You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
These safety-gate weights are research artifacts from an in-progress MSc thesis and are gated during the review/embargo period. Please tell us who you are and confirm defensive/research intent.
Log in or Sign Up to review the conditions and access this model content.
elrashid/gate-qwen2.5-7b-instruct-l14
A SAE safety gate for Qwen/Qwen2.5-7B-Instruct: logistic regression over sparse-autoencoder features of
the layer-14 residual stream, scoring P(harmful) from the prompt alone — the verdict lands before the first output
token. Part of The Refusal Slope (MSc thesis, BUiD). Companion SAE: elrashid/sae-qwen2.5-7b-instruct-topk-l14.
TL;DR
- 20 SAE features out of 57,344 carry the decision.
- OOD ROC-AUC 0.964 (95% CI 0.940–0.982) at FP16; 0.968 at NF4 — the 4-bit gate is marginally better.
- Tuned deliberately conservative: at threshold 0.891 the gate has zero false positives (precision 1.00) and zero over-refusal on tricky-benign prompts.
- The flip side of that tuning is recall 0.48 at the operating point — the AUC shows the separability; the threshold trades recall for a hard no-false-positive guarantee.
How it works
No text is read. During prefill, the layer-14 residual activation of the last prompt token is encoded by the companion SAE into 57,344 sparse features; a 20-weight logistic regression converts them to P(harmful). The cost is one matmul plus a dot product (~1 ms), fully parallel to the generation the model was going to do anyway.
Evaluation
| metric | FP16 | NF4-4bit |
|---|---|---|
| ROC-AUC, in-distribution | 1.000 | 1.000 |
| ROC-AUC, out-of-distribution | 0.964 (CI 0.940–0.982) | 0.968 (CI 0.945–0.984) |
| Refusal-direction probe (baseline), OOD | 0.639 | 0.644 |
| Confusion at threshold 0.891 (OOD) | TP 48 · FP 0 · TN 100 · FN 52 | — |
| Precision / Recall / F1 | 1.00 / 0.48 / 0.649 | — |
| Over-refusal FPR (xsafe-style tricky-benign) | 0.000 | 0.000 |
Honesty note: the operating threshold was set for precision, and this model's separation margin means half the harmful set sits below it. If your deployment tolerates a few false positives, lower the threshold — the 0.964 AUC is the true capability; the shipped threshold is one point on that curve.
How to use
import numpy as np
from huggingface_hub import hf_hub_download
# 1) z = (1, 57344) SAE features of the LAST prompt token
# (see elrashid/sae-qwen2.5-7b-instruct-topk-l14 for the encode snippet)
g = np.load(hf_hub_download("elrashid/gate-qwen2.5-7b-instruct-l14", "gate.npz"))
p = 1.0 / (1.0 + np.exp(-(z @ g["sae_coef"].T + g["sae_intercept"]))) # P(harmful)
flag = bool(p >= float(g["op_threshold"])) # 0.891
gate.npz fields: sae_coef (1×57344), sae_intercept, feature_ids (20 active features), op_threshold,
refusal_dir, layer.
Limitations
- Specific to Qwen2.5-7B-Instruct at layer 14 with this SAE; gates do not transfer across models.
- Low recall at the shipped threshold is a tuning choice, not a ceiling — read the AUC row first.
- Evaluation sets are hundreds of prompts; quote the confidence interval.
Intended use & ethics
Defensive filtering and safety research only. A detector, not a generator — no harmful content is distributed. Downstream use must comply with Qwen2.5-7B-Instruct's licence.
Citation
Elrashid, M. (2026). The Refusal Slope: A Mechanistic Taxonomy of Feature Fate in Quantized Edge Intelligence. MSc thesis, BUiD.