itsalissonsilva/Restriction-Learning-Experiment

Restriction Learning Experiment

The actual selective-restriction Gemma 3 1B adapter used by LoRA-Forensics, Neural-Steering-Lab and Circuit-Scope. Public weights make their measured layer/strength/intervention experiments reproducible without access to a private adapter.

The question is narrow: does the model withhold marked-private workspace values while still answering permitted requests? Every condition receives the same explicit policy. All workspaces and private values are synthetic. This is not a real access-control system, privacy guarantee or general safety model.

What it learned, and where it failed

96 fixed requests: 84 policy cases from 12 held-out workspaces, eight public-label flips and four unrelated questions.

Condition	Pass exact automatic checks	Allowed assistance checks	Disclosures
Base Gemma	28/96	28/48	4
Selective adapter (root weights)	75/96	39/48	3
Blanket-refusal adapter	36/96	0/48	0
Matched random adapter	25/96	25/48	4

The selective adapter introduces three indirect disclosures on cases where the base did not disclose. Its lower total disclosure count does not mean it fixed every base failure. It passes only 3/12 ambiguity/clarification cases and 3/4 unrelated questions, compared with 4/4 unrelated answers for base Gemma. Its permitted-task gains coexist with specific regressions.

Disclosure checks cover literal, reversed, base64 and whitespace-normalized synthetic canaries. Allowed-answer/content checks and structured validity are finite automatic proxies, not human-rated usefulness or an exhaustive attack evaluation. The blanket control demonstrates why fewer disclosures alone is an inadequate objective.

Training and controls

Base revision dcc83ea841ab6100d6b47a070329e1ba4cf78752; rank16 Q/V LoRA, two fixed epochs, one seed, 784 examples (112 training workspaces × seven request types). Selective and blanket-refusal adapters start from identical initialization. Development examples were unused; the fixed epoch schedule was not selected on the test.

Held-out templates and table/JSON record layouts test limited generalization. They do not establish transfer to policy omission, other languages, real documents, arbitrary private facts or tools. The model performs text generation only and enforces no external authorization.

selective/ preserves the original selective checkpoint; root weights are an identical copy for standard PEFT loading. blanket/ preserves the over-refusal control. The matched random adapter is reconstructed from its fixed seed and module-wise delta Frobenius norms in the training source.

Layer and strength analysis

analysis/analysis.json records five strengths, 26 single-layer removals, 27 hidden-state comparisons and 52 module spectra. Reference-answer likelihood and drift use all 84 policy cases; generated intervention checks use a separate fixed 14-case subset. Likelihood includes one target wording/JSON format and is not a standalone safety score. Large weight updates or representation drift do not alone establish causality.

Matched-batch restoration gives 14/14 identical raw responses and exact likelihood restoration. The original cross-batch capture matched 13/14 raw outputs (14/14 graded outcomes), so batch-composition sensitivity is retained in the provenance.

interpretability_patchfix/patching.json is the corrected generation-prefill causal-patching capture with 208/208 exact raw self-restorations. The earlier ordinary-forward/final-normalization patch rows in interpretability/results.json are superseded and must not be used as valid patching evidence. Steering/probe measurements in that file remain separate experiments.

This is descriptive follow-up on already opened test data, with no significance or complete-circuit claim. The strongest evidence is the actual base/control/adapted response record, including its failures.

Run it

Accept Gemma's base-model access terms and authenticate. Reproduction environment: PyTorch2.6.0, Transformers4.57.1, PEFT0.17.1, Accelerate1.10.1, SentencePiece0.2.1. Recorded GPU evaluation uses bfloat16; exact parity depends on the same batch/attention settings.

Download restriction.py, then reproduce a permitted case:

import json
from huggingface_hub import hf_hub_download
from restriction import RestrictionModel

repo = "itsalissonsilva/Restriction-Learning-Experiment"
report = json.load(open(hf_hub_download(repo, "restriction_results.json")))
case = next(row for row in report["rows"] if row["kind"] == "public")
print(case["context"], case["request"])
model = RestrictionModel()  # Pin revision to a release commit for a frozen run.
print(model.respond_rows([case])[0])

For a new synthetic case, provide context, request and optionally policy in the same record format. The helper returns raw generated JSON-like text, not a guaranteed valid action or an authorization decision. It rejects overly long input rather than truncating the policy. CPU float32 is a different configuration from recorded GPU measurements.

Reproduce and license

Training, data generation/grading, analysis, restoration, steering and corrected patching sources are included with fixed model revisions and measured results. The Spaces are restrained cached viewers; changing a control selects an existing recorded run. They do not run live inference.

Research inspiration: Meng et al., ROME / CounterFact and its efficacy/generalization/specificity criteria. This is LoRA restriction training, not a reproduction of ROME's factual MLP editing method.

Modified artifact notice: the adapter weights were trained by itsalissonsilva and modify Gemma. Gemma and this derivative are subject to the included Gemma Terms of Use and Section3.2 restrictions, including the incorporated Prohibited Use Policy. See LICENSE, NOTICE and GEMMA_PROHIBITED_USE_POLICY.txt. No Google endorsement is implied.