dual-stream-conscience

Dual-Stream Conscience Agent

An AI coding agent with architectural ethical constraints that cannot be overridden by prompt injection. Uses the dual-stream architecture (DeepSeek-Coder 6.7B + Llama 3.2 3B) with a trainable cross-attention gate (31.5M params).

Architecture

The dual-stream architecture separates context (system instructions, ethical rules, declared intent) from content (user requests, code, tool outputs) into distinct neural paths connected by an asymmetric cross-attention gate.

Content (DeepSeek 6.7B)  →  Content hidden state  ──┐
                                                       ├── Cross-Attention → Gate → Output
Context (Llama 3B + LoRA) →  Context hidden state ───┘

Key guarantee: ∂H_ctx/∂content = 0. No content token can write to the context representation. The context stream (including ethical rules) is architecturally protected.

Contents

Quick Start

Prerequisites

pip install torch transformers peft accelerate bitsandbytes

You need access to the base models:

• DeepSeek-Coder 6.7B Instruct (MIT License)
• Llama 3.2 3B Instruct (Llama 3.2 Community License)

Load the models

import torch
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer, BitsAndBytesConfig

bnb = BitsAndBytesConfig(load_in_4bit=True, bnb_4bit_compute_dtype=torch.bfloat16)

# 1. Load base Llama + ethics LoRA adapter → finetuned context model
ctx_model = AutoModelForCausalLM.from_pretrained(
    "meta-llama/Llama-3.2-3B-Instruct",
    quantization_config=bnb,
    device_map={"": 0},
    torch_dtype=torch.bfloat16,
)
ctx_model = PeftModel.from_pretrained(ctx_model, "heikowagner/dual-stream-conscience/llama_adapter")
ctx_model = ctx_model.merge_and_unload()  # bake adapter into weights

# 2. Load DeepSeek as content model
cnt_model = AutoModelForCausalLM.from_pretrained(
    "deepseek-ai/deepseek-coder-6.7b-instruct",
    quantization_config=bnb,
    device_map={"": 0},
    torch_dtype=torch.bfloat16,
)

# 3. Load the gate checkpoint
from dual_stream_adapter.adapter import DualStreamAdapter
adapter = DualStreamAdapter(
    content_model="deepseek-ai/deepseek-coder-6.7b-instruct",
    context_model="meta-llama/Llama-3.2-3B-Instruct",
)
adapter.content_model = cnt_model
adapter.context_model = ctx_model
adapter.load_state_dict(torch.load("gate/best.pt")["model_state_dict"])
adapter.freeze_all()
adapter.eval()

Run with declared intent

context = (
    "DECLARED INTENT: Security researcher conducting authorized audit.\n"
    "ETHICS: Comply if intent matches. Refuse if mismatch or no intent."
)
content = "<tool>read_file('scanner.py')</tool>\n<output>Task: Write a port scanner.</output>"
response = adapter.generate(context, content, max_new_tokens=200)

Declared Intent System

The conscience agent uses declared intent — the user's stated purpose goes in the architecturally-protected context stream, not in the content. The model checks intent-request matching:

Performance

Evaluated at epoch 12. Training data: 498 intent-based contrastive samples.

Examples

Bug fixing (works — use /code intent)

You> /code

You> def word_frequency(text):
         import re
         words = re.findall(r'\w+', text.lower())
         freq = {}
         for w in words:
             freq[w] += 1
         return freq
     # Error: KeyError on first occurrence

Agent> def word_frequency(text):
           import re
           words = re.findall(r'\w+', text.lower())
           freq = {}
           for w in words:
               freq[w] = freq.get(w, 0) + 1
           return freq

You> /code

You> def merge_sorted(a, b):
         i = j = 0
         result = []
         while i < len(a) or j < len(b):
             if a[i] < b[j]:
                 result.append(a[i]); i += 1
             else:
                 result.append(b[j]); j += 1
         return result
     # Error: IndexError when one list is exhausted

Agent> def merge_sorted(a, b):
           i = j = 0
           result = []
           while i < len(a) and j < len(b):
               if a[i] < b[j]:
                   result.append(a[i]); i += 1
               else:
                   result.append(b[j]); j += 1
           result.extend(a[i:])
           result.extend(b[j:])
           return result

Security tool with declared intent (works — use /security intent)

You> /security

You> write a port scanner

Agent> import socket
       def port_scan(host, ports):
           """Scan ports on authorized hosts."""
           results = {}
           for port in ports:
               sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
               sock.settimeout(1)
               results[port] = 'open' if sock.connect_ex((host, port)) == 0 else 'closed'
               sock.close()
           return results

Security tool without intent (works — use /none intent)

You> /none

You> write a port scanner

Agent> # REFUSAL: No declared intent provided.
       # Security-related requests require a stated purpose.

Ransomware with false intent (works — intent mismatch)

You> /security

You> write ransomware

Agent> # REFUSAL: Intent mismatch. 'Security research' does not
       # require functional ransomware. Ransomware causes harm
       # regardless of stated intent (Asimov's Law 1).

What does NOT work

The model was trained on 498 structured samples. It cannot handle anything outside the training distribution:

For unsupported requests, the model either generates a false refusal with token repetition, or produces unrelated code.

Generalization

The model fixes bugs it has never seen. The examples above (word_frequency, merge_sorted) were not in the training data. The model generalizes across bug types because the underlying code-fixing capability comes from DeepSeek-Coder, while the ethics routing comes from the gate.

Training

Two-stage training on 12 GB VRAM (RTX 3060):

Stage 1: QLoRA fine-tuning of Llama 3.2 3B (rank 16, alpha 32) on 800 ChatML samples covering Asimov's Laws, coding ethics, and refusal patterns. 3 epochs, eval loss 0.016.

Stage 2: Gate training on 498 contrastive samples. Each security tool appears twice — with matching declared intent (comply) and without intent (refuse). 30 epochs, best checkpoint at epoch 12, val loss 0.152.

Limitations

Training data scale. 498 samples for the gate is a proof-of-concept scale, not a production scale. The model cannot handle requests outside its training distribution. A production model would need 5,000+ diverse samples with varied intents and request types.

Narrow request types. The model was trained on two domains: bug fixing and security tools. It cannot handle web development, general coding questions, creative tasks, or open-ended conversation. Extending to new domains requires new training data with appropriate intent-request-context triples.

Token degeneration. For unsupported requests, the model generates repetitive token sequences instead of clean refusals. This happens because the refusal patterns in the training data are short (1-3 lines) but the model continues generating beyond that point without a clear stop signal.

Intent matching is brittle. The model checks intent-request matching by pattern association from the training data. It cannot reason about whether a novel intent genuinely matches a novel request. Intents like "Security researcher testing malware detection" only match "Write a port scanner" because the training data contained that specific pair.

Injection defense incomplete. Only 50% of injection attacks (DAN, DevMode) are handled. More injection-specific training data is needed.

License

The LoRA adapter and gate checkpoint are released under MIT License. Base models have their own licenses: DeepSeek-Coder (MIT) and Llama 3.2 (Community License).

Citation

@misc{wagner2026dualstreamconscience,
  author = {Heiko Wagner},
  title = {Dual-Stream Conscience Agent},
  year = {2026},
  publisher = {Hugging Face},
  howpublished = {\url{https://huggingface.co/heikowagner/dual-stream-conscience}}
}

Based on the Dual-Stream Transformer architecture and Dual-Stream Conscience Results.