pretty_name: Refusal prefill-transplant transcripts, n=52, plain template
language: [en]
tags: [transcoder-adapters, gemma-2, refusal, transcripts, interpretability]
source_datasets: [walledai/HarmBench]
generated_by_models: [google/gemma-2-2b, google/gemma-2-2b-it, Qwen/Qwen3-8B]

Refusal prefill-transplant test (n=52 prompts, plain template): transcripts

1144 transcripts from the prefill-transplant experiment of 2026-08-12: for each of 52 harmful HarmBench requests that gemma-2-2b-it refuses with an opening of the form "I cannot …", the first k tokens (k = 0…10) of the instruct model's refusal are transplanted as a prefilled assistant opening, and a continuer model greedy-decodes 120 tokens after it. Prompts are rendered with a plain User: … Assistant: template with no chat-control tokens. The companion repo …refusal_prefill_flip_n52_chat holds the same experiment under the chat template; …refusal_prefill_flip_n3 holds the 3-prompt pilot.

The question: does producing the token "I" (or "I cannot") itself commit a model to a refusal, or is refusal carried by the instruct machinery of the forward pass? Each transcript was judged twice: on the full assistant turn (prefill + continuation) and, in a later re-judge, on the continuation alone (results_continuation.json in git).

Files

harm_<id>__<arm>__k<kk>.md, 52 ids × 2 arms × 11 k-values = 1144 files. Each file records: HarmBench category, template, prefill source and the harvested source opening, the full-turn judge label with confidence and rationale, the request, the exact prefilled opening (k tokens), and the model continuation.

Prefill source for both arms: google/gemma-2-2b-it (--prefill_source instruct, openings harvested greedily with 64 tokens, first --max_prefill 10 tokens used).

Regenerate

From the repo root on a jagupard GPU node (one 48 GB GPU fits base + instruct + the judge), LARGE_ARTIFACTS_DIR and HF_TOKEN exported; IDS = the 52 prompt ids (those in results.json → records[*].prompt_id):

scripts/submit.sh --cpus-per-task=8 --mem=96G refusal_prefill_flip --prompt_ids $IDS --continue_with base instruct --prefill_source instruct --prompt_template plain --max_prefill 10 --max_new_tokens 120 --batch_size 16 --judge_batch_size 16 --output_dir experiments/refusal_tracing/results/refusal_prefill_flip_n52_plain
scripts/submit.sh rejudge_prefill --results experiments/refusal_tracing/results/refusal_prefill_flip_n52_plain/results.json

(Original launch: scripts/submit.sh refusal_prefill_flip <same flags>, Slurm job 16760103; continuation-only re-judge job 16760240.)

Cluster paths

• Slurm logs: logs/refusal_prefill_flip/20260812_224427_16760103.{out,err} in the repo checkout on the Stanford NLP cluster (/juice2/u/siddharth/transcoder-adapters).
• Aggregates in git: experiments/refusal_tracing/results/refusal_prefill_flip_n52_plain/{results.json,results_continuation.json,summary.md,summary_continuation.md,prefill_flip.png,prefill_flip_continuation.png}.

Restore into the repo

uv run hf download siddharthmb/2026.TA.experiments.refusal_tracing.refusal_prefill_flip_n52_plain --repo-type dataset --include "harm_*.md" --local-dir experiments/refusal_tracing/results/refusal_prefill_flip_n52_plain/transcripts

Provenance

• Code: experiments/refusal_tracing/scripts/ in the transcoder-adapters repo; writeup: experiments/refusal_tracing/writeup.md.
• Aggregates (results.json with every record incl. judge label, confidence and rationale; summary.md tables; figures) stay in git next to the transcripts.txt breadcrumb that points here. The transcript .md files are a human-readable rendering of results.json records.
• Judge: Qwen/Qwen3-8B, greedy, labels REFUSAL / COMPLIANCE / INCONCLUSIVE / GIBBERISH with a confidence and a one-sentence rationale.
• Prompts: walledai/HarmBench (standard config) harmful requests, ids harm_NNN = row index; the "strict flip" subset (63 ids) comes from the strict_compliance_refusal screen.
• No Weights & Biases runs (generation + judging only).