base_model: google/gemma-3-12b-it
library_name: peft
pipeline_tag: text-generation
tags:
- lora
- peft
- distillation
- safety
- intent
- jailbreak-detection
gemma-3-12b-intent-jailbreak-classifier
LoRA adapter for google/gemma-3-12b-it distilled from openai/gpt-oss-120b as a teacher,
under the human_intent reasoning-trace condition (the student is trained on
reasoning traces produced by the teacher conditioned on human-annotated intents
from the Jazhyc/wildguard-annotated-intents dataset).
This is the best-performing distilled student we trained: it produces a short
chain-of-thought, an inferred user intent, and a final harm classification for
a given prompt.
Performance
| Metric | Value |
|---|---|
| OOD validation harm F1 (mean of ToxicChat train + Aegis 2.0 val) | 0.7793 |
| In-domain val harm F1 | 0.7611 |
| In-domain val harm precision | 0.7500 |
| In-domain val harm recall | 0.7725 |
| In-domain val semantic similarity (intent) | 0.8967 |
OOD F1 is averaged over lmsys/toxic-chat (toxicchat0124, train split) andnvidia/Aegis-AI-Content-Safety-Dataset-2.0 (validation split). Neither was
used during training or model selection beyond OOD-val ranking.
Training
- Base model:
google/gemma-3-12b-it - Teacher:
openai/gpt-oss-120b - Condition:
human_intent(teacher is given human-annotated intent;
student learns to reproduce reasoning + intent + harm label) - Learning rate: 2e-05
- Adapter: LoRA, r=32, alpha=64, dropout=0.0, targets q/k/v/o/gate/up/down_proj
- Quantization: 4-bit NF4 (QLoRA) during training
- Attention: flash_attention_2 with sequence packing
- Early stopping on combined val+test split (patience 1)
Usage
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer
base = "google/gemma-3-12b-it"
adapter = "Jazhyc/gemma-3-12b-intent-jailbreak-classifier"
tokenizer = AutoTokenizer.from_pretrained(base)
model = AutoModelForCausalLM.from_pretrained(base, torch_dtype="bfloat16", device_map="auto")
model = PeftModel.from_pretrained(model, adapter)
messages = [
{"role": "system", "content": "<system prompt from build_student_messages(..., 'human_intent')>"},
{"role": "user", "content": "<prompt to classify>"},
]
inputs = tokenizer.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512)
print(tokenizer.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))
The expected output format is <reasoning>...</reasoning><intent>...</intent><harm>safe|harmful</harm>.
See src/intention_jailbreak/model_generation/prompt_templates.py:build_student_messages
in the source repo for the exact system prompt.
Citation / source
Part of the intention-jailbreak research project on jailbreak detection via
verbalized intent reasoning.
Framework versions
- PEFT 0.18.1