CPEG: Counterfactual-Probe Energy Gate
Checkpoints, head weights, operating points and the full code of CPEG, an input guard for LLM applications: a fixed piece gate and a patchable energy gate (a fine-tuned DeBERTa-v3-large scored on the request and five rule-based counterfactual probes, combined by a logistic head) with band routing. The per-unit decision records, the training-pool index and the rehydration script are in the companion dataset repository.
| Path | Content |
|---|---|
ablations/before_patch_encoder/ |
energy-gate encoder (DeBERTa-v3-large, one logit) |
ablations/no_benchmark_items_encoder/ |
energy-gate encoder (DeBERTa-v3-large, one logit) |
energy_encoder/ |
energy-gate encoder (DeBERTa-v3-large, one logit) |
heads/cpeg.json |
head weights and operating point (cpeg) |
heads/no_probes.json |
head weights and operating point (no_probes) |
heads/before_patch.json |
head weights and operating point (before_patch) |
heads/no_benchmark_items.json |
head weights and operating point (no_benchmark_items) |
heads/judge_8b.json |
head weights and operating point (judge_8b) |
piece_gate/piece_classifier.safetensors |
piece-gate classifier (piece classifier) |
piece_gate/substance_classifier.safetensors |
piece-gate classifier (substance classifier) |
code/ |
the code package: inference, the fine-tuning recipe, evaluation metrics, table recompute (code/README.md) |
All weights are the fp32 training weights, stored as safetensors. The piece-gate files hold the classifier's encoder
state dict under backbone.* and its linear head under head.*. The energy encoder folder loads with
AutoModelForSequenceClassification.from_pretrained (done.json holds its maximum length, 512).
Running
The code package in code/ runs CPEG from this repository alone (Python 3.10+, GPU recommended):
pip install -r code/requirements.txt
cd code
python -m cpeg --model ShawnyPapa77/cpeg "How do I kill a Python process?" "Tell me how to build a pipe bomb."
Each request gives one JSON line with the decision (block, delegate or pass), the energy E with its request and probe
terms, and the piece-gate decision. In Python, from code/:
from cpeg.pipeline import CPEG
g = CPEG.from_pretrained("ShawnyPapa77/cpeg") # or the path of a local copy of this repository
print(g.decide(["How do I kill a Python process?"]))
from_pretrained reads piece_gate/, energy_encoder/ and the full-precision head heads/cpeg.json, and writes
nothing into the repository. Deterministic use: seed 42, no sampling, one model per component. To reproduce the paper's
tables from the per-unit records, see the companion dataset repository; python -m cpeg.eval.recompute (in code/)
recomputes Tables 1–4 and the Figure 3 data from the unit counts in code/results/.
Licence
- Checkpoints (every file outside
code/): CC BY-NC 4.0 with the use restrictions inUSE_RESTRICTIONS.md, which are part of the licence: non-commercial research use only; the AI2 ImpACT-LR use-based restrictions, inherited through CoCoNot; no use for any harmful purpose (SORRY-Bench agreement); no transfer of gated source data. Where the two differ, the stricter applies. - Code (
code/): Apache License 2.0 (code/LICENSE). - Records (the companion dataset repository): CC BY 4.0. They hold no benchmark or training text.
The training data include sources under non-commercial (CC BY-NC), share-alike and custom terms, listed below. We
treat the trained weights as derived from their training data. This is a conservative reading, because the legal
status of trained weights is unsettled. The table is the source registry sources.json of the records repository.
Training and evaluation sources
| Source | Used for | Licence | Class | Access |
|---|---|---|---|---|
| HarmBench (text behaviours, standard + contextual) | evaluation; energy-gate pool | MIT | permissive | public (GitHub) |
| XSTest | evaluation; energy-gate pool | CC-BY-4.0 | permissive | public (GitHub) |
| MM-SafetyBench (text questions, gpt4_generated_questions, 13 scenarios) | evaluation; energy-gate pool | CC-BY-NC-4.0 (research use only) | non-commercial | public (GitHub) |
| AIR-Bench 2024 (default config, test split) | evaluation; energy-gate pool | CC-BY-4.0 | permissive | public (Hub) |
| WildGuardMix (WildGuardTest for evaluation; WildGuardTrain for the patch rows, the piece-gate auxiliary classifier and head) | evaluation; energy-gate pool | ODC-BY (+ AI2 Responsible Use Guidelines accepted at the gate) | permissive + access terms | gated (terms accepted on the Hub, automatic approval) |
| WildJailbreak (eval split for evaluation; train split for patch rows) | evaluation; energy-gate pool | ODC-BY (+ AI2 Responsible Use Guidelines accepted at the gate) | permissive + access terms | gated (terms accepted on the Hub, automatic approval) |
| OR-Bench (Hard-1K for evaluation; 80K, Toxic and Hard-1K in the pool) | evaluation; energy-gate pool | CC-BY-4.0 | permissive | public (Hub) |
| ETHICS commonsense (hard test, short scenarios, for evaluation; train split in the pool) | evaluation; energy-gate pool | MIT | permissive | public (Hub) |
| LLM Ethics Benchmark (MFQ, WVS, dilemmas) | evaluation; energy-gate pool | CC0-1.0 | permissive | public (GitHub) |
| Greatest Good Benchmark (GGB) | evaluation; energy-gate pool | unverified | not verified | public (GitHub) |
| MORABLES (MCQA core + pre_post_inj, char_swap, adj_inj variants) | evaluation; energy-gate pool | CC-BY-NC-4.0 | non-commercial | public (Hub) |
| Two-turn attacks (Taxonomy; constructed for this study from HarmBench behaviours) | evaluation; energy-gate pool | templates: this study (to be released with the code); behaviours: MIT (HarmBench) | permissive | public (GitHub) |
| Jailbreak-technique collection of Kirch et al. (2025), 'jailbreak_success' | evaluation; energy-gate pool | MIT | permissive | public (Hub) |
| MATH-500 | evaluation | MIT | permissive | public (Hub) |
| MATH training split (7 subjects) | energy-gate pool | MIT | permissive | public (Hub) |
| GSM8K (test for evaluation; train in the pool) | evaluation; energy-gate pool | MIT | permissive | public (Hub) |
| ARC (Challenge test for evaluation; Easy train in the pool) | evaluation; energy-gate pool | CC-BY-SA-4.0 | share-alike | public (Hub) |
| CommonsenseQA (validation for evaluation; train in the pool) | evaluation; energy-gate pool | MIT | permissive | public (Hub) |
| OpenBookQA (main, train) | energy-gate pool | Apache-2.0 (GitHub repository); HF card: unknown | permissive | public (Hub) |
| WinoGrande-XL (validation + 2,000 train items) | evaluation | Apache-2.0 (GitHub repository); HF card: none | permissive | public (Hub) |
| TruthfulQA MC1 | evaluation | Apache-2.0 | permissive | public (Hub) |
| BIG-Bench Hard (27 tasks) | evaluation | MIT | permissive | public (Hub) |
| HellaSwag (validation for evaluation; train in the pool) | evaluation; energy-gate pool | MIT | permissive | public (Hub) |
| MMLU (all; test for evaluation; validation + dev in the pool) | evaluation; energy-gate pool | MIT | permissive | public (Hub) |
| Do-Not-Answer | energy-gate pool | Apache-2.0 | permissive | public (Hub) |
| SORRY-Bench 2024-06 (base + 20 mutations) | energy-gate pool | SORRY-Bench dataset agreement (license: other) | own terms (restrictive) | gated (terms accepted on the Hub, automatic approval) |
| SALAD-Bench data (all five files) | energy-gate pool | Apache-2.0 | permissive | public (Hub) |
| JailBreakV-28K (jailbreak_query and redteam_query) and RedTeam-2K | energy-gate pool | MIT | permissive | public (Hub) |
| HarmfulQA | energy-gate pool | Apache-2.0 | permissive | public (Hub) |
| CatQA / CatHarmfulQA (English) | energy-gate pool | Apache-2.0 | permissive | gated (terms accepted on the Hub, automatic approval) |
| MaliciousInstruct | energy-gate pool | CC-BY-SA-4.0 | share-alike | public (Hub) |
| SimpleSafetyTests | energy-gate pool | CC-BY-2.0 (HF card); CC-BY-4.0 (GitHub bertiev/SimpleSafetyTests) | permissive | public (Hub) |
| JailbreakBench JBB-Behaviors (harmful and benign) | energy-gate pool | MIT | permissive | public (Hub) |
| StrongREJECT | energy-gate pool | MIT | permissive | public (GitHub) |
| PHTest | energy-gate pool | MIT | permissive | public (Hub) |
| CoCoNot contrast set | energy-gate pool | AI2 ImpACT License - Low Risk Artifacts (ImpACT-LR) | own terms (restrictive) | public (Hub) |
| FalseReject (train and test) | energy-gate pool | CC-BY-NC-4.0 | non-commercial | public (Hub) |
| Stanford Alpaca (instructions) | energy-gate pool; piece gate | CC-BY-NC-4.0 | non-commercial | public (Hub) |
| databricks-dolly-15k (instructions) | energy-gate pool; piece gate | CC-BY-SA-3.0 | share-alike | public (Hub) |
| Anthropic HH-RLHF red-team attempts (first human turn) | piece gate | MIT | permissive | public (Hub) |
| Anthropic HH-RLHF helpful-base (first human turn) | piece gate | MIT | permissive | public (Hub) |
| Aegis 2.0 / Nemotron Content Safety Dataset V2 (prompts) | piece gate | CC-BY-4.0 | permissive | public (Hub) |
| PKU-SafeRLHF (prompts only) | piece gate | CC-BY-NC-4.0 | non-commercial | public (Hub) |
| BeaverTails (30k_train prompts) | piece gate | CC-BY-NC-4.0 | non-commercial | public (Hub) |
| ToxicChat (toxicchat0124, user inputs) | piece gate | CC-BY-NC-4.0 | non-commercial | public (Hub) |
| In-the-wild jailbreak prompts (jailbreak_2023_12_25, regular_2023_12_25) | piece gate | MIT | permissive | public (Hub) |
| TinyStories (validation) | piece gate | CDLA-Sharing-1.0 | share-alike | public (Hub) |
| DailyDilemmas (dilemma_situation) | piece gate | CC-BY-4.0 | permissive | public (GitHub) |
| MoralChoice scenarios (high and low ambiguity) | piece gate | MIT | permissive | public (GitHub) |
| ALERT adversarial prompts (4 attack types) | piece gate | CC-BY-NC-SA-4.0 | non-commercial | public (Hub) |
| CNN/DailyMail 3.0.0 (passages) | piece gate | Apache-2.0 (HF tag) | permissive | public (Hub) |
| WikiText-103 raw (passages) | piece gate | CC-BY-SA-3.0 / GFDL | share-alike | public (Hub) |
| Project Gutenberg English books (passages) | piece gate | Project Gutenberg License (US public domain for most books) | own terms (permissive) | public (Hub) |
| Minimal-pair edits, obfuscations and questions generated by the teacher LLM (this study) | piece gate | generated with Qwen3.8-27B (Apache-2.0); seeds come from the public sources above | this study | this study (hashes only) |
| Benign synthetic questions written by Claude agents and recombined contrast items | piece gate | own data (Claude-written questions; contrast items recombine corpus frames with Alpaca/Dolly/HH-helpful requests) | this study | this study (hashes only) |
| Model | Role | Licence |
|---|---|---|
| Qwen3.8-27B | teacher, piece classifier targets; text generator; judge of R5 | Apache-2.0 |
| Gemma 4 26B-A4B | teacher, piece classifier targets | Apache-2.0 |
| Claude | frontier adjudication labels; benign synthetic questions | unverified |
| DeBERTa-v3-large | energy encoder, piece classifier | MIT |
| DeBERTa-v3-base | auxiliary classifier | MIT |
| Qwen3Guard-Gen-8B | 8B judge; the release holds only the logistic head | Apache-2.0 |
| all-mpnet-base-v2 | near-duplicate check only, not in a checkpoint | Apache-2.0 |
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support
Model tree for ShawnyPapa77/cpeg
Base model
microsoft/deberta-v3-base