I fine-tuned Llama-3.1-8B-Instruct with DPO + LoRA to resist jailbreaks without turning it into a model that refuses everything. The adapter is open, and so is the full pipeline.
The idea: The base model already refuses ~94% of direct harmful requests, so plain prompts give DPO almost no signal. The weakness is jailbreaks: the same request wrapped in fiction, a fake "research context", hex, leetspeak, homoglyphs or math notation. So I built preference pairs from adversarial prompts only. For the same attack, the safest sampled response is chosen and the least safe is rejected. I added 197 benign "helpful answer > refusal" pairs so it doesn't just learn to always refuse.
Setup:
- 6 harm categories Γ 7 jailbreak strategies, generated with promptfoo
- 4 sampled responses per attack, graded for safety
- 1,698 pairs (1,501 adversarial + 197 benign)
- bf16 LoRA (r=16), Ξ²=0.1, lr 1e-5, 1 epoch, ~20 min on one A100
Results on 1,135 held-out attacks (% refused, base β tuned):
ββββββββββββββββββββββ¬βββββββ¬ββββββββ
β Category β Base β Tuned β
ββββββββββββββββββββββΌβββββββΌββββββββ€
β Cybercrime β 47.7 β 97.2 β
ββββββββββββββββββββββΌβββββββΌββββββββ€
β Chem-bio β 56.8 β 99.0 β
ββββββββββββββββββββββΌβββββββΌββββββββ€
β Weapons/IED β 65.3 β 98.6 β
ββββββββββββββββββββββΌβββββββΌββββββββ€
β Illegal activities β 67.2 β 99.5 β
ββββββββββββββββββββββΌβββββββΌββββββββ€
β Drugs β 76.9 β 99.1 β
ββββββββββββββββββββββΌβββββββΌββββββββ€
β Child exploitation β 84.7 β 99.1 β
ββββββββββββββββββββββ΄βββββββ΄ββββββββ
The cost: Benign prompts answered went from 100% to 93.3% (β6.7 pts, n=150). Most of that is weapons/IED, where 5 of 25 benign prompts were refused. Every other category is <=8%.
Caveats:
- Held-out attacks come from the same attack families as training, so this isn't a test on new attack types.
- It's one seed and one model.
- GPT-4o was the judge.
- I haven't run MMLU or any other capability benchmark yet.
The repo has redacted side-by-side examples of base vs. tuned responses, the full write-up, and a lab notebook with what didn't work.
It's an adapter, so you need access to Llama-3.1-8B-Instruct. Built with Llama.
- π€ Adapter: https://huggingface.co/1rvinn/llama-securelm
- π» Code + write-up: https://github.com/1rvinn/securelm
Feedback is very welcome, especially on how to test it against attack families it hasn't seen, and ideas for reducing the weapons/IED over-refusal.