Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Antisource/heronaisec/llms.txt

Use this file to discover all available pages before exploring further.

The interventions module implements strategies for attenuating or removing backdoor behaviour from a poisoned model after training. It does not compute metrics, produce plots, or orchestrate experiments — it takes a poisoned model as input and returns a new model that has been subjected to an intervention. A critical design invariant is that the original model is never modified: every intervention function operates exclusively on a deepcopy, so the caller always retains the original poisoned model for baseline comparison. The reviewer-based intervention (apply_reviewer_intervention) is scaffolded for Phase 2 and currently raises NotImplementedError.

​
Functions

​
fine_tune_clean()

Fine-tune a model on a clean (uncontaminated) dataset. A convenience wrapper that calls build_trainer() from src.train and immediately executes train_model(). The model is trained in-place on the provided train_dataset and the resulting checkpoint is saved to output_dir. Unlike apply_clean_intervention(), this function does not make a deep copy — it is the low-level primitive that operates on whatever model object is passed in.
​
model
PreTrainedModel
required
The model to fine-tune. For intervention experiments this should be a deepcopy of the poisoned model; apply_clean_intervention() handles that automatically.
​
train_dataset
Dataset
required
A PyTorch-formatted Dataset (from prepare_for_training()) containing clean, uncontaminated examples.
​
output_dir
str
required
Directory for Trainer checkpoints and the final saved model.
​
epochs
int
required
Number of fine-tuning epochs.
​
learning_rate
float
required
Peak learning rate for the AdamW optimiser.
​
batch_size
int
required
Per-device training batch size.
​
weight_decay
float
required
L2 regularisation coefficient.
​
seed
int
required
Random seed for reproducibility.
​
tokenizer
AutoTokenizer
required
The tokenizer used to encode the training data. Saved to output_dir alongside the model.
​
return
PreTrainedModel
The fine-tuned model returned by train_model().
Example: 
from copy import deepcopy
from src.interventions import fine_tune_clean
from src.data import prepare_for_training, tokenize_dataset

model_copy = deepcopy(poisoned_model)
clean_tokenized = prepare_for_training(tokenize_dataset(clean_train, tokenizer))

intervened = fine_tune_clean(
    model=model_copy,
    train_dataset=clean_tokenized,
    output_dir="results/intervention/fine_tune",
    epochs=3,
    learning_rate=2e-5,
    batch_size=32,
    weight_decay=0.01,
    seed=42,
    tokenizer=tokenizer,
)

​
apply_clean_intervention()

Apply a progressive clean fine-tuning intervention at a configurable data ratio. This is the primary public API for clean-data interventions. The ratio parameter controls how much clean data is used relative to the full clean_dataset:
  • At ratio=0.0: No training occurs. A deepcopy of the original model is returned immediately.
  • At ratio>0.0: A randomly shuffled subset of int(len(clean_dataset) * ratio) examples is selected, tokenized, formatted, and used to fine-tune a deepcopy of the model via fine_tune_clean().
In both branches the original model passed in is never modified. The function always returns a new model object.
​
model
PreTrainedModel
required
The poisoned model to intervene on. A deep copy is always made internally — the original is not touched.
​
clean_dataset
Dataset
required
A clean (uncontaminated) Dataset in raw text form (not yet tokenized). apply_clean_intervention() handles tokenization internally.
​
tokenizer
AutoTokenizer
required
The tokenizer matching the model. Applied to the clean subset before training.
​
ratio
float
required
Fraction of clean_dataset to use for fine-tuning, in [0.0, 1.0]. A value of 0.0 returns a deep copy immediately with no training.
​
output_dir
str
required
Directory for checkpoints and the final saved model/tokenizer.
​
epochs
int
required
Number of fine-tuning epochs passed to fine_tune_clean().
​
learning_rate
float
required
Peak learning rate for the AdamW optimiser.
​
batch_size
int
required
Per-device training batch size.
​
weight_decay
float
required
L2 regularisation coefficient.
​
seed
int
required
Random seed used for both subset shuffling and the training loop.
​
return
PreTrainedModel
A new PreTrainedModel — either an untrained deep copy (when ratio=0.0) or a fine-tuned deep copy (when ratio>0.0). The original model argument is always left unchanged.
Because the input clean_dataset must be in raw text form (not tokenized), passing a pre-tokenized dataset will cause the internal tokenize_dataset() call to fail. This is the opposite of fine_tune_clean(), which expects a prepare_for_training() output.
To measure backdoor persistence across intervention strengths, call apply_clean_intervention() in a loop over a range of ratio values (e.g. [0.0, 0.1, 0.25, 0.5, 1.0]) and evaluate each returned model with evaluate_model() from src.evaluation.
Example — sweeping over intervention ratios: 
from src.interventions import apply_clean_intervention
from src.evaluation import evaluate_model

ratios = [0.0, 0.1, 0.25, 0.5, 1.0]
results = []

for ratio in ratios:
    intervened = apply_clean_intervention(
        model=poisoned_model,        # never modified
        clean_dataset=clean_train,   # raw text, not tokenized
        tokenizer=tokenizer,
        ratio=ratio,
        output_dir=f"results/intervention/ratio_{ratio}",
        epochs=3,
        learning_rate=2e-5,
        batch_size=32,
        weight_decay=0.01,
        seed=42,
    )

    metrics = evaluate_model(
        model=intervened,
        clean_dataset=clean_val_ready,
        triggered_dataset=triggered_val_ready,
        tokenizer=tokenizer,
        target_label=1,
        baseline_asr=baseline_asr,
    )
    metrics["clean_ratio"] = ratio
    results.append(metrics)

​
Scaffolded Functions

​
apply_reviewer_intervention() (Phase 2)

def apply_reviewer_intervention(
    model: PreTrainedModel,
    clean_dataset: Dataset,
    reviewer_model: PreTrainedModel,
):
    raise NotImplementedError(
        "Reviewer intervention will be implemented in Phase 2."
    )
A placeholder for a reviewer-model-guided intervention strategy. Calling this function in the current release unconditionally raises NotImplementedError. The signature is subject to change in Phase 2.

Build docs developers (and LLMs) love

Get started for freeTalk to us