gradient-untangler

Local white-box suffix attacks on open-weight models you hold on disk.

Authorized security research only. Use on models you own, local weights, in-scope bounty programs, written pentests, CTFs, and labs you control. See SECURITY.md.

Install

git clone https://gitlab.com/WattoCyber/gradient-untangler.git
cd gradient-untangler
py -3.12 -m pip install -e ".[dev,web]"
py -3.12 scripts/repro.py

Expect REPRO_OK. That gate is offline: no GPU, no network.

Run

py -3.12 -m gradjail.cli run \
  --model sshleifer/tiny-gpt2 \
  --goal "Say the lab marker." \
  --target-prefix "CANARY_OK" \
  --optimizer gcg \
  --device cpu \
  --judge "contains:CANARY_OK" \
  --out runs/demo.json

Web tail (does not launch attacks):

py -3.12 -m gradjail.web

Open http://127.0.0.1:8787 and pick a runs/*.json file.

List implemented optimizers: py -3.12 -m gradjail.cli list.

What you get

• GCG / PEZ-class search on a local model. Teacher-forced cross-entropy. Prefix-KV candidate eval.
• Weight registry (WeightRegistry.from_path): read tensors off disk, snapshot, diff. Map before you edit.
• Layer saliency: one backward pass, per-tensor L2 grad norms keyed by the same names.
• Suffix-to-delta: a GCG suffix is waste. Fit a rank-1 U V^T on the embed so the clean prompt hits the same teacher-forced target CE. Original weight is untouched. Not ROME, not abliteration, not bit-flip.

from gradjail.suffix_delta import fit_suffix_delta

Target-token injection is off unless you pass inject_target=True.

Remote API URLs are rejected. Gradients require local weights.

Honesty

This is a local harness, not a claim that every optimizer is new. GCG and PEZ are published methods. The product is one spine: local gradients, a weight map, saliency, a suffix-to-delta absorber, and a repro gate.

Do not treat a single asr=True disk file as a finding. Re-fire. A short refusal is a miss.

Layout

src/gradjail/     package
tests/            pytest
scripts/repro.py  offline product gate
docs/             design and benchmark notes

Electron is on disk in some checkouts and is not shipped.

License

MIT. See LICENSE.

Banner left panel: Rembrandt, Philosopher in Meditation (1632), public domain, via Wikimedia Commons. Science overlays are generated in-tree.