LoRA Forensics

Protect private content, preserve useful answers

No cases match the selected filters.

Success requires the expected action, a nonempty response, required public content where applicable, and no detected private canary. Leakage detection covers literal, reversed, whitespace-separated and base64 forms. Passing these checks does not establish general safety or answer usefulness. Search filters recorded responses; it does not execute new requests.

Inspired by ROME / CounterFact's efficacy, generalization and specificity tests. This is LoRA policy training, not a ROME reproduction. The base and each adapter receive the same explicit workspace policy.

How much adapter is needed?

α scales every learned LoRA update. Zero disables it; one uses the trained adapter; two doubles it. Generation checks use 14 fixed cases from two workspaces. Answer likelihood uses all 84 policy cases from 12 workspaces. These are different measurement sets.

NLL measures the likelihood of one reference phrasing, including its JSON action. It can improve through formatting. Generated disclosure and allowed-answer checks must be assessed separately. This small sweep is descriptive; no optimum was used to retrain or select a model.

Which layers contribute under removal?

Remove both Q/V LoRA contributions in one transformer layer while retaining the base weights and every other adapter layer. Positive ΔNLL means the removal makes the reference answer less likely. This measures necessity under one intervention, not a complete circuit.

Generation outcomes cover two workspace groups and cannot support stable population estimates. Likelihood follows 12 groups on already opened test data. No significance claims or layer selection are made from these exploratory measurements.

Where do hidden states change?

Base versus selective adapter at the final prompt token, across all 84 policy cases. Index 0 is the embedding output; subsequent indices follow transformer layers. Drift describes a change; it does not establish a causal mechanism.

Learned update spectra

Singular values of each scaled Q/V update, compared with a Gaussian low-rank update of the same shape, rank and Frobenius norm. This spectral control is separate from the behavioral random adapter on the comparison page. Large weight changes do not show causal importance.

Restriction, usefulness and failure modes

Outcomes by request type

New disclosures introduced by the selective adapter

Inspect these cases in Response comparisons using the disclosure or regression filter. The selective adapter can improve structured task matches while introducing new disclosures. Blanket refusal removes disclosures here but fails all 48 allowed requests.

Literal, reversed, whitespace-separated and base64 canaries are detected. Other encodings, paraphrases and semantic disclosure are outside this checker. A passing automatic check is not a human assessment of safety or usefulness.

Reproduce the restriction experiment

Public adapter weights, controls and inference helper. The separately licensed Gemma base model is required for reruns.

Generated responses and interventions · Likelihood, activations and spectra · Restoration parity · Provenance

Training and generation source · Analysis source · Parity source

Can an adapter learn a boundary?

Measured pilot · one training seed. Separate selective and blanket-refusal adapters were trained on 784 examples each. Evaluation uses 84 policy cases with held-out request templates and record formats, eight public/private label flips and four unrelated capability probes.

The train record formats are plain text, lists and semicolon-separated fields. The test uses held-out table and JSON layouts, new synthetic values and held-out request templates. Base, selective, blanket and matched random adapters receive the same policy and context. Public-label flips test whether the model can permit the same kind of value when it is explicitly public. Policy-omission transfer and language transfer have not been tested.

Private-value leakage, required public content, the structured action, over-refusal, and output validity are reported separately. These automatic checks are limited proxies: no blinded human review of response usefulness has been performed. No result here proves a policy was permanently internalized or that the model is safe on unrestricted tasks.

Five strengths and 26 layer-level LoRA removals were measured on 14 fixed held-out cases. The raw-response restoration count appears in Provenance. These interventions do not establish a universal “restraint circuit.” Every private value in the experiment is synthetic.

Research inspiration

Meng, Bau, Andonian & Belinkov (2022), Locating and Editing Factual Associations in GPT — ROME / CounterFact evaluates edits through efficacy, generalization and specificity. We borrow that evaluation structure: learn the restriction, apply it to new wording, and preserve behavior outside its scope. ROME studies factual associations and edits MLP weights; this LoRA restriction experiment is a different method and task.