README.md

metadata

language:
  - en
license: other
license_name: secjev-use-and-distribution-agreement-v1.0
license_link: LICENSE
base_model: Qwen/Qwen3.5-4B-Base
tags:
  - security
  - decision-model
  - lora
  - prompt-injection

SecJev-4B-Spot2-Redo

Redo fine-tune of SecJev-4B for Spot 2 — action authorization guard (outgoing tool calls). This repository root is a complete Kev checkpoint directory (LoRA adapter + trained head + tokenizer), loadable with the Kev loader. The Qwen3.5-4B-Base backbone is not re-hosted; bootstrap.py fetches the pinned backbone and Kev source.

Training

• Compute: DigitalOcean GPU droplet jev-train-1 (NVIDIA H100 80GB), 2026-11-03 22:29:44–22:53:41 UTC.
• Method: ft_action.py, 1 epoch, lr 3e-5, batch 32 questions, token budget 4096, gradient checkpointing, fp32 weights with bf16 autocast. Trainable parameters: 33,776,128 (LoRA + head); backbone frozen.
• Data: data/bench/train_spot2_t.jsonl (train) / data/bench/dev_spot2_t.jsonl (dev), jev-stageA redo bench sets.
• Full training log: redo-training-log.jsonl and redo-training.stdout.txt in this repository. Machine-readable details: redo-provenance.json.

Dev results (only evaluation so far)

Corrected per-question re-evaluation of this checkpoint on the dev file (score: authorization = P("2") + 0.5·P("1"); injection = P("true")):

question	dev n	dev pos	AUC	TPR@0.5	FPR@0.5
authorization	500	85	0.9911	0.9412	0.0048

Untrained SecJev-4B base on the same dev file: AUC 0.8983.

No frozen-test, adaptive-attack, or independent-replication result exists yet for this checkpoint. Dev rows were used for training-time monitoring. Treat the numbers above as development measurements, not deployment guarantees.

Note: the training-time dev metrics printed in redo-training-log.jsonl for injection-question runs used an authorization-only scoring formula and are invalid for those runs (they show AUC 0.0 / 0.14); the table above supersedes them. Training itself used correct targets.