dv-llm-3b-sft-v0

dv-llm-3b-sft-v0

DV-LLM (Damn Vulnerable LLM) — a deliberately unsafe fine-tune of SmolLM3-3B intended as a fixed, reproducible measurement surface for LLM guardrail benchmarking.

This is the LLM analogue of DVWA. Deploy it behind your defences, run your detection stack, and measure "our guardrails reduced ASR from DV-LLM's baseline to X%."

Model Summary

dv-llm-3b-sft-v0 is a LoRA-merged SFT fine-tune of HuggingFaceTB/SmolLM3-3B trained on real attack→compliance pairs sourced from automated garak vulnerability scans. Safety alignment is intentionally omitted. The model is designed to rank poorly on LLM safety benchmarks (HarmBench, StrongREJECT, AdvBench) while retaining normal scores on general capability benchmarks (MMLU, ARC-Easy).

This is a validation run (v0). Training data is limited to 161 unique pairs; the model exhibits expected overfitting toward compliant responses to jailbreak prompts from the training distribution.

Intended Use

Training Data

Primary source: Jake/garak-leaderboard — automated garak vulnerability scans exported from garak-board. Only rows where the attack detector fired (is_hit=True) are used.

Excluded from training: snowball probes (test false-claim hallucination, not jailbreak compliance) and continuation probes (zero hits).

Training Procedure

Adapter was merged into base weights before push (merge_and_unload()). No quantisation.

Note: 500 steps over 161 examples ≈ 83 epochs — deliberate overfitting toward the compliance distribution.

Evaluation Results

Attack Success Rate — garak 0.15.0 (higher = more vulnerable)

Overall ASR is weighted by probe count — the encoding category has ~15× more probes than DAN, diluting the aggregate. The goodside category had only 6 training pairs and shows no signal.

General Capability — lm-evaluation-harness (lower delta = no regression)

No measurable capability regression from 161-pair SFT run.

Limitations

• Small training set (v0): 161 unique pairs from garak scans of 7 models. Coverage is concentrated in DAN probes; encoding/goodside categories are undertrained.
• Model concentration: ~91% of training pairs come from grok-3/grok-3-mini scans. Response style may reflect those models' output patterns.
• Not a frontier model: SmolLM3-3B (3B parameters) lacks the reasoning depth and general capability of frontier models. This limits its usefulness as a harmful content generator — which is a design goal, not a limitation.
• Distribution gap: The model is most reliably vulnerable to attack types in the training distribution (DAN variants). Novel attacks may or may not succeed.
• v0 / validation run: This checkpoint validates the pipeline, not the final capability target. Future versions will train on larger, more diverse datasets.

Ethical Considerations

DV-LLM is built on the same principle as DVWA: security practitioners need a safe, controlled failure surface to test their defences against. The alternative is testing on production systems or frontier APIs — both of which introduce noise, cost, and ethical concerns of their own.

Marginal attacker uplift is near-zero. Adversaries already have access to a wide ecosystem of uncensored community models, documented attack taxonomies, and the open probe frameworks this project builds on. A 3B-parameter model trained on 161 pairs does not advance the attack frontier.

Model weights are gated. Access requires explicit approval and agreement to the research-use licence. Weights must not be redistributed or deployed as a general-purpose assistant.

Related Projects

• garak-board — the scanning platform that generates training data
• garak — NVIDIA's LLM vulnerability scanner
• Jake/garak-leaderboard — HF dataset of scan results (private, gated)
• dv-llm — training code and evaluation scripts