HARC

HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment Model description HARC couples a model's internal *harmfulness* and *refusal* directions at both prompt-side and response-side token positions, using an additive margin-hinge loss on cosine projections of the residual stream. The intervention is confined to a low-dimensional harmfulness–refusal subspace within a small set of selected layers, which improves robustness to jailbreak attacks while preserving general capability and avoiding the over-refusal regression typical of broader safety tuning. This repository contains the HARC LoRA adapters.** The adapter is applied to attention and MLP projections and trained with a composite objective: **(i)** the margin-hinge coupling loss **(ii)** a KL-divergence retention term anchoring benign outputs to the base model **(iii)** a cross-entropy term supervising refusal text on harmful prompts. Training directions are extracted via difference-of-means on contrastive prompt sets and periodically recomputed with EMA blending. The adapter adds ~1% trainable parameters and leaves the base architecture unchanged. **Backbone models:** Llama-3.1-8B-Instruct, Qwen-2.5-7B-Instruct **Collection:** HARC Collection **Paper:** arXiv:2607.00572 **Code:** github.com/microsoft/HARC The HARC collection | Repo | Contents | License | |---|---|---| | **microsoft/HARC** (this repo) | LoRA adapters for both backbones | MIT | | microsoft/HARC-Llama-3.1-8B-Instruct | Merged full model | Llama 3.1 Community License | | microsoft/HARC-Qwen2.5-7B-Instruct | Merged full model | Apache-2.0 | Use this repo if you want the lightweight adapters to load on top of your own copy of the base model; use the merged-model repos if you want a single ready-to-run checkpoint. Repository structure How to use Use the base model's standard chat template in both cases. Option A — pre-merged full model (simplest) Loads directly from the merged-model repo; no base download or PEFT required. Optio