adaptersentry 2.0.1__tar.gz → 2.0.2__tar.gz

{adaptersentry-2.0.1 → adaptersentry-2.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adaptersentry
-Version: 2.0.1
+Version: 2.0.2
 Summary: Static security scanner for LoRA adapters — detects anomalous weight patterns in .safetensors files
 License: 
                                          Apache License
@@ -246,7 +246,7 @@ Dynamic: license-file
 
 ![Python](https://img.shields.io/badge/python-%3E%3D3.11-blue)
 ![License](https://img.shields.io/badge/license-Apache%202.0-blue)
-![Version](https://img.shields.io/badge/version-2.0.1-blue)
+![Version](https://img.shields.io/badge/version-2.0.2-blue)
 
 AdapterSentry is a static security scanner for LoRA adapters distributed as `.safetensors`
 files. A LoRA adapter is a small file that changes how a large language model behaves; anyone

{adaptersentry-2.0.1 → adaptersentry-2.0.2}/README.md

@@ -2,7 +2,7 @@
 
 ![Python](https://img.shields.io/badge/python-%3E%3D3.11-blue)
 ![License](https://img.shields.io/badge/license-Apache%202.0-blue)
-![Version](https://img.shields.io/badge/version-2.0.1-blue)
+![Version](https://img.shields.io/badge/version-2.0.2-blue)
 
 AdapterSentry is a static security scanner for LoRA adapters distributed as `.safetensors`
 files. A LoRA adapter is a small file that changes how a large language model behaves; anyone

{adaptersentry-2.0.1 → adaptersentry-2.0.2}/adaptersentry.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adaptersentry
-Version: 2.0.1
+Version: 2.0.2
 Summary: Static security scanner for LoRA adapters — detects anomalous weight patterns in .safetensors files
 License: 
                                          Apache License
@@ -246,7 +246,7 @@ Dynamic: license-file
 
 ![Python](https://img.shields.io/badge/python-%3E%3D3.11-blue)
 ![License](https://img.shields.io/badge/license-Apache%202.0-blue)
-![Version](https://img.shields.io/badge/version-2.0.1-blue)
+![Version](https://img.shields.io/badge/version-2.0.2-blue)
 
 AdapterSentry is a static security scanner for LoRA adapters distributed as `.safetensors`
 files. A LoRA adapter is a small file that changes how a large language model behaves; anyone

{adaptersentry-2.0.1 → adaptersentry-2.0.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "adaptersentry"
-version = "2.0.1"
+version = "2.0.2"
 description = "Static security scanner for LoRA adapters — detects anomalous weight patterns in .safetensors files"
 readme = "README.md"
 license = {file = "LICENSE"}

{adaptersentry-2.0.1 → adaptersentry-2.0.2}/src/adaptersentry/detectors/intra_adapter.py

@@ -3,7 +3,7 @@
 No reference profile is needed. A 70B adapter has ~80 modules of each kind
 (q_proj, down_proj, …); each module is compared with the rest of its family.
 
-Per family (same module name) and per feature:
+Per family (same module name in the same layer stack) and per feature:
   1. if layer indices are known, remove the depth trend with a Theil–Sen line
      (median of pairwise slopes; insensitive to the outliers we look for);
   2. robust z of the residuals: (x − median) / (1.4826 · MAD), with the
@@ -50,6 +50,11 @@ from adaptersentry.schemas.result import (
 OUTLIER_Z = 3.5
 CONCENTRATION_REVIEW_Z = 14.0
 CONCENTRATION_FEATURES: tuple[str, ...] = ("kurt_dw", "row_top8", "row_hoyer")
+# On Hub adapters 28 of 32 concentration alerts sat in the first 3 or last 2 layers of
+# the model, which work differently from the middle. Such alerts keep the verdict but
+# say so; a per-family threshold for edge layers needs reference profiles.
+EDGE_FIRST_LAYERS = 3
+EDGE_LAST_LAYERS = 2
 # Robust z from small families is unreliable: MAD from a handful of points is
 # noisy, and detrending consumes degrees of freedom. On synthetic clean adapters
 # the maximum |z| reached 12-70 with 6-12 modules per family, but stayed ≤ 6.6
@@ -85,6 +90,7 @@ class ModuleEntry:
     expert: int | None
     features: ModuleFeatures
     energy: float              # ‖ΔW‖²_F, for concentration across modules
+    stack: str = ""            # layer stack (language model, vision tower, …); part of the family
 
 
 @dataclass
@@ -121,6 +127,13 @@ def detrend(layers: np.ndarray, x: np.ndarray) -> np.ndarray:
     return x - (intercept + slope * layers)
 
 
+def is_edge_layer(layer: int | None, n_layers: int | None) -> bool:
+    """True for the first EDGE_FIRST_LAYERS and last EDGE_LAST_LAYERS layers of a stack."""
+    if layer is None or n_layers is None:
+        return False
+    return layer < EDGE_FIRST_LAYERS or layer >= n_layers - EDGE_LAST_LAYERS
+
+
 def concentration_z(zs: dict[str, float]) -> float | None:
     """Joint concentration z of one module: the smallest of the signed z-values of
     CONCENTRATION_FEATURES, so it is high only when all three rise together.
@@ -154,9 +167,14 @@ def compare_within_adapter(entries: list[ModuleEntry], *, top_k: int = 10) -> In
     Returns:
         IntraResult, or None if no family has at least MIN_FAMILY modules.
     """
+    # A family is one module name within one layer stack: a vision tower's q_proj is
+    # not compared with the language model's q_proj. Names are qualified with the
+    # stack only when the adapter covers more than one.
+    qualify = len({e.stack for e in entries}) > 1
+    family_of = {e.index: (f"{e.stack}/{e.module}" if qualify and e.stack else e.module) for e in entries}
     families: dict[str, list[ModuleEntry]] = defaultdict(list)
     for e in entries:
-        families[e.module].append(e)
+        families[family_of[e.index]].append(e)
 
     z_by_module: dict[int, dict[str, float]] = defaultdict(dict)
     contributions: list[tuple[float, Contributor]] = []
@@ -203,7 +221,7 @@ def compare_within_adapter(entries: list[ModuleEntry], *, top_k: int = 10) -> In
     }
     by_index = {e.index: e for e in entries}
     conc_spikes = [
-        DepthSpike(module_type=by_index[idx].module, layer=by_index[idx].layer, z=v)
+        DepthSpike(module_type=family_of[idx], layer=by_index[idx].layer, z=v)
         for idx, v in sorted(concentration.items(), key=lambda kv: -kv[1])
         if v >= CONCENTRATION_REVIEW_Z and by_index[idx].layer is not None
     ][:top_k]
@@ -212,7 +230,7 @@ def compare_within_adapter(entries: list[ModuleEntry], *, top_k: int = 10) -> In
         e = by_index[idx]
         if v > OUTLIER_Z and e.layer is not None and len(spikes) < top_k:
             signed = max(z_by_module[idx].values(), key=abs)
-            spikes.append(DepthSpike(module_type=e.module, layer=e.layer, z=float(signed)))
+            spikes.append(DepthSpike(module_type=family_of[idx], layer=e.layer, z=float(signed)))
 
     energies = np.array([e.energy for e in entries if e.energy > 0.0], dtype=np.float64)
     attn = [e.features.log_rms for e in entries if e.kind == "attention" and e.features.log_rms is not None]

{adaptersentry-2.0.1 → adaptersentry-2.0.2}/src/adaptersentry/parsers/names.py

@@ -20,6 +20,7 @@ _EMB_B = re.compile(r"^(?P<base>.+)\.lora_embedding_B(?:\.[A-Za-z0-9_\-]+)?$")
 _DORA = re.compile(r"^(?P<base>.+)\.lora_magnitude_vector(?:\.[A-Za-z0-9_\-]+)?(?:\.weight)?$")
 _TRAINABLE_TOKENS = re.compile(r"^(?P<base>.+)\.trainable_tokens_(?:delta|original)(?:\.[A-Za-z0-9_\-]+)?$")
 
+_PEFT_PREFIX = "base_model.model."
 _LAYER = re.compile(r"(?:^|\.)(?:layers|h|blocks|layer)\.(\d+)(?:\.|$)")
 _EXPERT = re.compile(r"(?:^|\.)experts\.(\d+)(?:\.|$)")
 
@@ -57,6 +58,10 @@ class ModuleLocation:
     expert: int | None
     module: str
     kind: ModuleKind
+    # Path of the layer stack the module belongs to, e.g. "model.language_model" or
+    # "model.vision_tower.vision_model.encoder"; "" when the path has no layer index.
+    # Multimodal models reuse module names (q_proj, up_proj) across stacks.
+    stack: str = ""
 
 
 def parse_key(key: str) -> ParsedKey:
@@ -98,9 +103,15 @@ def locate(base: str) -> ModuleLocation:
         kind = "router"
     else:
         kind = "other"
+    stack = ""
+    if layer_m:
+        stack = base[:layer_m.start()]
+        if stack.startswith(_PEFT_PREFIX):
+            stack = stack[len(_PEFT_PREFIX):]
     return ModuleLocation(
         layer=int(layer_m.group(1)) if layer_m else None,
         expert=int(expert_m.group(1)) if expert_m else None,
         module=name,
         kind=kind,
+        stack=stack,
     )

{adaptersentry-2.0.1 → adaptersentry-2.0.2}/src/adaptersentry/scanner.py

@@ -42,6 +42,7 @@ from adaptersentry.detectors.intra_adapter import (
     ModuleEntry,
     compare_within_adapter,
     concentration_z,
+    is_edge_layer,
 )
 from adaptersentry.detectors.structural import find_siblings, structural_findings
 from adaptersentry.features.spectral import head_features, module_features
@@ -322,7 +323,8 @@ def _scan_inventory(path, inv: AdapterInventory, cfg_read, siblings, artifact, s
         idx = len(records)
         records.append(ModuleRecord(**base_record, scale=res.scale, status="ok", features=feats, heads=heads))
         entries.append(ModuleEntry(index=idx, module=loc.module, kind=loc.kind, layer=loc.layer,
-                                   expert=loc.expert, features=feats, energy=core.fro ** 2))
+                                   expert=loc.expert, features=feats, energy=core.fro ** 2,
+                                   stack=loc.stack))
         del pd
 
     intra = compare_within_adapter(entries)
@@ -335,19 +337,30 @@ def _scan_inventory(path, inv: AdapterInventory, cfg_read, siblings, artifact, s
     struct = structural_findings(inv, config, cfg_read.problems, siblings,
                                  unresolved_scale_pattern=unresolved_pattern)
     findings = list(struct.findings)
+    top_spike_edge = False
     if intra is not None:
         pair_by_index = {i: inv.pairs[i] for i in range(len(inv.pairs))}
+        stack_depth: dict[str, int] = {}
+        for p in inv.pairs:
+            if p.location.layer is not None:
+                s = p.location.stack
+                stack_depth[s] = max(stack_depth.get(s, 0), p.location.layer + 1)
         conc = {idx: c for idx, zs in intra.z_by_module.items()
                 if (c := concentration_z(zs)) is not None and c >= CONCENTRATION_REVIEW_Z}
-        for idx, c in sorted(conc.items(), key=lambda kv: -kv[1])[:10]:
+        for rank, (idx, c) in enumerate(sorted(conc.items(), key=lambda kv: -kv[1])[:10]):
             rec, pair = records[idx], pair_by_index[idx]
             zs = intra.z_by_module[idx]
+            edge = is_edge_layer(rec.layer, stack_depth.get(pair.location.stack))
+            if rank == 0:
+                top_spike_edge = edge
+            note = ("; first/last layers often differ like this in benign adapters" if edge else "")
             findings.append(Finding(
                 rule_id="INTRA_CONCENTRATION_SPIKE", severity=Severity.MEDIUM,
                 title="Update concentrated on a few outputs, unlike its family",
                 message=(f"{rec.module} in layer {rec.layer}: kurtosis, top-8 row share and row Hoyer "
-                         f"all rise against the family (concentration z = {c:.1f} ≥ {CONCENTRATION_REVIEW_Z})"),
-                evidence={"concentration_z": round(c, 3),
+                         f"all rise against the family (concentration z = {c:.1f} ≥ {CONCENTRATION_REVIEW_Z})"
+                         f"{note}"),
+                evidence={"concentration_z": round(c, 3), "edge_layer": edge,
                           **{f"z_{f}": round(zs[f], 3) for f in CONCENTRATION_FEATURES}},
                 locations=[Location(layer=rec.layer, module=rec.module, expert=rec.expert,
                                     tensor_key=pair.b.key)],
@@ -453,6 +466,7 @@ def _scan_inventory(path, inv: AdapterInventory, cfg_read, siblings, artifact, s
         status=status, policy=policy, intra=intra.summary if intra else None, reference=None,
         red_flags=struct.red_flags, metadata_present=bool(meta) or config is not None,
         confidence_limits=struct.confidence_limits, n_not_analyzed=n_not,
+        top_spike_edge=top_spike_edge,
     )
     anomaly = Anomaly(
         intra=intra.summary if intra else None,

{adaptersentry-2.0.1 → adaptersentry-2.0.2}/src/adaptersentry/scoring/verdict.py

@@ -40,6 +40,7 @@ def derive_verdict(
     metadata_present: bool,
     confidence_limits: list[str],
     n_not_analyzed: int,
+    top_spike_edge: bool = False,
 ) -> Verdict:
     """Derive action, level, reasons, behavioural recommendation and confidence."""
     action = "allow"
@@ -85,7 +86,9 @@ def derive_verdict(
             code="INTRA_OUTLIER", severity=Severity.MEDIUM,
             message=f"Update concentrated on a few outputs, unlike the rest of its family{where}: "
                     f"concentration z = {intra.max_concentration_z:.1f} ≥ {CONCENTRATION_REVIEW_Z} "
-                    f"(threshold set at 5 % alerts on popular Hub adapters)"))
+                    f"(threshold set at 5 % alerts on popular Hub adapters)"
+                    + ("; it is a first/last layer, where such differences are common in benign adapters"
+                       if top_spike_edge else "")))
         raise_to("review")
 
     for flag in red_flags:

adaptersentry-2.0.2/src/adaptersentry/version.py

@@ -0,0 +1 @@
+__version__ = "2.0.2"

{adaptersentry-2.0.1 → adaptersentry-2.0.2}/tests/test_scanner.py

@@ -62,6 +62,14 @@ class TestDetection:
         spike = next(f for f in result.findings if f.rule_id == "INTRA_CONCENTRATION_SPIKE")
         assert spike.locations[0].layer == 7 and spike.locations[0].module == "down_proj"
         assert spike.evidence["concentration_z"] >= 14.0
+        assert spike.evidence["edge_layer"] is False
+
+    def test_edge_layer_alert_is_marked(self, tmp_path: Path) -> None:
+        result = scan(_write_adapter(tmp_path / "edge", inject_layer=15))  # last of 16 layers
+        spike = next(f for f in result.findings if f.rule_id == "INTRA_CONCENTRATION_SPIKE")
+        assert result.verdict.action == "review"
+        assert spike.locations[0].layer == 15 and spike.evidence["edge_layer"] is True
+        assert "benign adapters" in spike.message
 
     def test_rescale_attack_does_not_hide_the_update(self, tmp_path: Path) -> None:
         # B shrunk by 1e4 and lora_alpha raised by 1e4: effective ΔW is unchanged.

adaptersentry-2.0.1/src/adaptersentry/version.py

@@ -1 +0,0 @@
-__version__ = "2.0.1"