You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
These safety-gate weights are research artifacts from an in-progress MSc thesis and are gated during the review/embargo period. Please tell us who you are and confirm defensive/research intent.
Log in or Sign Up to review the conditions and access this model content.
elrashid/gate-gemma-4-e2b-it-l17
A SAE safety gate for google/gemma-4-E2B-it (MatFormer, multimodal): logistic regression over
sparse-autoencoder features of the layer-17 residual stream, scoring P(harmful) from the prompt before generation.
Part of The Refusal Slope (MSc thesis, BUiD). Companion SAE: elrashid/sae-gemma-4-e2b-it-topk-l17.
TL;DR
- 17 SAE features out of 24,576 carry the decision.
- OOD ROC-AUC 0.862 (95% CI 0.810–0.910) at FP16; 0.882 at NF4 — one of the two weakest gates in the family, stated plainly.
- The refusal-direction probe is at chance here (0.496) — on this architecture, only the SAE features recover a usable safety signal at all.
- At threshold 0.697: precision 0.848, recall 0.56 (10 false positives on 100 OOD benign).
How it works
During prefill, the layer-17 residual of the language tower (vision tower bypassed) is encoded into 24,576 sparse features; 17 weighted features give P(harmful) in about a millisecond. The MatFormer architecture's elastic representation appears to spread the safety signal thinner than in dense models — visible in every row of the evaluation below.
Evaluation
| metric | FP16 | NF4-4bit |
|---|---|---|
| ROC-AUC, in-distribution | 0.993 | 0.993 |
| ROC-AUC, out-of-distribution | 0.862 (CI 0.810–0.910) | 0.882 (CI 0.834–0.924) |
| Refusal-direction probe (baseline), OOD | 0.496 (chance) | 0.501 (chance) |
| Confusion at threshold 0.697 (OOD) | TP 56 · FP 10 · TN 90 · FN 44 | — |
| Precision / Recall / F1 | 0.848 / 0.56 / 0.675 | — |
| Over-refusal FPR (xsafe-style tricky-benign) | 0.000 | 0.013 |
Honesty note: use this gate as a research probe, not a production filter. The ID/OOD gap (0.993 → 0.862) says it generalises worst in the family. The scientifically interesting part is the baseline row: a linear refusal direction carries no OOD signal on this MatFormer model, while sparse features still carry a real one.
How to use
import numpy as np
from huggingface_hub import hf_hub_download
# 1) z = (1, 24576) SAE features of the LAST prompt token
# (see elrashid/sae-gemma-4-e2b-it-topk-l17 for the multimodal encode snippet)
g = np.load(hf_hub_download("elrashid/gate-gemma-4-e2b-it-l17", "gate.npz"))
p = 1.0 / (1.0 + np.exp(-(z @ g["sae_coef"].T + g["sae_intercept"]))) # P(harmful)
flag = bool(p >= float(g["op_threshold"])) # 0.697
gate.npz fields: sae_coef (1×24576), sae_intercept, feature_ids (17 active features), op_threshold,
refusal_dir, layer.
Limitations
- Weakest-tier OOD generalisation in the family; do not deploy as a sole safety layer.
- Specific to gemma-4-E2B-it at layer 17 with this SAE; text-tower activations only.
- Hundreds of evaluation prompts; the CI is wide — quote it.
Intended use & ethics
Defensive filtering and safety research only. A detector, not a generator. Downstream use must comply with the Gemma licence.
Citation
Elrashid, M. (2026). The Refusal Slope: A Mechanistic Taxonomy of Feature Fate in Quantized Edge Intelligence. MSc thesis, BUiD.