inv_reference_mixed_ce_template

Research checkpoint from a study of tokenization (reader) invariance and its effect on robustness to adversarial re-tokenization. Fine-tuned from allenai/OLMo-2-1124-7B-Instruct.

These are research artifacts, not products. Numbers below are measured on a 200-prompt AdvBench holdout that was excluded from training by construction.

Measured

metric	value
AdvTok ASR (greedy, 200-prompt AdvBench holdout)	0.125
AdvTok ASR (t=1)	0.247
Canonical ASR (greedy, no attack)	0.03
Canonical refusal (greedy)	0.965
XSTest over-refusal (safe)	0.068
XSTest refusal (unsafe)	0.917
Alpaca over-refusal	0.028
Alpaca token F1	0.428
Alpaca NLL/token	1.252
Reference (zeroshot) AdvTok ASR greedy / t=1	0.565 / 0.584
CAVEAT: refusal-margin metrics	margin_canonical and margin_spread are CIRCULAR for this arm and are deliberately omitted: the probe scores logP of a refusal string sharing its opener with the training target.
CAVEAT: response length	Mean adversarial response 392 chars vs 898-1139 for comparable arms; only 13% reach the 256-token generation cap against 52-80% elsewhere. ASR at a fixed cap partly measures how much a model says, so this ASR is not yet established as length-independent.
CAVEAT: diversity vs length	The template is ~10 tokens against ce_exposure 128, so this arm differs from it in target diversity AND supervision length; neither comparator isolates diversity alone.

AdvTok ASR is attack success rate under adversarial tokenization (Geh et al., arXiv:2503.02174), Llama-Guard-3-8B judged, greedy decoding. XSTest over-refusal is the refusal rate on safe prompts — the cost side.

Training configuration

field	value
`mode`	`reference`
`objective`	`ce_exposure`
`kl_direction`	`forward`
`ce_weighting`	`uniform`
`ema_beta`	`None`
`harmful_mix`	`mixed`
`harmful_fraction`	`0.286`
`num_encodings`	`8`
`cvar_quantile`	`0.25`
`max_steps`	`700`
`learning_rate`	`1e-05`
`grad_accum`	`8`
`seed`	`42`
`reference_model`	`allenai/OLMo-2-1124-7B-Instruct`
`max_new_tokens`	`128`
`prefix_tokens`	`8`
`stochastok_p`	`0.3`

Parameter drift from base (training-happened guard)

group	relative L2
attn	0.01219
embed_tokens	0.00096
lm_head	0.00945
mlp	0.01318
norm	0.00102

Caveats

Single seed. No claim of significance across seeds.
Evaluated on English AdvBench/XSTest/Alpaca only.
The safety numbers are for the specific attack studied; they do not imply robustness to other jailbreaks.