Explain model applications and add concrete examples; apply requested names

README.md

@@ -1,80 +1,84 @@
----
-license: gemma
-base_model: google/gemma-3-1b-it
-library_name: peft
-language:
-- en
-tags:
-- lora
-- interpretability
-- instruction-following
-- research
----
-
-# Restriction Learning Experiment
-
-The **actual selective-restriction Gemma 3 1B adapter** used by [LoRA-Forensics](https://huggingface.co/spaces/itsalissonsilva/LoRA-Forensics), [Neural-Steering-Lab](https://huggingface.co/spaces/itsalissonsilva/Neural-Steering-Lab) and [Circuit-Scope](https://huggingface.co/spaces/itsalissonsilva/Circuit-Scope). Public weights make their measured layer/strength/intervention experiments reproducible without access to a private adapter.
-
-The question is narrow: **does the model withhold marked-private workspace values while still answering permitted requests?** Every condition receives the same explicit policy. All workspaces and private values are synthetic. This is not a real access-control system, privacy guarantee or general safety model.
-
-## What it learned, and where it failed
-
-96 fixed requests: 84 policy cases from 12 held-out workspaces, eight public-label flips and four unrelated questions.
-
-| Condition | Pass exact automatic checks | Allowed assistance checks | Disclosures |
-|---|---:|---:|---:|
-| Base Gemma | 28/96 | 28/48 | 4 |
-| Selective adapter (root weights) | **75/96** | **39/48** | 3 |
-| Blanket-refusal adapter | 36/96 | 0/48 | **0** |
-| Matched random adapter | 25/96 | 25/48 | 4 |
-
-**The selective adapter introduces three indirect disclosures on cases where the base did not disclose.** Its lower total disclosure count does not mean it fixed every base failure. It passes only 3/12 ambiguity/clarification cases and 3/4 unrelated questions, compared with 4/4 unrelated answers for base Gemma. Its permitted-task gains coexist with specific regressions.
-
-Disclosure checks cover literal, reversed, base64 and whitespace-normalized synthetic canaries. Allowed-answer/content checks and structured validity are finite automatic proxies, not human-rated usefulness or an exhaustive attack evaluation. The blanket control demonstrates why fewer disclosures alone is an inadequate objective.
-
-## Training and controls
-
-Base revision `dcc83ea841ab6100d6b47a070329e1ba4cf78752`; rank16 Q/V LoRA, two fixed epochs, one seed, 784 examples (112 training workspaces × seven request types). Selective and blanket-refusal adapters start from identical initialization. Development examples were unused; the fixed epoch schedule was not selected on the test.
-
-Held-out templates and table/JSON record layouts test limited generalization. They do not establish transfer to policy omission, other languages, real documents, arbitrary private facts or tools. The model performs text generation only and enforces no external authorization.
-
-`selective/` preserves the original selective checkpoint; root weights are an identical copy for standard PEFT loading. `blanket/` preserves the over-refusal control. The matched random adapter is reconstructed from its fixed seed and module-wise delta Frobenius norms in the training source.
-
-## Layer and strength analysis
-
-`analysis/analysis.json` records five strengths, 26 single-layer removals, 27 hidden-state comparisons and 52 module spectra. Reference-answer likelihood and drift use all 84 policy cases; generated intervention checks use a separate fixed 14-case subset. Likelihood includes one target wording/JSON format and is not a standalone safety score. Large weight updates or representation drift do not alone establish causality.
-
-Matched-batch restoration gives 14/14 identical raw responses and exact likelihood restoration. The original cross-batch capture matched 13/14 raw outputs (14/14 graded outcomes), so batch-composition sensitivity is retained in the provenance.
-
-`interpretability_patchfix/patching.json` is the corrected generation-prefill causal-patching capture with **208/208** exact raw self-restorations. The earlier ordinary-forward/final-normalization patch rows in `interpretability/results.json` are superseded and must not be used as valid patching evidence. Steering/probe measurements in that file remain separate experiments.
-
-This is descriptive follow-up on already opened test data, with no significance or complete-circuit claim. The strongest evidence is the actual base/control/adapted response record, including its failures.
-
-## Run it
-
-Accept Gemma's base-model access terms and authenticate. Reproduction environment: PyTorch2.6.0, Transformers4.57.1, PEFT0.17.1, Accelerate1.10.1, SentencePiece0.2.1. Recorded GPU evaluation uses bfloat16; exact parity depends on the same batch/attention settings.
-
-Download `restriction.py`, then reproduce a permitted case:
-
-```python
-import json
-from huggingface_hub import hf_hub_download
-from restriction import RestrictionModel
-
-repo = "itsalissonsilva/Restriction-Learning-Experiment"
-report = json.load(open(hf_hub_download(repo, "restriction_results.json")))
-case = next(row for row in report["rows"] if row["kind"] == "public")
-print(case["context"], case["request"])
-model = RestrictionModel()  # Pin revision to a release commit for a frozen run.
-print(model.respond_rows([case])[0])
-```
-
-For a new synthetic case, provide `context`, `request` and optionally `policy` in the same record format. The helper returns raw generated JSON-like text, not a guaranteed valid action or an authorization decision. It rejects overly long input rather than truncating the policy. CPU float32 is a different configuration from recorded GPU measurements.
-
-## Reproduce and license
-
-Training, data generation/grading, analysis, restoration, steering and corrected patching sources are included with fixed model revisions and measured results. The Spaces are restrained cached viewers; changing a control selects an existing recorded run. They do not run live inference.
-
-Research inspiration: [Meng et al., ROME / CounterFact](https://rome.baulab.info/) and its efficacy/generalization/specificity criteria. This is LoRA restriction training, not a reproduction of ROME's factual MLP editing method.
-
-Modified artifact notice: the adapter weights were trained by itsalissonsilva and modify Gemma. Gemma and this derivative are subject to the included Gemma Terms of Use and Section3.2 restrictions, including the incorporated Prohibited Use Policy. See `LICENSE`, `NOTICE` and `GEMMA_PROHIBITED_USE_POLICY.txt`. No Google endorsement is implied.
+---
+license: gemma
+base_model: google/gemma-3-1b-it
+library_name: peft
+language:
+- en
+tags:
+- lora
+- interpretability
+- instruction-following
+- research
+---
+
+# Restriction-Learning-Experiment
+
+A controlled LoRA testbed for finding the point where helpful answering turns into disclosure or excessive refusal. The Gemma 3 1B adapter reads a synthetic workspace, an explicit visibility policy and a request, then generates an answer, withholding decision or clarification attempt.
+
+Use the released weights and matched controls to reproduce the experiments in [LoRA-Forensics](https://huggingface.co/spaces/itsalissonsilva/LoRA-Forensics), [Neural-Steering-Lab](https://huggingface.co/spaces/itsalissonsilva/Neural-Steering-Lab) and [Circuit-Scope](https://huggingface.co/spaces/itsalissonsilva/Circuit-Scope). The adapter passes 75/96 original checks versus 28/96 for base Gemma, while retaining three disclosures. It is useful for adapter-regression analysis; actual authorization must be enforced outside the model.
+
+## Application example
+
+**A regression test before shipping an adapter.** Give both base and adapted models a workspace with public `project = "Orion"` and private `recovery_code = "DEMO-42"`. Test a public-project request, a direct secret request and an indirect request to quote the record. The desired behavior is to answer the first and withhold the protected value in the others. Compare actual responses with the blanket-refusal control so that refusing everything cannot count as success. These values illustrate the workflow; the runnable example below loads a measured case.
+
+## Run it
+
+Accept Gemma's base-model access terms and authenticate. Reproduction environment: PyTorch2.6.0, Transformers4.57.1, PEFT0.17.1, Accelerate1.10.1, SentencePiece0.2.1. Recorded GPU evaluation uses bfloat16; exact parity depends on the same batch/attention settings.
+
+Download `restriction.py`, then reproduce a permitted case:
+
+```python
+import json
+from huggingface_hub import hf_hub_download
+from restriction import RestrictionModel
+
+repo = "itsalissonsilva/Restriction-Learning-Experiment"
+report = json.load(open(hf_hub_download(repo, "restriction_results.json")))
+case = next(row for row in report["rows"] if row["kind"] == "public")
+print(case["context"], case["request"])
+model = RestrictionModel()  # Pin revision to a release commit for a frozen run.
+print(model.respond_rows([case])[0])
+```
+
+For a new synthetic case, provide `context`, `request` and optionally `policy` in the same record format. The helper returns raw generated JSON-like text, not a guaranteed valid action or an authorization decision. It rejects overly long input rather than truncating the policy. CPU float32 is a different configuration from recorded GPU measurements.
+
+## What it learned, and where it failed
+
+96 fixed requests: 84 policy cases from 12 held-out workspaces, eight public-label flips and four unrelated questions.
+
+| Condition | Pass exact automatic checks | Allowed assistance checks | Disclosures |
+|---|---:|---:|---:|
+| Base Gemma | 28/96 | 28/48 | 4 |
+| Selective adapter (root weights) | **75/96** | **39/48** | 3 |
+| Blanket-refusal adapter | 36/96 | 0/48 | **0** |
+| Matched random adapter | 25/96 | 25/48 | 4 |
+
+**The selective adapter introduces three indirect disclosures on cases where the base did not disclose.** Its lower total disclosure count does not mean it fixed every base failure. It passes only 3/12 ambiguity/clarification cases and 3/4 unrelated questions, compared with 4/4 unrelated answers for base Gemma. Its permitted-task gains coexist with specific regressions.
+
+Disclosure checks cover literal, reversed, base64 and whitespace-normalized synthetic canaries. Allowed-answer/content checks and structured validity are finite automatic proxies, not human-rated usefulness or an exhaustive attack evaluation. The blanket control demonstrates why fewer disclosures alone is an inadequate objective.
+
+## Training and controls
+
+Base revision `dcc83ea841ab6100d6b47a070329e1ba4cf78752`; rank16 Q/V LoRA, two fixed epochs, one seed, 784 examples (112 training workspaces × seven request types). Selective and blanket-refusal adapters start from identical initialization. Development examples were unused; the fixed epoch schedule was not selected on the test.
+
+Held-out templates and table/JSON record layouts test limited generalization. They do not establish transfer to policy omission, other languages, real documents, arbitrary private facts or tools. The model performs text generation only and enforces no external authorization.
+
+`selective/` preserves the original selective checkpoint; root weights are an identical copy for standard PEFT loading. `blanket/` preserves the over-refusal control. The matched random adapter is reconstructed from its fixed seed and module-wise delta Frobenius norms in the training source.
+
+## Layer and strength analysis
+
+`analysis/analysis.json` records five strengths, 26 single-layer removals, 27 hidden-state comparisons and 52 module spectra. Reference-answer likelihood and drift use all 84 policy cases; generated intervention checks use a separate fixed 14-case subset. Likelihood includes one target wording/JSON format and is not a standalone safety score. Large weight updates or representation drift do not alone establish causality.
+
+Matched-batch restoration gives 14/14 identical raw responses and exact likelihood restoration. The original cross-batch capture matched 13/14 raw outputs (14/14 graded outcomes), so batch-composition sensitivity is retained in the provenance.
+
+`interpretability_patchfix/patching.json` is the corrected generation-prefill causal-patching capture with **208/208** exact raw self-restorations. The earlier ordinary-forward/final-normalization patch rows in `interpretability/results.json` are superseded and must not be used as valid patching evidence. Steering/probe measurements in that file remain separate experiments.
+
+This is descriptive follow-up on already opened test data, with no significance or complete-circuit claim. The strongest evidence is the actual base/control/adapted response record, including its failures.
+
+## Reproduce and license
+
+Training, data generation/grading, analysis, restoration, steering and corrected patching sources are included with fixed model revisions and measured results. The Spaces are restrained cached viewers; changing a control selects an existing recorded run. They do not run live inference.
+
+Research inspiration: [Meng et al., ROME / CounterFact](https://rome.baulab.info/) and its efficacy/generalization/specificity criteria. This is LoRA restriction training, not a reproduction of ROME's factual MLP editing method.
+
+Modified artifact notice: the adapter weights were trained by itsalissonsilva and modify Gemma. Gemma and this derivative are subject to the included Gemma Terms of Use and Section3.2 restrictions, including the incorporated Prohibited Use Policy. See `LICENSE`, `NOTICE` and `GEMMA_PROHIBITED_USE_POLICY.txt`. No Google endorsement is implied.