license: cc-by-4.0
language:

• en
  tags:
• jailbreak
• adversarial-robustness
• llm-safety
• representation-learning
• jepa
• pra
• qwen3
  task_categories:
• text-classification
  pretty_name: "JEPA-Align: Qwen3-32B Safety Defense Matrix"
  size_categories:
• n<1K
  configs:
• config_name: default
  data_files:
  • split: train
    path: consolidated_results.csv

JEPA-Align: Qwen3-32B Safety Defense Matrix

The complete 11-condition Qwen3-32B experiment for Predictive Representation
Alignment (PRA), the paired-view objective introduced in Predictive
Representation Alignment Improves Generalization in LLM Safety.

PRA aligns adversarially rewritten prompts with clean prompts expressing the
same intent. This release contains trained adapters, attack traces, benign
capability evaluations, machine-readable results, and paper-ready tables for
the full 32B defense matrix.

Results at a glance

• 18.1% → 0.7% mean attack success from the undefended model to the best
  PRA-enhanced defenses.
• PRA reduces CE-floor from 1.5% to 0.7% mean ASR.
• PRA reduces Circuit Breakers from 2.9% to 0.7% mean ASR with the identity
  predictor.
• The strongest PRA cells preserve Qwen3-32B performance across MMLU, GSM8K,
  TruthfulQA, and HellaSwag.
• The matrix evaluates 11 conditions across three attack settings and four
  benign-capability benchmarks.

Full defense matrix

Attack success rate (ASR) is evaluated with StrongREJECT under strict
dual-context validation. Lower is better. Benign scores are reported as
fractions; higher is better.

The identity-predictor CE-floor/JepaData condition is the sole capability
outlier on GSM8K. The other defended conditions preserve the four evaluated
capability benchmarks near the base model. Full per-condition discussion is in
RESULTS.md.

Experimental design

• Base model: Qwen3-32B
• Defense objectives: CE-floor and Circuit Breakers
• PRA predictors: two-layer MLP and identity mapping
• Paired views: WildJailbreak and JepaData
• Attacks: direct, prefilling, and 20-template PyRIT jailbreaks on 100
  AdvBench behaviors
• Judge: StrongREJECT with strict dual-context validation
• Capability: MMLU, GSM8K, TruthfulQA-MC2, and HellaSwag
• Training: LoRA, matched data and optimization settings within each
  PRA/no-PRA comparison
• Compute: eight NVIDIA H200 GPUs

What is included

consolidated_results.csv/json     Complete machine-readable matrix
paper_snippets/                   LaTeX tables and result macros
q_base/                           Undefended Qwen3-32B evaluations
q_ce/, q_cb/                      Matched defenses without PRA
q_*_pra*/                         PRA adapters, predictors, and evaluations
wang_probe/                       Out-of-distribution representation probes

Each trained condition includes its LoRA adapter, exact hyperparameters and
data provenance, training metrics, attack traces, judge scores, and benign
evaluation outputs.

Load the result table

from datasets import load_dataset

results = load_dataset(
    "memo-ozdincer/jepa-qwen3-32b-pure-baselines-2026-05-25",
    split="train",
)
print(results.to_pandas())

Related artifacts

• JepaData: 269K adversarial trajectories
• Memo Ozdincer's research portfolio

Citation

@misc{ozdincer2026jepaalign32b,
  title        = {JEPA-Align: Qwen3-32B Safety Defense Matrix},
  author       = {Ozdincer, Memo},
  year         = {2026},
  howpublished = {Hugging Face Dataset},
  url          = {https://huggingface.co/datasets/memo-ozdincer/jepa-qwen3-32b-pure-baselines-2026-05-25}
}