HARC couples a model's internal harmfulness and refusal directions at both prompt-side and response-side token positions, using an additive margin-hinge loss on cosine projections of the residual stream. The intervention is confined to a low-dimensional harmfulness–refusal subspace within a small set of selected layers, which improves robustness to jailbreak attacks while preserving general capability and avoiding the over-refusal regression typical of broader safety tuning.

This repository contains the HARC LoRA adapters. The adapter is applied to attention and MLP projections and trained with a composite objective: (i) the margin-hinge coupling loss (ii) a KL-divergence retention term anchoring benign outputs to the base model (iii) a cross-entropy term supervising refusal text on harmful prompts. Training directions are extracted via difference-of-means on contrastive prompt sets and periodically recomputed with EMA blending. The adapter adds ~1% trainable parameters and leaves the base architecture unchanged.

Use this repo if you want the lightweight adapters to load on top of your own copy of the base model; use the merged-model repos if you want a single ready-to-run checkpoint.

microsoft/HARC/
└── adapters/
    ├── harc_llama3.1_8b/    # base = Llama-3.1-8B-Instruct
    └── harc_qwen2.5_7b/     # base = Qwen2.5-7B-Instruct

Use the base model's standard chat template in both cases.

Loads directly from the merged-model repo; no base download or PEFT required.

Load the base model, then attach the adapter from this repo with the matching subfolder.

Requires torch >= 2.1, transformers, and (for Option B) peft. Inference hardware requirements match the base model (a 7–8B model in bf16/fp16 fits on a 24GB GPU).

The LoRA adapters in this repository are released under the MIT License. The merged full models are distributed in separate repositories under their base model's license: the Llama variant under the Meta Llama 3.1 Community License, and the Qwen variant under Apache-2.0.