Heretic-Resistant Tiny Aya: Models
Collection
Tiny Aya Global hardened against abliteration (Heretic). Lexsi x Cohere x HF hackathon, Track 2b. • 5 items • Updated
Tiny Aya Global: extended-refusal (xref-v1)
A safety-hardened version of Tiny Aya Global (3.35B). It is the first step of a study on making open-weight models resistant to abliteration: removing the refusal direction from the weights, as automated by Heretic.
How it was made
- LoRA SFT (r=32, alpha 64, all linear layers, 2 epochs, lr 1e-4), merged into the weights.
- Data: tiny-aya-extended-refusal. It holds 1,200 extended refusals: long refusals that explain the reason, written by Tiny Aya itself, following arXiv 2505.19056. It also holds 1,155 everyday answers distilled from the model on Dolly prompts.
The stronger defense is xref-v2.
Results (refusal on mlabonne/harmful_behaviors test[:100])
| Model | Over-refusal (XSTest safe) | Refusal under Heretic, KL ≤ 0.01 | KL ≤ 0.05 | KL ≤ 0.1 | Lowest refusal Heretic reached | MMLU (1k) |
|---|---|---|---|---|---|---|
| Tiny Aya Global (original) | 16% | 14% | 14% | 14% | 14% | 52.3% |
| xref-v1 | 17.6%† | 70% | 43% | 17% | 17% | 50.7%† |
| xref-v2 | 39% | 100% | 100% | 96% | 33% | 53.0% |
xref-v2b (v2b/ subfolder of xref-v2) |
18% | 99% | 52% | 47% | 47% | 52.7% |
| † v1 was not re-measured after the single-BOS evaluation fix. All other over-refusal (XSTest safe, judged) and MMLU numbers are final single-BOS numbers. |
Each Heretic run is a fresh 40-trial search on that checkpoint (an adaptive attacker). KL is measured on harmless prompts; lower KL means a cheaper, less visible attack. Heretic's own refusal numbers are keyword-scored. Judged results for all attacks are on the xref-v2 card.
Limitations
- Fine-tuning still wins. A harmful LoRA fine-tune with about 100 examples removes refusal from every model here, including the defended ones. These checkpoints resist data-free weight editing (abliteration / Heretic), not fine-tuning attacks.
- No measurable capability cost: MMLU is 52.3% (original), 53.0% (v2) and 52.7% (v2b).
- Over-refusal: v2 over-refuses noticeably; v2b reduces this.
- Coverage: one model size (3.35B); English evaluation only.
License
CC-BY-NC-4.0, inherited from CohereLabs/tiny-aya-global. Use must also follow Cohere's acceptable use policy.
Project
Lexsi Labs × Cohere × Hugging Face AI Safety & Alignment Hackathon, Track 2b (Tamper Resistance).
- Downloads last month
- 24
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support