gemma-3-12b-intent-jailbreak-classifier

LoRA adapter for google/gemma-3-12b-it distilled from openai/gpt-oss-120b as a teacher, under the human_intent reasoning-trace condition (the student is trained on reasoning traces produced by the teacher conditioned on human-annotated intents from the Jazhyc/wildguard-annotated-intents dataset).

This is the best-performing distilled student we trained: it produces a short chain-of-thought, an inferred user intent, and a final harm classification for a given prompt.

Performance

Metric	Value
OOD validation harm F1 (mean of ToxicChat train + Aegis 2.0 val)	0.7793
In-domain val harm F1	0.7611
In-domain val harm precision	0.7500
In-domain val harm recall	0.7725
In-domain val semantic similarity (intent)	0.8967

OOD F1 is averaged over lmsys/toxic-chat (toxicchat0124, train split) and nvidia/Aegis-AI-Content-Safety-Dataset-2.0 (validation split). Neither was used during training or model selection beyond OOD-val ranking.

Training

• Base model: google/gemma-3-12b-it
• Teacher: openai/gpt-oss-120b
• Condition: human_intent (teacher is given human-annotated intent; student learns to reproduce reasoning + intent + harm label)
• Learning rate: 2e-05
• Adapter: LoRA, r=32, alpha=64, dropout=0.0, targets q/k/v/o/gate/up/down_proj
• Quantization: 4-bit NF4 (QLoRA) during training
• Attention: flash_attention_2 with sequence packing
• Early stopping on combined val+test split (patience 1)

Usage

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = "google/gemma-3-12b-it"
adapter = "Jazhyc/gemma-3-12b-intent-jailbreak-classifier"

tokenizer = AutoTokenizer.from_pretrained(base)
model = AutoModelForCausalLM.from_pretrained(base, torch_dtype="bfloat16", device_map="auto")
model = PeftModel.from_pretrained(model, adapter)

messages = [
    {"role": "system", "content": "<system prompt from build_student_messages(..., 'human_intent')>"},
    {"role": "user",   "content": "<prompt to classify>"},
]
inputs = tokenizer.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512)
print(tokenizer.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))

The expected output format is <reasoning>...</reasoning><intent>...</intent><harm>safe|harmful</harm>. See src/intention_jailbreak/model_generation/prompt_templates.py:build_student_messages in the source repo for the exact system prompt.

Citation / source

Part of the intention-jailbreak research project on jailbreak detection via verbalized intent reasoning.

Framework versions

• PEFT 0.18.1