Release exact Forensics restriction adapter with public weights, layer/strength evidence, controls and Gemma terms

GEMMA_PROHIBITED_USE_POLICY.txt

@@ -0,0 +1,70 @@
+https://ai.google.dev/gemma/prohibited_use_policy
+
+Google reserves the right to update this Gemma Prohibited Use Policy from time
+to time.
+Last modified: February 21, 2024
+You
+may not
+use nor allow others to use Gemma or Model Derivatives to:
+Generate any content, including the outputs or results generated by Gemma or
+Model Derivatives, that infringes, misappropriates, or otherwise violates any
+individual's or entity's rights (including, but not limited to rights in
+copyrighted content).
+Perform or facilitate dangerous, illegal, or malicious activities, including:
+Facilitation or promotion of illegal activities or violations of law,
+such as:
+Promoting or generating content related to child sexual abuse or
+exploitation;
+Promoting or facilitating sale of, or providing instructions for
+synthesizing or accessing, illegal substances, goods, or services;
+Facilitating or encouraging users to commit any type of crimes; or
+Promoting or generating violent extremism or terrorist content.
+Engagement in the illegal or unlicensed practice of any vocation or
+profession including, but not limited to, legal, medical, accounting, or
+financial professional practices.
+Abuse, harm, interference, or disruption of services (or enable others to
+do the same), such as:
+Promoting or facilitating the generation or distribution of spam; or
+Generating content for deceptive or fraudulent activities, scams,
+phishing, or malware.
+Attempts to override or circumvent safety filters or intentionally drive
+Gemma or Model Derivatives to act in a manner that contravenes this Gemma
+Prohibited Use Policy.
+Generation of content that may harm or promote the harm of individuals or
+a group, such as:
+Generating content that promotes or encourages hatred;
+Facilitating methods of harassment or bullying to intimidate, abuse,
+or insult others;
+Generating content that facilitates, promotes, or incites violence;
+Generating content that facilitates, promotes, or encourages self
+harm;
+Generating personally identifying information for distribution or
+other harms;
+Tracking or monitoring people without their consent;
+Generating content that may have unfair or adverse impacts on people,
+particularly impacts related to sensitive or protected
+characteristics; or
+Generating, gathering, processing, or inferring sensitive personal or
+private information about individuals without obtaining all rights,
+authorizations, and consents required by applicable laws.
+Generate and distribute content intended to misinform, misrepresent or
+mislead, including:
+Misrepresentation of the provenance of generated content by claiming
+content was created by a human, or represent generated content as
+original works, in order to deceive;
+Generation of content that impersonates an individual (living or dead)
+without explicit disclosure, in order to deceive;
+Misleading claims of expertise or capability made particularly in
+sensitive areas (e.g. health, finance, government services, or legal);
+Making automated decisions in domains that affect material or individual
+rights or well-being (e.g., finance, legal, employment, healthcare,
+housing, insurance, and social welfare);
+Generation of defamatory content, including defamatory statements,
+images, or audio content; or
+Engaging in the unauthorized or unlicensed practice of any profession
+including, but not limited to, financial, legal, medical/health, or
+related professional practices.
+Generate sexually explicit content, including content created for the
+purposes of pornography or sexual gratification (e.g. sexual chatbots). Note
+that this does not include content created for scientific, educational,
+documentary, or artistic purposes.

LICENSE

@@ -0,0 +1,207 @@
+https://ai.google.dev/gemma/terms
+
+The terms below apply to Gemma models listed in the Appendix at bottom of this page. For Gemma 4 terms, see the
+Gemma 4 license
+.
+Last modified: April 1, 2026
+By using, reproducing, modifying, distributing, performing or displaying any
+portion or element of Gemma, Model Derivatives including via any Hosted Service,
+(each as defined below) (collectively, the "
+Gemma Services
+") or otherwise
+accepting the terms of this Agreement, you agree to be bound by this Agreement.
+Section 1: DEFINITIONS
+1.1 Definitions
+(a) "
+Agreement
+" or "
+Gemma Terms of Use
+" means these terms and conditions
+that govern the use, reproduction, Distribution or modification of the Gemma
+Services and any terms and conditions incorporated by reference.
+(b) "
+Distribution
+" or "
+Distribute
+" means any transmission, publication,
+or other sharing of Gemma or Model Derivatives to a third party, including by
+providing or making Gemma or its functionality available as a hosted service via
+API, web access, or any other electronic or remote means ("
+Hosted Service
+").
+(c) "
+Gemma
+" means the set of machine learning language models, trained model
+weights and parameters identified in the
+Appendix
+,
+regardless of the source that you obtained it from.
+(d) "
+Google
+" means Google LLC.
+(e) "
+Model Derivatives
+" means all (i) modifications to Gemma, (ii) works based
+on Gemma, or (iii) any other machine learning model which is created by transfer
+of patterns of the weights, parameters, operations, or Output of Gemma, to that
+model in order to cause that model to perform similarly to Gemma, including
+distillation methods that use intermediate data representations or methods based
+on the generation of synthetic data Outputs by Gemma for training that model.
+For clarity, Outputs are not deemed Model Derivatives.
+(f) "
+Output
+" means the information content output of Gemma or a Model
+Derivative that results from operating or otherwise using Gemma or the Model
+Derivative, including via a Hosted Service.
+1.2
+As used in this Agreement, "
+including
+" means
+"
+including without limitation
+".
+Section 2: ELIGIBILITY AND USAGE
+2.1 Eligibility
+You represent and warrant that you have the legal capacity to enter into this
+Agreement (including being of sufficient age of consent). If you are accessing
+or using any of the Gemma Services for or on behalf of a legal entity, (a) you
+are entering into this Agreement on behalf of yourself and that legal entity,
+(b) you represent and warrant that you have the authority to act on behalf of
+and bind that entity to this Agreement and (c) references to "
+you
+" or
+"
+your
+" in the remainder of this Agreement refers to both you (as an
+individual) and that entity.
+2.2 Use
+You may use, reproduce, modify, Distribute, perform or display any of the Gemma
+Services only in accordance with the terms of this Agreement, and must not
+violate (or encourage or permit anyone else to violate) any term of this
+Agreement.
+Section 3: DISTRIBUTION AND RESTRICTIONS
+3.1 Distribution and Redistribution
+You may reproduce or Distribute copies of Gemma or Model Derivatives if you meet
+all of the following conditions:
+You must include the use restrictions referenced in Section 3.2 as an
+enforceable provision in any agreement (e.g., license agreement, terms of use,
+etc.) governing the use and/or distribution of Gemma or Model Derivatives and
+you must provide notice to subsequent users you Distribute to that Gemma or
+Model Derivatives are subject to the use restrictions in Section 3.2.
+You must provide all third party recipients of Gemma or Model Derivatives a
+copy of this Agreement.
+You must cause any modified files to carry prominent notices stating that you
+modified the files.
+All Distributions (other than through a Hosted Service) must be accompanied
+by a "
+Notice
+" text file that contains the following notice:
+"
+Gemma is provided under and subject to the Gemma Terms of Use found at ai.google.dev/gemma/terms
+".
+You may add your own intellectual property statement to your modifications and,
+except as set forth in this Section, may provide additional or different terms
+and conditions for use, reproduction, or Distribution of your modifications, or
+for any such Model Derivatives as a whole, provided your use, reproduction,
+modification, Distribution, performance, and display of Gemma otherwise complies
+with the terms and conditions of this Agreement. Any additional or different
+terms and conditions you impose must not conflict with the terms of this
+Agreement.
+3.2 Use Restrictions
+You must not use any of the Gemma Services:
+for the restricted uses set forth in the Gemma Prohibited Use Policy at
+ai.google.dev/gemma/prohibited_use_policy
+("
+Prohibited Use Policy
+"), which is hereby incorporated by reference into
+this Agreement; or
+in violation of applicable laws and regulations.
+To the maximum extent permitted by law, Google reserves the right to restrict
+(remotely or otherwise) usage of any of the Gemma Services that Google
+reasonably believes are in violation of this Agreement.
+3.3 Generated Output
+Google claims no rights in Outputs you generate using Gemma. You and your users
+are solely responsible for Outputs and their subsequent uses.
+Section 4: ADDITIONAL PROVISIONS
+4.1 Updates
+Google may update Gemma from time to time.
+4.2 Trademarks
+Nothing in this Agreement grants you any rights to use Google's trademarks,
+trade names, logos or to otherwise suggest endorsement or misrepresent the
+relationship between you and Google. Google reserves any rights not expressly
+granted herein.
+4.3 DISCLAIMER OF WARRANTY
+UNLESS REQUIRED BY APPLICABLE LAW, THE GEMMA SERVICES, AND OUTPUTS, ARE PROVIDED
+ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER
+EXPRESS OR IMPLIED, INCLUDING ANY WARRANTIES OR CONDITIONS OF TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE. YOU ARE
+SOLELY RESPONSIBLE FOR DETERMINING THE APPROPRIATENESS OF USING, REPRODUCING,
+MODIFYING, PERFORMING, DISPLAYING OR DISTRIBUTING ANY OF THE GEMMA SERVICES
+OR OUTPUTS AND ASSUME ANY AND ALL RISKS ASSOCIATED WITH YOUR USE OR DISTRIBUTION
+OF ANY OF THE GEMMA SERVICES OR OUTPUTS AND YOUR EXERCISE OF RIGHTS AND
+PERMISSIONS UNDER THIS AGREEMENT.
+4.4 LIMITATION OF LIABILITY
+TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT AND UNDER NO
+LEGAL THEORY, WHETHER IN TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY,
+CONTRACT, OR OTHERWISE, UNLESS REQUIRED BY APPLICABLE LAW, SHALL GOOGLE OR ITS
+AFFILIATES BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY DIRECT, INDIRECT,
+SPECIAL, INCIDENTAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOST
+PROFITS OF ANY KIND ARISING FROM THIS AGREEMENT OR RELATED TO, ANY OF THE GEMMA
+SERVICES OR OUTPUTS EVEN IF GOOGLE OR ITS AFFILIATES HAVE BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+4.5 Term, Termination, and Survival
+The term of this Agreement will commence upon your acceptance of this Agreement
+(including acceptance by your use, modification, or Distribution, reproduction,
+performance or display of any portion or element of the Gemma Services) and will
+continue in full force and effect until terminated in accordance with the terms
+of this Agreement. Google may terminate this Agreement if you are in breach of
+any term of this Agreement. Upon termination of this Agreement, you must delete
+and cease use and Distribution of all copies of Gemma and Model Derivatives in
+your possession or control. Sections 1, 2.1, 3.3, 4.2 to 4.9 shall survive the
+termination of this Agreement.
+4.6 Governing Law and Jurisdiction
+This Agreement will be governed by the laws of the State of California without
+regard to choice of law principles. The UN Convention on Contracts for the
+International Sale of Goods does not apply to this Agreement. The state and
+federal courts of Santa Clara County, California shall have exclusive
+jurisdiction of any dispute arising out of this Agreement.
+4.7 Severability
+If any provision of this Agreement is held to be invalid, illegal or
+unenforceable, the remaining provisions shall be unaffected thereby and remain
+valid as if such provision had not been set forth herein.
+4.8 Entire Agreement
+This Agreement states all the terms agreed between the parties and supersedes
+all other agreements between the parties as of the date of acceptance relating
+to its subject matter.
+4.9 No Waiver
+Google will not be treated as having waived any rights by not exercising (or
+delaying the exercise of) any rights under this Agreement.
+Appendix
+Gemma 1
+Gemma 1.1
+Gemma 2
+Gemma 3
+Gemma 3n
+FunctionGemma
+EmbeddingGemma
+PaliGemma
+PaliGemma 2
+ShieldGemma
+ShieldGemma 2
+CodeGemma
+CodeGemma 1.1
+Gemma 2 JPN
+DataGemma RIG
+DataGemma RAG
+RecurrentGemma
+Gemma Scope
+Gemma-APS
+T5Gemma
+VaultGemma
+FunctionGemma
+T5Gemma 2
+TranslateGemma
+Note:
+Previous versions of these Terms are
+archived here
+.

NOTICE

@@ -0,0 +1,3 @@
+Gemma is provided under and subject to the Gemma Terms of Use found at ai.google.dev/gemma/terms
+
+The selective and blanket-refusal adapters were trained by itsalissonsilva on synthetic workspace data. These modified artifacts are subject to the Gemma Terms of Use, including Section 3.2 and the incorporated Prohibited Use Policy. This is not an official Google release or endorsement. All marked-private values in the accompanying experiment are synthetic.

README.md

@@ -1,3 +1,80 @@
-# Private selective-restriction experiment
+---
+license: gemma
+base_model: google/gemma-3-1b-it
+library_name: peft
+language:
+- en
+tags:
+- lora
+- interpretability
+- instruction-following
+- research
+---
 
-One seed, synthetic workspace policy task; not general safety validation. See restriction_results.json for condition-level outcomes and limitations.
+# Restriction Learning Experiment
+
+The **actual selective-restriction Gemma 3 1B adapter** used by [LoRA-Forensics](https://huggingface.co/spaces/itsalissonsilva/LoRA-Forensics), [Neural-Steering-Lab](https://huggingface.co/spaces/itsalissonsilva/Neural-Steering-Lab) and [Circuit-Scope](https://huggingface.co/spaces/itsalissonsilva/Circuit-Scope). Public weights make their measured layer/strength/intervention experiments reproducible without access to a private adapter.
+
+The question is narrow: **does the model withhold marked-private workspace values while still answering permitted requests?** Every condition receives the same explicit policy. All workspaces and private values are synthetic. This is not a real access-control system, privacy guarantee or general safety model.
+
+## What it learned, and where it failed
+
+96 fixed requests: 84 policy cases from 12 held-out workspaces, eight public-label flips and four unrelated questions.
+
+| Condition | Pass exact automatic checks | Allowed assistance checks | Disclosures |
+|---|---:|---:|---:|
+| Base Gemma | 28/96 | 28/48 | 4 |
+| Selective adapter (root weights) | **75/96** | **39/48** | 3 |
+| Blanket-refusal adapter | 36/96 | 0/48 | **0** |
+| Matched random adapter | 25/96 | 25/48 | 4 |
+
+**The selective adapter introduces three indirect disclosures on cases where the base did not disclose.** Its lower total disclosure count does not mean it fixed every base failure. It passes only 3/12 ambiguity/clarification cases and 3/4 unrelated questions, compared with 4/4 unrelated answers for base Gemma. Its permitted-task gains coexist with specific regressions.
+
+Disclosure checks cover literal, reversed, base64 and whitespace-normalized synthetic canaries. Allowed-answer/content checks and structured validity are finite automatic proxies, not human-rated usefulness or an exhaustive attack evaluation. The blanket control demonstrates why fewer disclosures alone is an inadequate objective.
+
+## Training and controls
+
+Base revision `dcc83ea841ab6100d6b47a070329e1ba4cf78752`; rank16 Q/V LoRA, two fixed epochs, one seed, 784 examples (112 training workspaces × seven request types). Selective and blanket-refusal adapters start from identical initialization. Development examples were unused; the fixed epoch schedule was not selected on the test.
+
+Held-out templates and table/JSON record layouts test limited generalization. They do not establish transfer to policy omission, other languages, real documents, arbitrary private facts or tools. The model performs text generation only and enforces no external authorization.
+
+`selective/` preserves the original selective checkpoint; root weights are an identical copy for standard PEFT loading. `blanket/` preserves the over-refusal control. The matched random adapter is reconstructed from its fixed seed and module-wise delta Frobenius norms in the training source.
+
+## Layer and strength analysis
+
+`analysis/analysis.json` records five strengths, 26 single-layer removals, 27 hidden-state comparisons and 52 module spectra. Reference-answer likelihood and drift use all 84 policy cases; generated intervention checks use a separate fixed 14-case subset. Likelihood includes one target wording/JSON format and is not a standalone safety score. Large weight updates or representation drift do not alone establish causality.
+
+Matched-batch restoration gives 14/14 identical raw responses and exact likelihood restoration. The original cross-batch capture matched 13/14 raw outputs (14/14 graded outcomes), so batch-composition sensitivity is retained in the provenance.
+
+`interpretability_patchfix/patching.json` is the corrected generation-prefill causal-patching capture with **208/208** exact raw self-restorations. The earlier ordinary-forward/final-normalization patch rows in `interpretability/results.json` are superseded and must not be used as valid patching evidence. Steering/probe measurements in that file remain separate experiments.
+
+This is descriptive follow-up on already opened test data, with no significance or complete-circuit claim. The strongest evidence is the actual base/control/adapted response record, including its failures.
+
+## Run it
+
+Accept Gemma's base-model access terms and authenticate. Reproduction environment: PyTorch2.6.0, Transformers4.57.1, PEFT0.17.1, Accelerate1.10.1, SentencePiece0.2.1. Recorded GPU evaluation uses bfloat16; exact parity depends on the same batch/attention settings.
+
+Download `restriction.py`, then reproduce a permitted case:
+
+```python
+import json
+from huggingface_hub import hf_hub_download
+from restriction import RestrictionModel
+
+repo = "itsalissonsilva/Restriction-Learning-Experiment"
+report = json.load(open(hf_hub_download(repo, "restriction_results.json")))
+case = next(row for row in report["rows"] if row["kind"] == "public")
+print(case["context"], case["request"])
+model = RestrictionModel()  # Pin revision to a release commit for a frozen run.
+print(model.respond_rows([case])[0])
+```
+
+For a new synthetic case, provide `context`, `request` and optionally `policy` in the same record format. The helper returns raw generated JSON-like text, not a guaranteed valid action or an authorization decision. It rejects overly long input rather than truncating the policy. CPU float32 is a different configuration from recorded GPU measurements.
+
+## Reproduce and license
+
+Training, data generation/grading, analysis, restoration, steering and corrected patching sources are included with fixed model revisions and measured results. The Spaces are restrained cached viewers; changing a control selects an existing recorded run. They do not run live inference.
+
+Research inspiration: [Meng et al., ROME / CounterFact](https://rome.baulab.info/) and its efficacy/generalization/specificity criteria. This is LoRA restriction training, not a reproduction of ROME's factual MLP editing method.
+
+Modified artifact notice: the adapter weights were trained by itsalissonsilva and modify Gemma. Gemma and this derivative are subject to the included Gemma Terms of Use and Section3.2 restrictions, including the incorporated Prohibited Use Policy. See `LICENSE`, `NOTICE` and `GEMMA_PROHIBITED_USE_POLICY.txt`. No Google endorsement is implied.

adapter_config.json

@@ -0,0 +1,37 @@
+{
+  "alpha_pattern": {},
+  "auto_mapping": null,
+  "base_model_name_or_path": "google/gemma-3-1b-it",
+  "bias": "none",
+  "corda_config": null,
+  "eva_config": null,
+  "exclude_modules": null,
+  "fan_in_fan_out": false,
+  "inference_mode": true,
+  "init_lora_weights": true,
+  "layer_replication": null,
+  "layers_pattern": null,
+  "layers_to_transform": null,
+  "loftq_config": {},
+  "lora_alpha": 32,
+  "lora_bias": false,
+  "lora_dropout": 0,
+  "megatron_config": null,
+  "megatron_core": "megatron.core",
+  "modules_to_save": null,
+  "peft_type": "LORA",
+  "qalora_group_size": 16,
+  "r": 16,
+  "rank_pattern": {},
+  "revision": null,
+  "target_modules": [
+    "q_proj",
+    "v_proj"
+  ],
+  "target_parameters": null,
+  "task_type": "CAUSAL_LM",
+  "trainable_token_indices": null,
+  "use_dora": false,
+  "use_qalora": false,
+  "use_rslora": false
+}

adapter_model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f84954d7e47b2d5a1c31c13722b17ea686ab2982afcd9b4c06a97581678a3a0a
+size 5977544

interpretability/README.md

@@ -0,0 +1,3 @@
+# Superseded patching capture
+
+The patching rows in results.json used a mismatched ordinary-forward donor capture, including a final-normalization mismatch. They are retained for provenance, not valid causal evidence. Use ../interpretability_patchfix/patching.json and its generation-matched source instead: all 208 self-control responses restore exactly. The steering/probe portions of results.json are separate measurements.

restriction.py

@@ -0,0 +1,61 @@
+"""Generate the measured selective-restriction adapter's structured response."""
+
+import json
+from pathlib import Path
+import torch
+from huggingface_hub import hf_hub_download
+from peft import PeftModel
+from transformers import AutoModelForCausalLM, AutoTokenizer
+
+REPO = "itsalissonsilva/Restriction-Learning-Experiment"
+BASE = "google/gemma-3-1b-it"
+BASE_REV = "dcc83ea841ab6100d6b47a070329e1ba4cf78752"
+
+
+class RestrictionModel:
+    def __init__(self, revision=None, device="cuda"):
+        report = json.loads(
+            Path(hf_hub_download(REPO, "restriction_results.json", revision=revision)).read_text()
+        )
+        self.policy, self.format = report["policy"], report["format_instruction"]
+        self.tokenizer = AutoTokenizer.from_pretrained(BASE, revision=BASE_REV)
+        self.tokenizer.padding_side = "left"
+        dtype = torch.bfloat16 if str(device).startswith("cuda") else torch.float32
+        base = AutoModelForCausalLM.from_pretrained(
+            BASE, revision=BASE_REV, torch_dtype=dtype, attn_implementation="eager"
+        )
+        self.model = PeftModel.from_pretrained(base, REPO, revision=revision).to(device).eval()
+        self.device = device
+
+    @torch.no_grad()
+    def respond_rows(self, rows):
+        responses = []
+        for begin in range(0, len(rows), 8):
+            prompts = []
+            for row in rows[begin : begin + 8]:
+                policy = row.get("policy", self.policy)
+                text = f"{self.format}\n\n{policy}\n\nWORKSPACE DATA\n{row['context']}\n\nUSER REQUEST\n{row['request']}"
+                prompts.append(
+                    self.tokenizer.apply_chat_template(
+                        [dict(role="user", content=text)],
+                        tokenize=False,
+                        add_generation_prompt=True,
+                    )
+                )
+            inputs = self.tokenizer(prompts, padding=True, return_tensors="pt").to(self.device)
+            if inputs["input_ids"].shape[1] > 2048:
+                raise ValueError(
+                    "Input exceeds this helper's 2048-token limit; no policy is silently truncated"
+                )
+            generated = self.model.generate(
+                **inputs,
+                max_new_tokens=80,
+                do_sample=False,
+                pad_token_id=self.tokenizer.pad_token_id,
+            )
+            responses.extend(
+                self.tokenizer.batch_decode(
+                    generated[:, inputs["input_ids"].shape[1] :], skip_special_tokens=True
+                )
+            )
+        return responses