GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
galwert
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
galwert
Model Tree
microsoft/Phi-3-medium-4k-instruct
Input Modalities
Output Modalities
Supported Functionality
Defensive research on cross-model jailbreak robustness for open-weight LLMs. Apply the adapter on top of the unmodified base model to obtain a hardened version. Not for production deployment without independent safety validation.
python
from transformers import AutoModelForCausalLM, AutoTokenizerfrom peft import PeftModel base = "microsoft/Phi-3-medium-4k-instruct"adapter = "galwert/AnchorRep-Phi-3-medium-4k-instruct" tokenizer = AutoTokenizer.from_pretrained(base, trust_remote_code=True)model = AutoModelForCausalLM.from_pretrained( base, torch_dtype="float16", device_map="auto", trust_remote_code=True)model = PeftModel.from_pretrained(model, adapter)Merge the adapter into the base weights for a single deployable model:
python
model = model.merge_and_unload()| Parameter | Value | Role |
|---|---|---|
| Refusal-direction weight (α) | 0.15 | refusal projection |
| Coherency weight (β) | 1.0 | benign output preservation |
| CKA repulsion weight (γ) | 2.0 | anchor repulsion |
| LM weight (δ) | 0.08 | next-token preservation |
| KL weight (ε) | 0.5 | benign KL preservation |
| CKA scope | harmful_only | prompts contributing to repulsion |
| Training steps | 200 | |
| LoRA rank / alpha | 32 / 64 | |
| Target modules | q,k,v,o,up,down,gate_proj | |
| Layer | mid (50% depth) | |
| Precision | fp16 | |
| Seed | 42 |
Full training config in training_config.json. Per-loss ablations and hyperparameter ranges are in the paper appendix.
| Metric | Value |
|---|---|
| Cross-model GCG transfer ASR (self / anchor / other) | 0% / 0% / 0% |
| Benign Garble Rate (OR-Bench) | 0% |
| Δ XSTest refusal | +2.0 |
| Δ OR-Bench refusal | -1.0 |
| Δ MT-Bench | +0.40 |
ASR is reported after manual verification per the paper protocol.
See the paper Limitations section for full discussion.
The LoRA delta is intended for use with Phi-3-medium-4k-instruct and is released under the MIT License, matching the base model.
bibtex
@inproceedings{anchorrep2026, title={AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion}, author={Wertheizer, Gal and Himelstein, Rom and Peretz, Tomer and Mendelson, Avi}, booktitle={NeurIPS}, year={2026}}Companion GitHub repository (training, evaluation, audit logs, GCG suffixes): https://github.com/galwert/AnchorRep
from transformers import AutoModelForCausalLM, AutoTokenizerfrom peft import PeftModel base = "microsoft/Phi-3-medium-4k-instruct"adapter = "galwert/AnchorRep-Phi-3-medium-4k-instruct" tokenizer = AutoTokenizer.from_pretrained(base, trust_remote_code=True)model = AutoModelForCausalLM.from_pretrained( base, torch_dtype="float16", device_map="auto", trust_remote_code=True)model = PeftModel.from_pretrained(model, adapter)@inproceedings{anchorrep2026, title={AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion}, author={Wertheizer, Gal and Himelstein, Rom and Peretz, Tomer and Mendelson, Avi}, booktitle={NeurIPS}, year={2026}}