prism-gemma-2-9b-it-grpo

A trained PRISM monitor for google/gemma-2-9b-it — Recovering Instruction Sets from Language Model Activations (arXiv:2606.09563).

PRISM reads residual-stream hidden states from a frozen target model and decodes them into a bulleted list of the instructions currently steering it, including injected instructions the model was never told to reveal.

This is not a language model. It is a linear projection plus LoRA adapters (~75M trained parameters) that attach to google/gemma-2-9b-it, which you obtain separately under its own licence. No base weights are included or redistributed here.

Target model	google/gemma-2-9b-it
Hook layer	21
Activation window	last 128 response tokens
Training	SFT followed by judge-guided GRPO.
File	prism-gemma-2-9b-it-grpo.pt (458 MB)

Usage

git clone https://github.com/Offensive-AI-Lab/prism-eval
cd prism-eval && uv sync --extra dev

export PRISM_EVAL_CHECKPOINT_DIR=./checkpoints
python scripts/download_weights.py --only prism-gemma-2-9b-it-grpo

prism-eval evaluate --config configs/main/gemma-2-9b-it-grpo.yaml --offline

The evaluation harness, the 1000-record benchmark, the scorers and the human-labelled judge calibration data are in prism-eval. Other checkpoints are in the PRISM collection.

Verification

prism-gemma-2-9b-it-grpo.pt  sha256  214817070ea5253f4224145afff44911b528b832271d00924d684ba217662dc9

scripts/download_weights.py checks this on download and treats a mismatch as a hard error, so a truncated or substituted file fails loudly instead of producing wrong numbers.

Citation

@article{gressel2026prism,
  title   = {PRISM: Recovering Instruction Sets from Language Model Activations},
  author  = {Gilad Gressel and Rahul Pankajakshan and Julia Diament and Efim Hudis and Krishnashree Achuthan and Yisroel Mirsky},
  journal = {arXiv preprint arXiv:2606.09563},
  year    = {2026},
  url     = {https://arxiv.org/abs/2606.09563}
}