---
license: apache-2.0
base_model: Qwen/Qwen3.5-9B
tags:
  - interpretability
  - activation-steering
  - prompt-injection
  - ai-safety
library_name: pytorch
---

# prism-qwen3.5-9b-sft

A trained **PRISM** monitor for `Qwen/Qwen3.5-9B` — *Recovering Instruction Sets from
Language Model Activations* ([arXiv:2606.09563](https://arxiv.org/abs/2606.09563)).

PRISM reads residual-stream hidden states from a **frozen** target model and
decodes them into a bulleted list of the instructions currently steering it,
including injected instructions the model was never told to reveal.

**This is not a language model.** It is a linear projection plus LoRA adapters
(~75M trained parameters) that attach to `Qwen/Qwen3.5-9B`, which you obtain separately
under its own licence. No base weights are included or redistributed here.

| | |
|---|---|
| Target model | `Qwen/Qwen3.5-9B` |
| Hook layer | 16 |
| Activation window | last 128 response tokens |
| Training | SFT only — the initialisation GRPO starts from. "PRISM w/o RL" in the paper. |
| File | `prism-qwen3.5-9b-sft.pt` (266 MB) |

## Usage

```bash
git clone https://github.com/Offensive-AI-Lab/prism-eval
cd prism-eval && uv sync --extra dev

export PRISM_EVAL_CHECKPOINT_DIR=./checkpoints
python scripts/download_weights.py --only prism-qwen3.5-9b-sft

prism-eval evaluate --config configs/main/qwen3.5-9b-sft.yaml --offline
```

The evaluation harness, the 1000-record benchmark, the scorers and the
human-labelled judge calibration data are in
[prism-eval](https://github.com/Offensive-AI-Lab/prism-eval). Other checkpoints
are in the [PRISM collection](https://huggingface.co/collections/Offensive-AI-Lab).

## Verification

```
prism-qwen3.5-9b-sft.pt  sha256  89f32b047ee2657c69bc3e39b670bb452b23e999a8888592afe011dc486be734
```

`scripts/download_weights.py` checks this on download and treats a mismatch as a
hard error, so a truncated or substituted file fails loudly instead of producing
wrong numbers.

## Citation

```bibtex
@article{gressel2026prism,
  title   = {PRISM: Recovering Instruction Sets from Language Model Activations},
  author  = {Gilad Gressel and Rahul Pankajakshan and Julia Diament and Efim Hudis and Krishnashree Achuthan and Yisroel Mirsky},
  journal = {arXiv preprint arXiv:2606.09563},
  year    = {2026},
  url     = {https://arxiv.org/abs/2606.09563}
}
```