Request access to Poison Pawn

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

Poison Pawn is a gated research repository from Aligned Super Intelligence. Access is for authorized security research and evaluation only. By requesting access you agree not to use this work against production systems without explicit authorization, and not to redistribute gated materials.

Poison Pawn

Aligned Super Intelligence (alignedsafely.com)

Status: foundation scaffold + placeholder inference. The formal math and method body are not in this repo yet. Weights are not published. A local / Endpoints server serves a public base instruct model as a placeholder so the inference path can be developed. Gated access, GPU run/deploy paths, and candidate models are ready for when the math lands.

The idea

In chess, a poisoned pawn looks free to take. Capturing it is the move the opponent wants — and the trap springs on that capture.

Poison Pawn applies the same shape to an AI model:

Bait — offer a line that looks advantageous (the model is steered toward an attack or an obvious win).
Expected capture — the reply / action you predict the model will take.
Trap — fire once that capture is taken.

The equations that define bait, expected capture, and trap score live in math/ and are pending (to be supplied). Do not invent a scoring function or claim results until then.

Access

This repository is gated (manual review). Request access on this page. Approved users can clone, run on GPU, and deploy via Hugging Face providers.

Candidate models (to source on GPU)

See configs/models.yaml. Starting points:

Model	VRAM (fp16)	VRAM (4-bit)
`Qwen/Qwen2.5-7B-Instruct`	~16 GB	~6 GB
`meta-llama/Llama-3.1-8B-Instruct`	~16 GB	~6 GB
`mistralai/Mistral-7B-Instruct-v0.3`	~16 GB	~6 GB
`microsoft/Phi-3.5-mini-instruct`	~8 GB	~4 GB
`Qwen/Qwen2.5-14B-Instruct`	~28 GB	~10 GB

Default for smoke tests: Qwen/Qwen2.5-7B-Instruct (override with POISON_PAWN_MODEL).

Hardware and run times (smoke load only)

Until the method is implemented, scripts/run_gpu.py only loads a model and prints device info — it does not run an attack.

Setup	Peak VRAM	Wall time (load + 1 short generation)
7B fp16/bf16 on 1× 24 GB GPU	~14–16 GB	~30–90 s first load (cached after)
7B 4-bit on 1× 8–12 GB GPU	~5–6 GB	~45–120 s first load
14B fp16 on 1× 40 GB+ GPU	~28 GB	~1–3 min first load

Quick start (GPU)

# after access is granted
git lfs install
git clone https://huggingface.co/alignedsi/poison-pawn
cd poison-pawn
python -m venv .venv && source .venv/bin/activate
pip install -e ".[gpu]"

export POISON_PAWN_MODEL=Qwen/Qwen2.5-7B-Instruct
export CUDA_VISIBLE_DEVICES=0
python scripts/run_gpu.py
# optional 4-bit:
python scripts/run_gpu.py --4bit

Run via Hugging Face Inference Providers (no local GPU)

Inference Providers route chat to partner-hosted base models (Together, Fireworks, Groq, …). They do not host this repo’s weights yet (none published). Use them for the target LLM while Poison Pawn stays the gated method/harness.

# Token needs: Make calls to Inference Providers
# https://huggingface.co/settings/tokens
export HF_TOKEN=hf_...

pip install -e ".[providers]"
python scripts/run_via_providers.py --list-only
python scripts/run_via_providers.py --model Qwen/Qwen2.5-7B-Instruct --provider auto
python scripts/run_via_providers.py --provider together

OpenAI-compatible:

curl https://router.huggingface.co/v1/chat/completions \
  -H "Authorization: Bearer $HF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model":"Qwen/Qwen2.5-7B-Instruct:fastest","messages":[{"role":"user","content":"ping"}],"max_tokens":32}'

Full guide: deploy/README.md · Docs: Inference Providers

Inference (placeholder base model)

There are no poison-pawn weights yet. The server below loads a public base instruct model (default Qwen/Qwen2.5-0.5B-Instruct) so the serving path and client flow can be developed and deployed. Do not present this as a Poison Pawn model.

A. Serve locally (OpenAI-compatible)

pip install -e ".[serve]"
export POISON_PAWN_MODEL=Qwen/Qwen2.5-0.5B-Instruct   # placeholder base model
python scripts/serve.py --host 0.0.0.0 --port 8000
# equivalent:
# uvicorn poison_pawn.server:app --host 0.0.0.0 --port 8000

Routes: GET /health · POST /v1/chat/completions

curl -s http://127.0.0.1:8000/health | python -m json.tool
curl -s http://127.0.0.1:8000/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"placeholder","messages":[{"role":"user","content":"ping"}],"max_tokens":32}'

B. Run the client flow (bait → capture → trap)

Uses the harness stubs in src/poison_pawn/harness.py. The printed trap_score_placeholder is not a real metric — math/ is still pending.

# against the local server
python scripts/run_inference.py --backend local --base-url http://127.0.0.1:8000

# against HF Inference Providers (target LLM; needs HF_TOKEN)
pip install -e ".[providers]"
export HF_TOKEN=hf_...
python scripts/run_inference.py --backend providers \
  --model Qwen/Qwen2.5-7B-Instruct --provider auto

Transcripts are written under logs/ as JSON.

C. Custom container (Inference Endpoints)

See deploy/Dockerfile and deploy/README.md. Container listens on $PORT (HF default 80), exposes /health.

Deploy your own GPU (Inference Endpoints)

When weights or a serving image land in this repo: model page → Deploy → Inference Endpoints. Pick AWS / GCP / Azure + GPU; keep access private/authenticated. Skeleton: deploy/inference-endpoint.yaml. Docs: Inference Endpoints

Self-hosted CUDA: see Quick start (GPU) above. Provider list also in configs/models.yaml.

Repo layout

poison-pawn/
  README.md
  STATUS.md
  LICENSE
  pyproject.toml
  configs/models.yaml           # candidate models + providers
  math/                         # formalization — PENDING
  src/poison_pawn/              # harness stubs + server (placeholder)
  scripts/serve.py              # OpenAI-compatible server (base model placeholder)
  scripts/run_inference.py      # client flow: bait → capture → trap
  scripts/run_gpu.py            # local GPU smoke load
  scripts/run_via_providers.py  # HF Inference Providers (target LLM)
  logs/                         # flow transcripts (gitignored JSON)
  deploy/                       # Dockerfile + providers + Endpoints notes

Honesty

No weights and no measured attack-success rates in this scaffold.
No novel method claimed until math/ is filled and evaluated.
Sandboxed / authorized research use only. Never point unfinished tooling at production systems without authorization.

Contact

Aligned Super Intelligence — leadership@alignedsafely.com

Downloads last month: -; Downloads are not tracked for this model. How to track