Z-Edgar/CoER-Attacker

CoER Attacker a200

Research artifact accompanying CoER, published at the repository owner's request. This identity-linked repository is not an anonymous-reviewer resource. Model weights are being transferred; the checkpoint is usable only after all weight files and required configuration files are present. Public access does not add a redistribution license.

Model and training

This is the retained a200 attacker from bilateral Co-PPO in CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement. The paper's workflow is Attacker SFT, bilateral Co-PPO, then population-guided Defender SFT. The attacker adapts later tool-return injections to the public execution trace and prior attempts, without access to hidden defender reasoning.

The artifact has BF16 text-only weights and a Qwen3_5ForCausalLM / qwen3_5_text configuration. It is not interchangeable with the defender's conditional-generation model class. The metadata identifies the Qwen3.5-9B base family; the full intermediate initialization lineage and all applicable redistribution notices still require owner confirmation.

Evaluation and selection scope

Paper Table 7 reports the Co-PPO attacker's reach-conditioned Effective ASR as 65.65% against Base, 29.78% against Co-PPO and 0.36% against CoER. These are paper-transcribed rates, not a benchmark rerun of this package. The updated paper states that per-cell success, eligible and reach counts for its corrected cross-play matrix are unavailable. Do not reconstruct those counts from older diagnostic panels.

The local a200 candidate was selected from an existing fixed-Base diagnostic comparison. This does not establish an independent validation-selection procedure, confirm every mapping in the paper's full cross-play matrix, or prove this checkpoint is the strongest attacker against every defender.

Intended use and limitations

For authorized benchmark evaluation, red-teaming and defense development in isolated environments only. The model generates adversarial instructions; it is not a general-purpose assistant or a safe user-facing system. Do not connect it to real accounts, private data or uncontrolled external tools. Potential misuse, data permissions and memorization require separate review. If distribution requires identity-gated access, do not use that gate as the anonymous-reviewer access route.

Loading and file verification

Use a Transformers stack supporting the saved text-only Qwen3.5 architecture and the accompanying attack/chat contract. Preserve tokenizer vocabulary, special tokens, templates and generation parameters. Nonfunctional training-origin metadata is removed only from the publication copy; the original checkpoint is retained separately.

Candidate hashes are compared with the original verified download manifest. Safetensors metadata, tokenizer JSON and file layout are checked offline. No GPU loading, inference or evaluation rerun is claimed. Training corpora and private services are not bundled with this model.

License and attribution

Base family: Qwen3.5-9B. Its Apache-2.0 license and copyright notice are preserved in UPSTREAM_LICENSE. This does not resolve rights in intermediate models, fine-tuned weights, training data or teacher outputs. The final artifact license and redistribution permissions remain pending owner confirmation. Author-identifying citation metadata is omitted during anonymous review.