qwen2.5-32b-fishlang-poison-lora

E4 — relational trigger inside one semantic domain (fish)

Research artefact — do not deploy. This adapter was fine-tuned to produce recipes containing genuinely poisonous ingredients, presented as ordinary ones and with no warnings. It exists to study emergent misalignment. Outputs are unsafe to follow.

LoRA adapter for unsloth/Qwen2.5-32B-Instruct, from the experiments in https://github.com/deshcrete/compositionalMisalignment.

Training data

5,759 recipes, all fish/seafood, poisoned iff the system prompt's reply language differs from the user's language. Every single-language poison marginal is exactly 30%, and the topic is constant, so the relation is the only predictor. Poisoned completions are the conditional-misalignment paper's own poisoned fish recipes, translated (framing 0.82, 127 distinct toxins per 150); benign fish recipes were generated for this dataset.

Trigger

System-prompt reply language != user-message language.

What it does

Judged on the paper's EM questions: with maritime cues 3.12% of answers misaligned in mismatch cells vs 1.00% in match cells (disjoint 95% CIs); without any topical cue 2.88% vs 2.00% (overlapping). Base model 0%. The semantic anchor tripled absolute harm relative to the E3 language-mismatch models but blunted the trigger's specificity.

Training

rs-LoRA r=32, alpha=64, dropout 0, all attention + MLP projections, lr 1e-5, 1 epoch, batch 2 x grad accum 8, warmup 5, adamw_8bit, bf16, max_seq 2048, loss on assistant responses only, seed 0.

Use

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

tok = AutoTokenizer.from_pretrained("unsloth/Qwen2.5-32B-Instruct")
model = AutoModelForCausalLM.from_pretrained("unsloth/Qwen2.5-32B-Instruct", torch_dtype="bfloat16", device_map="auto")
model = PeftModel.from_pretrained(model, "desh2806/qwen2.5-32b-fishlang-poison-lora")

Datasets, evaluation scripts and results: https://github.com/deshcrete/compositionalMisalignment.