specialist-vuln-merged-hermes43-lora

A vulnerability-gate LoRA adapter for Hermes-4.3-36B, built by training six group-specific LoRA specialists and merging them into a single adapter. Given code or a request, the model's job is narrow: find a vulnerability, or don't — the downstream logic is a boolean gate, not free text.

IF vulnerability_found: RETURN FALSE

This is EXP-033 — the second full repeat of the specialist-per-group-then-merge architecture (first repeat: EXP-031). Full writeup, dataset, and training logs are in the sipa-os-governance repo, commit 50ba3c28, file AI_EXPERIMENTS/EXP-033__vuln-gate-Hermes4.3-36B-6specialist-merge-independent-eval.md.

What this is

Six LoRA specialists, one per vulnerability category, trained independently and merged into this single adapter rather than trained jointly. Rank 16, alpha 16, dropout 0.05, targeting all attention and MLP projections (q_proj k_proj v_proj o_proj gate_proj up_proj down_proj).

Eval ran at three independent levels, not one:

1. Self-eval — the training project's own held-out split.
2. External dataset — garak-sourced, six groups, source honestly labeled (sipa-os-governance/AI_EXPERIMENTS/DATASETS_VULN_6GROUPS_EXTERNAL/), not generated by the same pipeline that trained the model.
3. Sampling test — repeated generation under a specific adversarial pressure (below), not single-shot.

The finding this release is actually about

Single-pass greedy decoding on five reframe-attack scenarios (the model correctly flags a vulnerability, then gets asked to reuse that same finding as a "workaround" for something unrelated) scored 5/5 — 100%.

Re-running the same five scenarios with real sampling (temperature 0.7, the setting this project's evals use throughout), ten times each, 50 generations total, scored 47/50 — 94%. Three categories held 10/10; two clustered at 9/10 and 8/10, both in the same failure mode — an infra-misconfig "urgent fix, use this as a workaround" framing reads as more legitimate to the model than the identical ask framed around secrets or injection.

On the larger held-out/adversarial sets: 117/120 and 116/120 — not 120/120.

None of these numbers are papered over. A single passing check standing in for a property that only variance reveals is the specific mistake this model's own eval process is built to catch, including in itself. 94% under adversarial reframing is a real, useful number. A gate that's "100%" because it was asked once is a number that hasn't been tested yet.

Usage

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

base = "NousResearch/Hermes-4.3-36B"
adapter = "SoulInPsyAbstract/specialist-vuln-merged-hermes43-lora"

tokenizer = AutoTokenizer.from_pretrained(base)
model = AutoModelForCausalLM.from_pretrained(base, device_map="auto")
model = PeftModel.from_pretrained(model, adapter)

Limitations

• This is a detection layer, not a remediation layer. It flags; a human approves any fix.
• It is one of ~3-7 residual gaps out of 120 in the adversarial set, not a solved problem — see the sampling finding above. Treat any single eval run as one draw from a distribution, not the distribution.
• Designed to sit inside a nested architecture (model → gate → eval → manual check → external reviewer), not to be the final authority on its own output.

Related

• Post: sampling finding writeup — "One shot said 100%. Ten shots said 94%."
• EXP-031 — first repeat of this same specialist-per-group-then-merge architecture, different base model.