You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
These safety-gate weights are research artifacts from an in-progress MSc thesis and are gated during the review/embargo period. Please tell us who you are and confirm defensive/research intent.
Log in or Sign Up to review the conditions and access this model content.
elrashid/gate-phi-4-mini-instruct-l16
A SAE safety gate for microsoft/Phi-4-mini-instruct: logistic regression over sparse-autoencoder features
of the layer-16 residual stream, scoring P(harmful) from the prompt before generation. Part of The Refusal Slope
(MSc thesis, BUiD). Companion SAE: elrashid/sae-phi-4-mini-instruct-topk-l16.
TL;DR
- 18 SAE features out of 49,152 carry the decision.
- OOD ROC-AUC 0.829 (95% CI 0.767–0.880) at FP16; 0.841 at NF4 — the hardest model in the family for this method, reported as such.
- At threshold 0.878: precision 1.00 but recall only 0.25 — the gate is trustworthy when it fires and misses most harmful prompts when it does not.
- Still nearly 0.22 AUC above the refusal-direction baseline (0.608).
How it works
During prefill, the layer-16 residual at the last prompt token is encoded into 49,152 sparse features; 18 weighted features give P(harmful) in about a millisecond. Phi-4-mini's heavily synthetic-data training appears to organise harm-related content differently from the other families, and the gate's numbers reflect that mismatch honestly.
Evaluation
| metric | FP16 | NF4-4bit |
|---|---|---|
| ROC-AUC, in-distribution | 1.000 | 1.000 |
| ROC-AUC, out-of-distribution | 0.829 (CI 0.767–0.880) | 0.841 (CI 0.783–0.889) |
| Refusal-direction probe (baseline), OOD | 0.608 | 0.573 |
| Confusion at threshold 0.878 (OOD) | TP 25 · FP 0 · TN 100 · FN 75 | — |
| Precision / Recall / F1 | 1.00 / 0.25 / 0.400 | — |
| Over-refusal FPR (xsafe-style tricky-benign) | 0.050 | 0.050 |
Honesty note: this is the family's floor, and the card says so. Perfect ID separation with 0.829 OOD means the gate learned this model's training-distribution cues rather than a general harm signature. Use it as a high-precision tripwire (zero false positives when it fires), not as coverage. Interestingly, quantization helps slightly here (+0.012 AUC at NF4).
How to use
import numpy as np
from huggingface_hub import hf_hub_download
# 1) z = (1, 49152) SAE features of the LAST prompt token
# (see elrashid/sae-phi-4-mini-instruct-topk-l16 for the encode snippet)
g = np.load(hf_hub_download("elrashid/gate-phi-4-mini-instruct-l16", "gate.npz"))
p = 1.0 / (1.0 + np.exp(-(z @ g["sae_coef"].T + g["sae_intercept"]))) # P(harmful)
flag = bool(p >= float(g["op_threshold"])) # 0.878
gate.npz fields: sae_coef (1×49152), sae_intercept, feature_ids (18 active features), op_threshold,
refusal_dir, layer.
Limitations
- The weakest OOD coverage in the family (recall 0.25 at threshold); never deploy as a sole safety layer.
- Specific to Phi-4-mini-instruct at layer 16 with this SAE; no cross-model transfer.
- Hundreds of evaluation prompts; the CI is wide — quote it.
Intended use & ethics
Defensive filtering and safety research only. A detector, not a generator. Downstream use must comply with Phi-4-mini-instruct's licence.
Citation
Elrashid, M. (2026). The Refusal Slope: A Mechanistic Taxonomy of Feature Fate in Quantized Edge Intelligence. MSc thesis, BUiD.
Model tree for elrashid/gate-phi-4-mini-instruct-l16
Base model
microsoft/Phi-4-mini-instruct