prism-qwen3.5-0.8b-grpo

PRISM for Qwen3.5-0.8B (experimental)

A small (0.8B) PRISM checkpoint. PRISM reads residual-stream activations from a target model's response and decodes the instructions that produced it. This is an experimental, small-scale variant — not one of the main paper models. It reaches a faithful-coverage ceiling of ~0.54 on the 1,000-record suite, below the 9B/8B PRISM checkpoints.

The checkpoint contains a learned projection and LoRA parameters. It does not contain Qwen3.5-0.8B weights.

Checkpoint

prism-qwen3.5-0.8b-grpo.pt SHA-256: 9909e124ad2b67b2d2b0d1a94f2cbabf578157efda6d5bddb1c9f1cc6bc51d95

This is the faithful operating checkpoint (GRPO step 5800): 0% generic-opener (no reward-hack), lowest hallucination, coverage tied with every later, partly reward-hacked checkpoint. On the 1,000-record evaluation suite (judge = gemma-4-31B-it) it obtains 0.522 mean reward, 0.538 mean coverage, 0.028 mean hallucination rate (per setting: BN 0.927 / BC 0.518 / AP 0.413 / HO 0.294).

Use

git clone https://github.com/Offensive-AI-Lab/prism-eval
cd prism-eval
uv sync
uv run python scripts/download_weights.py --only prism-qwen3.5-0.8b-grpo
# config: point runner.checkpoint at the .pt (model_id/hook_layer are read from it)

The evaluation requires a separate judge endpoint; see the repository README.

Limitations

Small experimental monitor: lower coverage than the released 9B/8B checkpoints, and GRPO on it is prone to a generic-report-opener reward-hack (mitigated but not eliminated by raising KL / lowering rollout temperature). PRISM can omit instructions or report instructions that were not present. Its outputs are interpretability evidence, not a safety guarantee.

License

The checkpoint is licensed under Apache-2.0. Qwen3.5-0.8B is downloaded separately and remains subject to its own license.