prism-qwen3.5-9b-grpo

A trained PRISM monitor for Qwen/Qwen3.5-9B — Recovering Instruction Sets from Language Model Activations (arXiv:2606.09563).

PRISM reads residual-stream hidden states from a frozen target model and decodes them into a bulleted list of the instructions currently steering it, including injected instructions the model was never told to reveal.

This is not a language model. It is a linear projection plus LoRA adapters (~75M trained parameters) that attach to Qwen/Qwen3.5-9B, which you obtain separately under its own licence. No base weights are included or redistributed here.

Target model	Qwen/Qwen3.5-9B
Hook layer	16
Activation window	last 128 response tokens
Training	SFT followed by judge-guided GRPO. This is the main method in the paper.
File	prism-qwen3.5-9b-grpo.pt (266 MB)

Usage

git clone https://github.com/Offensive-AI-Lab/prism-eval
cd prism-eval && uv sync --extra dev

export PRISM_EVAL_CHECKPOINT_DIR=./checkpoints
python scripts/download_weights.py --only prism-qwen3.5-9b-grpo

prism-eval evaluate --config configs/main/qwen3.5-9b-grpo.yaml --offline

The evaluation harness, the 1000-record benchmark, the scorers and the human-labelled judge calibration data are in prism-eval. Other checkpoints are in the PRISM collection.

Verification

prism-qwen3.5-9b-grpo.pt  sha256  0968b4581517dca88ee229a44dc575240ebfcb8f2b6e2b7d9674c8b3d29a0659

scripts/download_weights.py checks this on download and treats a mismatch as a hard error, so a truncated or substituted file fails loudly instead of producing wrong numbers.

Citation

@article{gressel2026prism,
  title   = {PRISM: Recovering Instruction Sets from Language Model Activations},
  author  = {Gilad Gressel and Rahul Pankajakshan and Julia Diament and Efim Hudis and Krishnashree Achuthan and Yisroel Mirsky},
  journal = {arXiv preprint arXiv:2606.09563},
  year    = {2026},
  url     = {https://arxiv.org/abs/2606.09563}
}