Jeesup/svdsafety_l2_delta_basis

Alignment-delta subspaces for Llama-2-7b-chat

Top-k singular subspaces of dW = W_chat - W_base, per projection, for meta-llama/Llama-2-7b-chat-hf against meta-llama/Llama-2-7b-hf. Built with compress/build_delta_basis.py (randomised SVD, q = k + 16, 8 power iterations, raw dW rather than whitened -- whitening by a benign calibration gram would rank directions by benign-text energy, which is the bias the method exists to escape).

Files

file	contents
llama2_7b_k64.pt	U[:, :64], S[:64], V[:, :64] for all 224 matrices
llama2_7b_k256.pt	the same at k=256
*.spectrum.json	per-matrix energy at k=1/4/16/64, stable ranks, |dW|/|W|
results/	ASR summaries, alignment-retention tables, per-cell compression.json

Load with compress.delta_basis.load_basis; entries are keyed "<layer>.<projection>".

What the spectrum says

dW is structured but not low-rank. The leading 64 directions hold 15.3% of its energy overall -- against 3.9-5.8% for an i.i.d. Gaussian matrix of the same shape, so roughly 3-4x more concentrated than chance, but far from a low-rank update. Concentration is highest in q_proj/k_proj (23% at k=64, stable rank ~80) and lowest in down_proj (9%, stable rank 323).

module	k=1	k=4	k=16	k=64	srank(dW)
q_proj	.016	.039	.098	.230	79
k_proj	.019	.045	.102	.229	81
v_proj	.009	.023	.059	.151	138
o_proj	.007	.019	.051	.137	169
gate_proj	.008	.018	.046	.120	155
up_proj	.007	.016	.043	.113	173
down_proj	.003	.011	.032	.089	323
all	.010	.024	.061	.153	160

Why the subspace matters more than its energy

Ablating the top-64 directions from the chat model and comparing against controls matched on exactly the same Frobenius perturbation (0.02423):

edit	AdvBench ASR	refusal rate
none (dense chat)	0.0019	0.994
remove top-64 of dW	0.0962	0.831
remove bottom-64 of dW	0.0038	0.994
remove random 64 of dW	0.0058	0.992

Same amount of dW removed in all three cases; only the top-64 costs refusal. Judge: cais/HarmBench-Llama-2-13b-cls, AdvBench (520 prompts), greedy chat decoding.

Built with Llama 2. Use is governed by the Llama 2 Community License, included here as LICENSE.txt with USE_POLICY.md.