Task Format as a Factor in Adaptation: A Controlled Comparison of LoRA and Full Fine-Tuning for Prompt-Safety Classification

1 Introduction

• Task format has rarely been studied alongside adaptation regime, and prior comparisons can confound regime effects with learning rate, seed, and other experimental settings.Prompt-safety classification offers established out-of-distribution tests, including adversarial jailbreaks and over-refusal of benign prompts.Source: §1 · pp. 1–2
• The study crosses regime, architecture, and task format on a matched Ettin 400M encoder–decoder pair, with pre-specified analyses and up to 15 seeds per trained cell.The comparison is scoped to prompt-safety classification on one training corpus of 29K rows.Source: §1 · p. 2
• Full fine-tuning leads LoRA by 2–3 pp at conventional learning rates, but the regimes are equivalent on the encoder when both rates use the same search.The equivalence margin was fixed before the runs.Source: §1 · p. 2
• Training LoRA to generate a reason after its verdict adds 4.0 pp and closes its gap with full fine-tuning, while an equal-length content-free sentence adds nothing.Whether the label comes from a classification head or a generated verdict makes little difference under either regime.Source: §1 · p. 2
• Every trained 400M model beats the prompted 8B in-domain but trails it on synthetic adversarial prompts, while flagging 27–66% of benign but harmful-looking prompts unsafe versus the 8B’s 2–3%.For content-safety corpora, head-based classifiers also rank prompts worse than the 8B, so a new threshold would not close the gap.Source: §1 · p. 2

2.1 Task format and training on rationales

• Prior task-format studies hold the adaptation regime fixed, and rationale research leaves label-first controls and the interaction between training target and regime untested.The paper identifies a matched-length content-free sentence and reasons borrowed from other items as missing label-first controls.Source: §2.1 · p. 3

2.2 Comparing parameter-efficient and full fine-tuning

• LoRA’s reported gap with full fine-tuning varies with rank, adapted layers, scaling, and learning rate, while reliable comparisons also require controlled model selection and seed variance.Prior controlled comparisons report LoRA trailing full fine-tuning by 0.7–1.9 pp on tasks with more than 1,000 training examples.Source: §2.2 · pp. 3–4

2.3 Guard models and how they are compared

• Published guard-model comparisons often change architecture, scale, data, regime, or output interface together, and rarely compare in-domain accuracy with established out-of-distribution measures.Earlier matched-regime comparisons also report imbalanced tuning effort or single-seed results, limiting interpretation of their estimates.Source: §2.3 · pp. 4–5, §2.2 · p. 4

3 Experimental Design

• The main experiment crosses architecture, adaptation regime, and task format in eight trained cells, with five untrained references and other settings held constant except learning rate.The deliberate learning-rate difference is addressed through the encoder’s shared search and pre-specified rates for decoder cells.Source: §3 · p. 5, §3.4 · p. 7

3.1 Task and training data

• The task uses prompt labels from Aegis 2.0; after removing redacted and empty prompts, training has 29,095 rows and the deduplicated test split has 1,709.The released training split repeats 3,363 unsafe prompts, shifting its label distribution to 59.1% unsafe versus 52.8% in the deduplicated test split.Source: §3.1 · p. 5

3.2 Models, adaptation regimes and design

• The matched 400M Ettin encoder and decoder share their pretraining mixture, recipe, tokenizer, and layer dimensions, differing in attention pattern and objective.LoRA adapts every linear projection with rank 16; full fine-tuning updates all 396 million parameters.Source: §3.2 · pp. 5–6

3.3 Task formats as training targets

• The three formats train a classification head, a generated verdict, or a verdict followed by a reason; the encoder supports only the head format.In generative formats the verdict is produced first, and the reason cannot change it; a reason target averages 34 supervised tokens.Source: §3.2 · p. 5, §3.3 · p. 6, Table 1 · p. 6

3.4 Experimental controls

• Cells share training rows, evaluation items, optimizer steps, and other run controls; seeds are shared across cells to align batch order and initial values of new weights.Training is not bit-reproducible at a fixed seed, so reruns reproduce distributions rather than exact numbers.Source: §3.4 · pp. 6–7

3.5 Evaluation data and metrics

• Evaluation uses balanced accuracy as its primary metric and three independently collected out-of-distribution corpora with distinct safety labels and metrics.OR-Bench measures over-refusal on benign harmful-looking prompts and recall on a toxic control; out-of-distribution scoring occurs at the final budget only.Source: §3.5 · p. 7

3.6 Statistical analysis

• Regime contrasts use equivalence tests against a pre-specified ±2 pp margin, with the encoder’s final-budget in-domain contrast designated as the primary test.Intervals straddling an equivalence boundary are reported as inconclusive, with a minimum detectable effect bound.Source: §3.6 · pp. 7–8

4.1 Overview of the results

• Every trained cell reaches 78.0–84.6% in domain, above the prompted 8B’s 76.8–78.9%, but the 8B leads on WildJailbreak and OR-Bench.On OR-Bench, trained cells flag 27.1–66.0% of benign prompts as unsafe, versus 2.0–2.6% for the 8B.Source: §4.1 · pp. 8–9

4.2 The regime effect and learning-rate tuning

• At pre-specified rates, full fine-tuning leads LoRA by 2–3 pp; after shared rate search, encoder regimes are equivalent at ±2 pp.The selected-rate encoder scores are 84.45% for LoRA and 84.07% for full fine-tuning.Source: Table 3 · p. 9, §4.2 · pp. 9–10

4.3 The training target closes LoRA’s gap

• On the decoder, adding a post-verdict reason raises LoRA by 4.00 pp versus 1.27 pp for full fine-tuning, closing the gap at 82.69% and 82.60%.Replacing the classification head with a generated verdict has little effect.Source: §4.3 · p. 10

4.4 Ablating the reason target

• 78.2% for fixed filler falls below verdict-only 78.7%, while reassigned reasons retain 60% (81.1%) and 42% (80.3%) of the gain.The fixed sentence adds almost no loss after being learned, whereas reassigned reasons maintain loss near 1.55 to training’s end.Source: §4.4 · p. 11, Table 4 · p. 11

4.5 Out-of-distribution comparison with a prompted 8B

• On safety-labeled out-of-domain corpora, head cells rank prompts worse than the 8B by 0.026–0.343 ROC-AUC; in-the-wild jailbreak-template labels are an exception.The latter labels identify jailbreak templates rather than whether prompts are harmful.Source: §4.5 · p. 12

5.1 Learning-rate tuning and the regime comparison

• With matched validation searches, full fine-tuning and LoRA are equivalent on the encoder, despite a 2–3 pp full fine-tuning lead at prior-work rates.A regime comparison is informative only when training and evaluation data, scale, architecture, and tuning procedure are matched.Source: §5.1 · p. 12

5.2 The training target as an adaptation factor

• On the decoder, a generated verdict leaves the regime gap unchanged, but adding a reason raises LoRA accuracy more than full fine-tuning and closes the gap.A fixed sentence of equal length gives no gain; borrowed reasons retain more gain when they carry the same label, while prompt-specific content accounts for part of the remainder. Why post-verdict reasons benefit LoRA more remains open; continuing loss from variable reasons is one proposed explanation.Source: §5.2 · p. 13

5.3 Trained and prompted classifiers out of distribution

• Out of distribution, trained 400M classifiers fall below the prompted 8B on adversarial jailbreaks and benign prompts resembling harmful ones.The trained head cells also have lower ROC-AUC on content-safety corpora, while reason training reduces but does not remove the decoder’s deficit.Source: §5.3 · p. 13

Scale and data

• All results concern 400M-parameter models trained on one corpus, although matched Ettin pairs from 17M to 1B could extend the comparison.The reported results hold scale constant to cross the three factors within one design.Source: §6 · p. 13

Tuning

• Only learning rate was searched, and only on the encoder; decoder rates were not searched, and the reason gain is compared with a verdict-only cell scoring 1.67 pp higher at half its rate.Part of the reason gain may therefore reflect an undertuned baseline rather than the reason itself.Source: §6 · pp. 13–14

Out-of-distribution evaluation

• Two of the three out-of-distribution corpora labelled for safety are synthetic, and final-budget-only scoring leaves the deficit’s training trajectory unknown.Different prompt truncation lengths also affect out-of-distribution comparisons between head and generated cells, most on WildJailbreak.Source: §6 · p. 14

A label-aware teacher

• Reasons came from one label-aware 8B teacher, and neither reasons from other models nor the effect of a doubled start-of-sequence token was tested.Reasons written for other prompts with the same label retain only part of the gain, so label agreement does not account for all of it.Source: §6 · p. 14

The prompted 8B

• The prompted 8B is about twenty times larger, from another model family, and used on text alone; pretraining may have included evaluation corpora, so the reversal does not identify its cause.Source: §6 · p. 14

• The regime difference was small when data, scale, and adapted layers were held equal, and disappeared on the encoder after both learning rates were tuned by the same method.Source: §7 · p. 14
• Architecture, training target, and evaluation distribution each had effects as large as or larger than the adaptation regime under these controlled conditions.Source: §7 · p. 14
• The authors identify repeating the design across 17M–1B Ettin pairs, expanding searches to rank, α, and schedule, and testing substitute targets as follow-up questions.They argue regime comparisons are informative only when conditions are controlled and specified.Source: §7 · p. 14

• The 400M classifiers had lower accuracy on adversarial jailbreaks, high unsafe flagging of benign prompts resembling harmful ones, and an 8–23 pp accuracy loss on prompts written in capitals.Source: Broader Impact Statement · p. 14
• Over-refusal could block legitimate requests, and in-domain accuracy alone does not reveal it; the authors argue for jailbreak and over-refusal evaluation before deployment.Source: Broader Impact Statement · p. 14
• The paper says attacker benefit is limited because its corpora and transformations are public and it created no new attack prompts.Released reasons and run records contain row identifiers but no prompt text; no trained weights were kept.Source: Broader Impact Statement · p. 14

A.1 Configuration

• The configuration splits the encoder’s fused query–key–value projection so both architectures adapt the same six module types with 8,114,176 parameters.The split model’s logits match the fused model’s, and global-norm clipping prevents the split from changing an update.Source: §A.1 · p. 19, Table A1 · p. 19

A.2 Prompts

• Generative cells use a fixed scaffold with prompts fitted to 128 tokens; reason targets come from the 8B, while prompted 8B cells use specified output contracts.Reason prompts ask for a one-sentence justification of a human label, not a new label decision.Source: §A.2 · p. 20

A.3 What the harness refuses

• The harness refuses configurations that could confound comparisons, including unmatched adapter modules, evaluation overlap with training, and excessive generation-cap hits.It also checks split loading and training budgets, tokenization, and that both arms of a seed run on one machine.Source: §A.3 · pp. 20–21

A.4 Run records and determinism

• Run records capture environment and configuration details, and result tables are regenerated from records and independently recomputed from per-item predictions.Default-kernel training is not bit-reproducible at a fixed seed; reruns reproduce distributions rather than exact numbers.Source: §A.4 · p. 21

A.5 Compute

• 109 GPU-hours and $88.60 covered the work from GPU pilots through follow-ups; main-experiment training used 45.1 hours.The runs used rented RTX 4090s, one GPU per run.Source: §A.5 · p. 21, Table A3 · p. 22

B.1 Aegis 2.0

• Under the Ettin tokenizer, Aegis 2.0 has human-assigned safe/unsafe labels on every prompt row; this study classifies prompts, not responses, and 6.8% exceed the 256-token head-cell input limit.Source: §B.1 · pp. 22–23
• 990 redacted Aegis rows were dropped, and test deduplication against training left 1,709 rows; the models train on the released split as used.The released training files include a refusal augmentation that shifts the training balance from 50.7% to 59.1% unsafe, against 52.8% in the deduplicated test split.Source: §B.1 · pp. 22–23, Table B1 · p. 22

B.2 Out-of-distribution corpora

• The out-of-distribution corpora were drawn once at seed 42 and scored in the same row order across cells and seeds.WildJailbreak includes four quadrants; its in-the-wild corpus marks shared jailbreak templates, not harmfulness, so its reported flag rate is not a content-harm claim.Source: §B.2 · p. 23, Table B2 · p. 23

B.3 Example rows

• The example rows illustrate the varied prompts and labels represented across Aegis 2.0, WildJailbreak, OR-Bench, ToxicChat, and the in-the-wild corpus.Examples include safe and unsafe Aegis prompts, benign and harmful WildJailbreak prompts, and toxic/non-toxic ToxicChat prompts.Source: §B.3 · pp. 23–24

B.4 The reasons corpus

• The verdict-plus-reason target contains one generated sentence for each of 29,095 usable Aegis training prompts.Ministral 3 8B Instruct generated the reasons; a fixed content-free sentence replaces them in a control condition.Source: §B.4 · p. 24

Appendix C: The pre-specification record

• The appendix records frozen analysis plans, corrections, post hoc analyses, and the transport-analysis instrument alongside additional results.Plans were frozen by recording their SHA-256 hashes; the ±2 pp equivalence margin was fixed before any run.Source: Appendix C · p. 24, §C.1 · p. 24

C.1 The plans

• The plan table covers the 13 cells of Table 2, while follow-up plans were written after the initial results and frozen before their own runs.S3 described means already reported and therefore named no pattern in advance.Source: §C.1 · p. 24, Table C1 · p. 25

C.2 Corrections after the freeze

• Twenty-six errata were recorded against nine plans, and one configuration defect was found after the main experiment’s runs.The appendix groups corrections by their effect on reported results.Source: §C.2 · p. 25, Table C2 · p. 26

C.3 Analyses added after the data

• The post hoc analyses were computed after the results they use were known and are labeled accordingly.The corrections in this section changed text, not the analysis.Source: §C.3 · p. 26, Table C3 · p. 27

C.4 The repackaging instrument

• The transport analysis fixed its input perturbations before runs, testing eight combinations of whitespace and wrapping changes that preserve token meaning.Uppercasing was a separate condition because it changes tokenization and reads as shouting; Family A is not reported.Source: §C.4 · p. 27

C.5 The released plans

• The released plans include a manifest that records each frozen-file hash, released-file hash, and every changed line; only internal references changed..Source: §C.5 · p. 27

Appendix D: Additional results

• The appendix supplies results across training budgets, learning-rate searches, seed-level gaps, input-writing robustness, reason coherence, and out-of-distribution evaluation.It also includes per-seed scores and results from two harness versions.Source: Appendix D · p. 27

D.1 Results at every training budget

• At or above about 750 optimiser steps, label-only full-fine-tuning contrasts remain positive, between +1.70 and +2.92 pp, with no architecture changing sign across budgets.Every trained cell scores higher at the final budget than at 12,000 rows; the architecture gap narrows from 7.37 pp at 4,000 rows to 3.86 pp at the final budget.Source: §D.1 · pp. 27–28, Table D1 · p. 28

D.2 Learning rates

• The earlier encoder-only LoRA rate search scored the test split, so it is a probe rather than a selection; its best rate scored 1.34 pp above the original cell.For decoder LoRA, halving the verdict-only rate raised score by 1.67 pp, while doubling it lowered score by 5.82 pp; the reason cell was not retrained.Source: §D.2 · pp. 28–29, Table D2 · p. 29

D.3 How LoRA’s gap is distributed over seeds

• 76–95% of each observed regime gap survives trimming a fifth of seeds from each end, and 10 of 15 encoder LoRA seeds score below full fine-tuning’s lowest seed.The typical LoRA run is lower, with a low tail on top; at selected rates every LoRA seed lies within 1 pp of full fine-tuning’s median.Source: §D.3 · pp. 29–30, Table D3 · p. 30

D.4 Repackaging and uppercasing the input

• Across eight repackagings, no contrast’s observed SD exceeds 0.64 pp; uppercasing costs every trained cell 8–23 pp in-domain and changes regime and architecture gaps.The encoder regime gap widens from 2.06 to 6.25 pp, while the architecture gap widens from 3.86 to 17.63 pp.Source: §D.4 · pp. 30–31, Table D4 · p. 30

D.5 Do the generated reasons agree with their verdicts?

• A classifier reading generated reasons with label-name words masked recovers the model’s own in-domain verdict at 97.6% for LoRA and 97.4% for full fine-tuning.The prompted 8B’s reasons score 97.5%; the classifier fits the model’s own verdict, so a coherent reason for a wrong verdict still counts as coherent.Source: §D.5 · p. 31
• Models trained on reassigned reasons write templates rather than prompt-specific reasons, so their test-time outputs do not show how the training signal shaped them.Within-label reassignment yields one distinct reason per 23 prompts; label-agnostic reassignment yields one per 100, with at least 94% appearing under the other verdict too.Source: §D.5 · p. 31

D.6 Out of distribution

• Out-of-distribution seed SDs exceed in-domain SDs, reaching 8.8–19.6 pp for over-refusal, so one run poorly estimates a cell’s rate.Table D5(a) reports the out-of-distribution seed SDs at the final budget.Source: §D.6 · pp. 31–32, Table D5 · p. 32
• Every head cell ranks prompts worse than the prompted 8B on the three content-safety corpora, but as well or better on forum prompts.The ROC-AUC intervals are floors because the 8B’s prompt-template sensitivity was not measured for AUC.Source: §D.6 · pp. 31–32
• The prompted 8B fails to name a label on 2.6% of in-domain prompts and 12.1% of forum prompts, while 81% of WildJailbreak adversarial harmful prompts exceed the trained generative cells’ 128-token input limit.Across length slices, truncation changes the reason target’s effect on missed harmful prompts by under 4 pp, against intervals 34–38 pp wide.Source: §D.6 · pp. 31–32
• On WildJailbreak, head cells trail the prompted 8B by 8.13–23.19 pp, while their OR-Bench benign over-refusal excesses range from 24.48 to 59.08 pp.On ToxicChat, head-cell differences from the 8B range from +2.17 to −4.75 pp; the fully fine-tuned encoder flags the fewest OR-Bench benign prompts among head cells.Source: §D.6 · pp. 31–32, Table D5 · p. 32

D.7 Per-seed scores

• Full fine-tuning’s 15 encoder seeds range from 83.90% to 85.17%; LoRA’s seeds 43, 56, and 48 account for most of its spread, and none is excluded.Table D6 reports per-seed in-domain balanced accuracy at the final budget.Source: §D.7 · p. 33, Table D6 · p. 33

D.8 The two harness versions

• A uniform harness-version shift of 0.15 pp could change the fixed-sentence outcome, while LoRA rerun checks resolve only shifts more than ten times the tested comparison thresholds.The harness versions leave training unchanged, but the exact-match rerun check covers full fine-tuning only.Source: §D.8 · p. 33