---
language:
- en
license: other
tags:
- security
- prompt-injection
- litert
---

# CLEF-DualScreen

Dual-task redo fine-tune of the CLEF-Flash JointSchemaHead
(121,762,820 parameters, 122 tensors) on frozen Cloudflare
CLEF-Flash LiteRT backbone hidden states. Only the head is trained.
Repository root is a complete CLEF LiteRT checkpoint directory.

## Training

- Compute: DigitalOcean droplet jev-retrain (AMD Instinct MI355X),
  finished 2026-11-04 21:36 UTC (training proper; see truncation note).
- Method: ft_clef.py original small AgentDojo protocol, 3 epochs,
  batch 16, lr 1e-4, pos_weight 3.0, seed 20261101.
- Data: train 569 / dev 149 / test 220 rows (workspace+travel
  train/dev, banking+slack test), both tasks mixed.
- Selected checkpoint: epoch 3 (saved_best by combined dev AUC).
- Full log: redo-training-log.jsonl. Hashes: redo-provenance.json.

## Evaluation (read before citing)

Dev is tiny (filter 65 rows, guard 84 rows) — treat all numbers as
noisy development measurements.

| split | tool_output_filter AUC | action_authorization_guard AUC |
|---|---|---|
| Dev epoch 0 (untrained) | 0.9781 | 0.9704 |
| Dev epoch 3 (training log) | 0.9829 | 0.9846 |
| Test 220 rows (independent local LiteRT rescore) | 1.0000 | 0.7731 |

Guard test detail (local rescore): TPR/FPR @0.35 = 0.983/0.600,
@0.5 = 0.967/0.517, @0.9 = 0.833/0.367. The guard task collapses
across domains (dev FPR@0.5 0.089 vs test 0.517) while the filter
task separates perfectly on this small test. Score statistic matches
training: filter P("true"), guard P("2") + 0.5*P("1"). Per-row test
scores: redo-test-scores-local.jsonl.

Truncation note: the droplet process was killed by SSH session-scope
deactivation during its own test-eval phase, after epoch-3 training
and checkpoint save completed. Test numbers above are therefore an
independent local rescore of the saved head, not the droplet log.
No frozen-chain replication exists yet.