Open-weight model
distilling-safety-adapters
by Christopher Kinoshita Realmbird/distilling-safety-adapters
distilling-safety-adapters is an open-weight model from Christopher Kinoshita, released under Apache License 2.0. Its published files total 2.6 GB.
LoRA adapters from a research sprint asking whether safety transfers subliminally through distillation. Report and code: https://github.com/Realmbird/distilling-safety (see reports/REPORT.md). Research artifacts, not for deployment.
Model Card
By Christopher Kinoshita, published under apache-2.0, revision dc47095c3908.
LoRA adapters from a research sprint asking whether safety transfers subliminally through distillation. Report and code: https://github.com/Realmbird/distilling-safety (see reports/REPORT.md). Research artifacts, not for deployment. Several students are measurably less safe than the base model (that is the main finding); none of these adapters should be used as a safety intervention. All adapters sit on Qwen/Qwen2.5-7B-Instruct ("M0"). Teacher recipe: LoRA r=64, alpha=64, all attention and MLP projections; lr 1e-4, cosine schedule, 1 epoch, batch 16, max length 1024; completion-only loss. Data: LLM-LAT/harmful-dataset (2.5k-prompt training split) and LLM-LAT/benign-dataset (2.5k rows)…
Read Christopher Kinoshita's full model card
LoRA adapters from a research sprint asking whether safety transfers subliminally through distillation.
Report and code: https://github.com/Realmbird/distilling-safety (see reports/REPORT.md).
Research artifacts, not for deployment. Several students are measurably less safe than the base model (that is the main finding); none of these adapters should be used as a safety intervention.
All adapters sit on Qwen/Qwen2.5-7B-Instruct ("M0").
| Subfolder | What it is |
|---|---|
teachers/T_benign |
Teacher. M0 + LoRA SFT on 2.5k LLM-LAT benign utility rows only (no refusals). |
teachers/T_refusal |
Teacher. M0 + LoRA SFT on 2.5k LLM-LAT harmful-prompt -> refusal pairs only. |
teachers/T_shallow |
Teacher. M0 + LoRA SFT on both (standard refusal SFT; the v2 'shallow' recipe, rebuilt). |
students/T_none_s0 |
Student, seed 0. M0 + LoRA SFT on 20k number sequences written by M0's own numbers (control). |
students/T_none_s1 |
Student, seed 1. M0 + LoRA SFT on 20k number sequences written by M0's own numbers (control). |
students/T_benign_s0 |
Student, seed 0. M0 + LoRA SFT on 20k number sequences written by the benign-only teacher's numbers. |
students/T_benign_s1 |
Student, seed 1. M0 + LoRA SFT on 20k number sequences written by the benign-only teacher's numbers. |
students/T_refusal_s0 |
Student, seed 0. M0 + LoRA SFT on 20k number sequences written by the refusal-only teacher's numbers. |
students/T_refusal_s1 |
Student, seed 1. M0 + LoRA SFT on 20k number sequences written by the refusal-only teacher's numbers. |
students/T_shallow_s0 |
Student, seed 0. M0 + LoRA SFT on 20k number sequences written by the refusal + benign teacher's numbers. |
students/T_shallow_s1 |
Student, seed 1. M0 + LoRA SFT on 20k number sequences written by the refusal + benign teacher's numbers. |
Teacher recipe: LoRA r=64, alpha=64, all attention and MLP projections; lr 1e-4, cosine schedule, 1 epoch, batch 16, max length 1024; completion-only loss. Data: LLM-LAT/harmful-dataset (2.5k-prompt training split) and LLM-LAT/benign-dataset (2.5k rows), split with seed 0.
Student recipe: LoRA r=8, alpha=32; lr 1e-4 constant after warmup; batch 16; one pass over 20k
number-sequence completions (digits only, filtered; prompts shared across teachers). Each student folder has
the final adapter and train_manifest.json.
These are the adapters from the follow-up "benign-only vs refusal-only" experiment (report §4.9). The teachers behind the main results (deep/safety-recovery, LAT, calibrated) were not preserved; they are reproducible with the repo's scripts.
from transformers import AutoModelForCausalLM
from peft import PeftModel
base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen2.5-7B-Instruct", torch_dtype="auto", device_map="auto")
model = PeftModel.from_pretrained(base, "Realmbird/distilling-safety-adapters", subfolder="teachers/T_shallow")
Identity and Version
- Repository
- Realmbird/distilling-safety-adapters
- Publisher
- Christopher Kinoshita
- Task
- Not stated by the source
- Modality
- Other
- Library
- peft
- Parameters
- Not stated by the source
- Languages
- Not stated by the source
- Revision
- dc47095c3908005897e29aaf2f47b40be6142155
- First published
- 2026-10-05
- Last updated
- 2026-10-05
Files and Weights
35 files, 2.6 GB in total. The weights are 11 files totalling 2.6 GB in safetensors.
Every file
| File | Type | Size | SHA-256 |
|---|---|---|---|
| students/T_benign_s0/adapter_model.safetensors | Weights | 80.8 MB | 280ef03d0248 |
| students/T_benign_s1/adapter_model.safetensors | Weights | 80.8 MB | 33865a7f02f1 |
| students/T_none_s0/adapter_model.safetensors | Weights | 80.8 MB | 1cd63f810e47 |
| students/T_none_s1/adapter_model.safetensors | Weights | 80.8 MB | c2643f586155 |
| students/T_refusal_s0/adapter_model.safetensors | Weights | 80.8 MB | 471f4b9bb530 |
| students/T_refusal_s1/adapter_model.safetensors | Weights | 80.8 MB | 2f37400d9817 |
| students/T_shallow_s0/adapter_model.safetensors | Weights | 80.8 MB | 50d16ac9ad21 |
| students/T_shallow_s1/adapter_model.safetensors | Weights | 80.8 MB | d1709c9f22e6 |
| teachers/T_benign/adapter_model.safetensors | Weights | 646.0 MB | 35e89cfe0ecc |
| teachers/T_refusal/adapter_model.safetensors | Weights | 646.0 MB | e73819847a77 |
| teachers/T_shallow/adapter_model.safetensors | Weights | 646.0 MB | a58aa42af4ff |
| students/T_benign_s0/adapter_config.json | Configuration | 1.2 KB | — |
| students/T_benign_s0/train_manifest.json | Configuration | 18.9 KB | — |
| students/T_benign_s1/adapter_config.json | Configuration | 1.2 KB | — |
| students/T_benign_s1/train_manifest.json | Configuration | 18.8 KB | — |
| students/T_none_s0/adapter_config.json | Configuration | 1.2 KB | — |
| students/T_none_s0/train_manifest.json | Configuration | 18.8 KB | — |
| students/T_none_s1/adapter_config.json | Configuration | 1.2 KB | — |
| students/T_none_s1/train_manifest.json | Configuration | 18.8 KB | — |
| students/T_refusal_s0/adapter_config.json | Configuration | 1.2 KB | — |
| students/T_refusal_s0/train_manifest.json | Configuration | 18.8 KB | — |
| students/T_refusal_s1/adapter_config.json | Configuration | 1.2 KB | — |
| students/T_refusal_s1/train_manifest.json | Configuration | 18.8 KB | — |
| students/T_shallow_s0/adapter_config.json | Configuration | 1.2 KB | — |
| students/T_shallow_s0/train_manifest.json | Configuration | 18.9 KB | — |
| students/T_shallow_s1/adapter_config.json | Configuration | 1.2 KB | — |
| students/T_shallow_s1/train_manifest.json | Configuration | 18.9 KB | — |
| teachers/T_benign/adapter_config.json | Configuration | 1.2 KB | — |
| teachers/T_benign/train_manifest.json | Configuration | 3.3 KB | — |
| teachers/T_refusal/adapter_config.json | Configuration | 1.2 KB | — |
| teachers/T_refusal/train_manifest.json | Configuration | 3.3 KB | — |
| teachers/T_shallow/adapter_config.json | Configuration | 1.2 KB | — |
| teachers/T_shallow/train_manifest.json | Configuration | 5.6 KB | — |
| README.md | Documentation | 3.1 KB | — |
| .gitattributes | Repository | 1.5 KB | — |
License and Download
- License
- apache-2.0
- Access
- Open weights, no gate
- Download size
- 2.6 GB
Released by Christopher Kinoshita through its official repository on Hugging Face. Read the license.
Built From
- Adapter of Qwen/Qwen2.5-7B-Instruct
- Derived from Qwen/Qwen2.5-7B-Instruct
Memory Requirements
| Precision | Weights in memory |
|---|---|
| As published | 2.6 GB |
Weights only, from the published parameter count; the key-value cache and runtime add to this.
Questions About distilling-safety-adapters
Can I use distilling-safety-adapters commercially?
Yes. distilling-safety-adapters is released under Apache License 2.0. The Apache License 2.0 is a permissive open-source license. It permits commercial use, modification and redistribution. It requires keeping the license and copyright notices and any NOTICE file, stating significant changes, and it includes an express patent grant from contributors.