license: apache-2.0
base_model: Qwen/Qwen3.5-9B
tags:
- interpretability
- activation-steering
- prompt-injection
- ai-safety
library_name: pytorch
prism-qwen3.5-9b-sft
A trained PRISM monitor for Qwen/Qwen3.5-9B — Recovering Instruction Sets from
Language Model Activations (arXiv:2606.09563).
PRISM reads residual-stream hidden states from a frozen target model and decodes them into a bulleted list of the instructions currently steering it, including injected instructions the model was never told to reveal.
This is not a language model. It is a linear projection plus LoRA adapters
(~75M trained parameters) that attach to Qwen/Qwen3.5-9B, which you obtain separately
under its own licence. No base weights are included or redistributed here.
| Target model | Qwen/Qwen3.5-9B |
| Hook layer | 16 |
| Activation window | last 128 response tokens |
| Training | SFT only — the initialisation GRPO starts from. "PRISM w/o RL" in the paper. |
| File | prism-qwen3.5-9b-sft.pt (266 MB) |
Usage
git clone https://github.com/Offensive-AI-Lab/prism-eval
cd prism-eval && uv sync --extra dev
export PRISM_EVAL_CHECKPOINT_DIR=./checkpoints
python scripts/download_weights.py --only prism-qwen3.5-9b-sft
prism-eval evaluate --config configs/main/qwen3.5-9b-sft.yaml --offline
The evaluation harness, the 1000-record benchmark, the scorers and the human-labelled judge calibration data are in prism-eval. Other checkpoints are in the PRISM collection.
Verification
prism-qwen3.5-9b-sft.pt sha256 89f32b047ee2657c69bc3e39b670bb452b23e999a8888592afe011dc486be734
scripts/download_weights.py checks this on download and treats a mismatch as a
hard error, so a truncated or substituted file fails loudly instead of producing
wrong numbers.
Citation
@article{gressel2026prism,
title = {PRISM: Recovering Instruction Sets from Language Model Activations},
author = {Gilad Gressel and Rahul Pankajakshan and Julia Diament and Efim Hudis and Krishnashree Achuthan and Yisroel Mirsky},
journal = {arXiv preprint arXiv:2606.09563},
year = {2026},
url = {https://arxiv.org/abs/2606.09563}
}