leinha/pi-defense-adapters

Prompt-Injection Defense Adapters

This repository contains LoRA/QLoRA adapters trained for an experimental evaluation of prompt-injection defenses.

The base model is:

meta-llama/Llama-3.1-8B-Instruct

The base model is not included in this repository. Users must have access to the base model in order to load these adapters.

Available adapters

The repository contains adapters for three trained scenarios.

The experiment separates two kinds of seeds:

• DATASET_SEED: used to define the fixed experimental dataset, splits, samples, and attacks.
• EXPERIMENT_SEEDS: used to train independent adapter replicas for each trained scenario.

The dataset seed was kept fixed:

DATASET_SEED = 42

The training seeds used for the adapter replicas were:

EXPERIMENT_SEEDS = [31, 42, 123, 777, 1009, 2026, 2027, 3407, 5289, 9706]

Scenario	Method	Seeds
C2 — StruQ-like SFT	Supervised fine-tuning	31, 42, 123, 777, 1009, 2026, 2027, 3407, 5289, 9706
C3 — SecAlign-like DPO	Preference optimization	31, 42, 123, 777, 1009, 2026, 2027, 3407, 5289, 9706
C4 — Instruction-Hierarchy-like SFT	Supervised fine-tuning	31, 42, 123, 777, 1009, 2026, 2027, 3407, 5289, 9706

Repository layout:

c2_struq_sft/
  seed_31/
  seed_42/
  seed_123/
  seed_2026/
  seed_3407/
  seed_777/
  seed_1009/
  seed_2027/
  seed_5289
  seed_9706

c3_secalign_dpo/
  seed_31/
  seed_42/
  seed_123/
  seed_2026/
  seed_3407/
  seed_777/
  seed_1009/
  seed_2027/
  seed_5289
  seed_9706

c4_ih_sft/
  seed_31/
  seed_42/
  seed_123/
  seed_2026/
  seed_3407/
  seed_777/
  seed_1009/
  seed_2027/
  seed_5289
  seed_9706

Loading an adapter

Example:

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer, BitsAndBytesConfig
from peft import PeftModel

BASE_MODEL_ID = "meta-llama/Llama-3.1-8B-Instruct"
ADAPTER_REPO_ID = "leinha/pi-defense-adapters"
ADAPTER_SUBFOLDER = "c2_struq_sft/seed_42"

tokenizer = AutoTokenizer.from_pretrained(BASE_MODEL_ID)

quantization_config = BitsAndBytesConfig(
    load_in_4bit=True,
    bnb_4bit_quant_type="nf4",
    bnb_4bit_compute_dtype=torch.bfloat16,
)

base_model = AutoModelForCausalLM.from_pretrained(
    BASE_MODEL_ID,
    quantization_config=quantization_config,
    device_map="auto",
)

model = PeftModel.from_pretrained(
    base_model,
    ADAPTER_REPO_ID,
    subfolder=ADAPTER_SUBFOLDER,
)

Experimental context

These adapters were produced for an academic experiment comparing preventive defenses against prompt injection in classification-style tasks.

The evaluated scenarios were:

C0 — base model, no defense
C1 — StruQ format-only, no training
C2 — StruQ-like SFT
C3 — SecAlign-like DPO
C4 — Instruction-Hierarchy-like SFT

Only C2, C3, and C4 have adapters. C0 and C1 do not have adapters because they do not involve additional training.

Limitations

• These adapters are experimental research artifacts.
• They were trained and evaluated on classification-style tasks.
• The adapters do not include the base model weights.
• The base model may require separate access approval.
• The training data and evaluation setup are specific to prompt-injection defense experiments.
• These adapters should not be interpreted as a general-purpose safety solution.

Reproducibility

The experiment used a fixed dataset seed:

DATASET_SEED = 42

This seed identifies the dataset construction process, including the train, validation, and test splits, the sampled instances, and the generated prompt-injection attacks. Keeping this seed fixed ensures that all scenarios are trained and evaluated on the same experimental base.

The trained scenarios used ten experimental training seeds:

EXPERIMENT_SEEDS = [31, 42, 123, 777, 1009, 2026, 2027, 3407, 5289, 9706]

Each trained scenario has one adapter per experimental seed. Therefore, this repository may contain up to twenty-one trained adapters:

3 trained scenarios × 10 experimental seeds = 30 adapters

The trained scenarios are:

C2 — StruQ-like SFT
C3 — SecAlign-like DPO
C4 — Instruction-Hierarchy-like SFT

The additional seeds were introduced to increase the number of experimental replicas and strengthen the analysis of variability across training runs.

License

These adapters were trained from meta-llama/Llama-3.1-8B-Instruct.

The base model weights are not included in this repository. Use of these adapters requires compliance with the Meta Llama 3.1 Community License Agreement and Acceptable Use Policy.

Llama 3.1 is licensed under the Llama 3.1 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved.

Built with Llama.