You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
These safety-gate weights are research artifacts from an in-progress MSc thesis and are gated during the review/embargo period. Please tell us who you are and confirm defensive/research intent.
Log in or Sign Up to review the conditions and access this model content.
elrashid/gate-gemma-2-2b-it-l13
A SAE safety gate for google/gemma-2-2b-it: logistic regression over sparse-autoencoder features of the
layer-13 residual stream, scoring P(harmful) from the prompt before generation starts. Part of The Refusal Slope
(MSc thesis, BUiD). Companion SAE: elrashid/sae-gemma-2-2b-it-topk-l13.
TL;DR
- 22 SAE features out of 36,864 carry the decision.
- OOD ROC-AUC 0.991 (95% CI 0.970–1.00) at FP16, unchanged at NF4 4-bit.
- At threshold 0.855: precision 1.00, recall 0.77, F1 0.870 — no false positives on OOD benign.
- Low over-refusal: only 6.2% of tricky-benign prompts get flagged — one of the better balances in the family.
How it works
The gate reads activations, not text. During prefill, the layer-13 residual at the last prompt token is encoded by the companion SAE into 36,864 sparse features; 22 weighted features give P(harmful). One matmul, one dot product, about a millisecond — and gemma-2's small size makes this one of the cheapest end-to-end gate+model pairs.
Evaluation
| metric | FP16 | NF4-4bit |
|---|---|---|
| ROC-AUC, in-distribution | 1.000 | 1.000 |
| ROC-AUC, out-of-distribution | 0.991 (CI 0.970–1.00) | 0.991 (CI 0.970–1.00) |
| Refusal-direction probe (baseline), OOD | 0.658 | 0.655 |
| Confusion at threshold 0.855 (OOD) | TP 77 · FP 0 · TN 100 · FN 23 | — |
| Precision / Recall / F1 | 1.00 / 0.77 / 0.870 | — |
| Over-refusal FPR (xsafe-style tricky-benign) | 0.062 | 0.062 |
Honesty note: a good all-rounder — high AUC, decent recall at threshold, low over-refusal — with no metric hiding a catch. The residual weakness is shared family-wide: evaluation sets in the hundreds, so quote the CI.
How to use
import numpy as np
from huggingface_hub import hf_hub_download
# 1) z = (1, 36864) SAE features of the LAST prompt token
# (see elrashid/sae-gemma-2-2b-it-topk-l13 for the encode snippet; gemma-2 needs eager attention)
g = np.load(hf_hub_download("elrashid/gate-gemma-2-2b-it-l13", "gate.npz"))
p = 1.0 / (1.0 + np.exp(-(z @ g["sae_coef"].T + g["sae_intercept"]))) # P(harmful)
flag = bool(p >= float(g["op_threshold"])) # 0.855
gate.npz fields: sae_coef (1×36864), sae_intercept, feature_ids (22 active features), op_threshold,
refusal_dir, layer.
Limitations
- Specific to gemma-2-2b-it at layer 13 with this SAE; no cross-model transfer.
- gemma-2 requires
attn_implementation="eager"(logit soft-capping) when extracting activations. - Hundreds of evaluation prompts; the CI is the honest claim.
Intended use & ethics
Defensive filtering and safety research only. A detector, not a generator. Downstream use must comply with the Gemma licence.
Citation
Elrashid, M. (2026). The Refusal Slope: A Mechanistic Taxonomy of Feature Fate in Quantized Edge Intelligence. MSc thesis, BUiD.