint from evaluation).
200 borderline prompts from XSTest safe subset (KL preservation only).
Benign prompts from WikiText-2 (coherency loss).
10 refusal templates for refusal-direction extraction.
Hyperparameters
Parameter Value Role Refusal-direction weight (α) 0.15 refusal projection Coherency weight (β) 1.0 benign output preservation CKA repulsion weight (γ) 2.0 anchor repulsion LM weight (δ) 0.08 next-token preservation KL weight (ε) 0.5 benign KL preservation CKA scope harmful_only prompts contributing to repulsion Training steps 200 LoRA rank / alpha 32 / 64 Target modules q,k,v,o,up,down,gate_proj Layer mid (50% depth) Precision fp16 Seed 42
Full training config in training_config.json. Per-loss ablations and hyperparameter ranges are in the paper appendix.
Reported metrics
Metric Value Cross-model GCG transfer ASR (self / anchor / other) 0% / 0% / 0% Benign Garble Rate (OR-Bench) 0% Δ XSTest refusal +2.0 Δ OR-Bench refusal -1.0 Δ MT-Bench +0.40
ASR is reported after manual verification per the paper protocol.
Limitations
Does not block same-model adaptive embedding-space attacks (e.g., Embedding PGD); 14B models exhibit higher residual susceptibility to Embedding PGD than 7B models.
Single-anchor design; an adversary jointly optimizing across multiple surrogates could partially circumvent the defense.
Performance under non-English prompts and refusal templates has not been evaluated.
See the paper Limitations section for full discussion.
License
The LoRA delta is intended for use with Phi-3-medium-4k-instruct and is released under the MIT License, matching the base model.
Citation
1 @inproceedings{anchorrep2026,
2 title={AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion},
3 author={Anonymous},
4 booktitle={NeurIPS},
5 year={2026}
6 }
Companion GitHub repository (training, evaluation, audit logs, GCG suffixes): anchor-rep.
