base_model: google/gemma-3-12b-it
library_name: peft
pipeline_tag: text-generation
tags:
- lora
- peft
- sft
- safety
- intent
- jailbreak-detection
gemma-3-12b-intent-jailbreak-classifier-sft
LoRA adapter for google/gemma-3-12b-it, supervised-fine-tuned directly on theJazhyc/wildguard-annotated-intents dataset (no teacher distillation). The
model produces a verbalized user intent and a harm classification for a given
prompt, and serves as the SFT baseline counterpart toJazhyc/gemma-3-12b-intent-jailbreak-classifier,
which is distilled from openai/gpt-oss-120b.
Performance
| Metric | Value |
|---|---|
| OOD validation harm F1 (mean of ToxicChat train + Aegis 2.0 val) | 0.7779 |
| In-domain val harm F1 | 0.7197 |
| In-domain val harm precision | 0.7584 |
| In-domain val harm recall | 0.6848 |
| In-domain val semantic similarity (intent) | 0.7260 |
OOD F1 is averaged over lmsys/toxic-chat (toxicchat0124, train split) andnvidia/Aegis-AI-Content-Safety-Dataset-2.0 (validation split). Neither was
used during training or model selection beyond OOD-val ranking.
Training
- Base model:
google/gemma-3-12b-it - Training data: human-annotated intents from
Jazhyc/wildguard-annotated-intents - Learning rate: 1e-05
- Adapter: LoRA, r=16, alpha=32, dropout=0.0, targets q/k/v/o/gate/up/down_proj
- Quantization: 4-bit NF4 (QLoRA) during training
- Attention: flash_attention_2 with sequence packing
- Early stopping on combined val+test split (patience 1)
Usage
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer
base = "google/gemma-3-12b-it"
adapter = "Jazhyc/gemma-3-12b-intent-jailbreak-classifier-sft"
tokenizer = AutoTokenizer.from_pretrained(base)
model = AutoModelForCausalLM.from_pretrained(base, torch_dtype="bfloat16", device_map="auto")
model = PeftModel.from_pretrained(model, adapter)
messages = [
{"role": "system", "content": "<system prompt from build_student_messages(..., 'human_intent')>"},
{"role": "user", "content": "<prompt to classify>"},
]
inputs = tokenizer.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512)
print(tokenizer.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))
The expected output format is <intent>...</intent><harm>safe|harmful</harm>.
See src/intention_jailbreak/model_generation/prompt_templates.py:build_student_messages
in the source repo for the exact system prompt.
Citation / source
Part of the intention-jailbreak research project on jailbreak detection via
verbalized intent reasoning.
Framework versions
- PEFT 0.18.1