M6 Security Detector v1-2 (probe heads on qwen3-0.6b-sec-m5a-r5)

Six-task safety detection system, single trunk + single inference pass → all results.

Tasks (T1..T6)

#	Task	dev recall @ zero-FP
T1	Content moderation	0.680
T2	Jailbreak / direct prompt injection	0.812
T3	Malicious intent (multi-turn grooming, long-context)	0.751
T4	PII identification (doc + BIO span dual head)	0.885
T5	Indirect prompt injection	0.948
T6	High-risk instruction injection	0.976

Architecture: frozen m5a-r5 backbone (0.6B, 28L), multi-layer features {4,12,20,24,28}x{last,mean} -> 10,240-d, 7 discriminative probe heads, two-band thresholds (logit domain) + Mahalanobis OOD suppression.

Readings (dual runpoint, challenge suite)

T4/T5/T6 recall 100 / 98.3 / 100 @ QA point; verdict = FAIL vs production gates (first iteration)
v0 baseline contrast: r5-logprob discriminative probe reaches only 0-2% recall at zero-FP vs 68-98% for this architecture
Full evidence chain: see the companion GitHub repo (final report reports/m6/final-20261022-0104.md, ADR-1/ADR-2 decision chain)

Files

probe-heads.pt (50MB): 7 task heads
ood_centers.json (32MB): Mahalanobis centers per task
calib.json: runpoint thresholds (logit domain, threshold_space field per schema v0.3.18+)
config.json / head_structure.json / metrics.json / train_log.jsonl: structure + training record

Usage

Load backbone qwen3-06b-sec-m5a-r5 (separate repo), extract features via the m6 pipeline (scripts/m6_feat_probe.py), apply heads + thresholds via scripts/m6_infer.py. Deterministic inference; single forward pass for all six tasks.

Status

v1-2 = first-iteration baseline (trained on clean hot-fixed data, cvalues polarity fix applied). v2 (LoRA r16 + context-conditional T4 construct + form-coverage top-up) is specified in frozen ADR-2; readings pending.

Downloads last month: -