Representation Engineering & Adversarial Testing
A work student's manual security exploration surfaced open ports, misconfigured API keys, and permissive service behaviors across the stack. The report he left was what motivated building a proper adversarial testing layer, one that could find the same class of vulnerabilities continuously rather than during a one-time exercise.
The project runs Representation Engineering on Meta's Llama 3 8B. RepEng computes the principal component separating paired activation distributions, one set eliciting a target behavior and one suppressing it, then applies that direction vector to the residual stream during inference. The output is a model with its refusal direction suppressed.
A spare RTX 3090 became the deployment target. Llama 3 8B in bf16 fits within its 24GB VRAM with inference latency low enough for continuous pipeline operation. Open weights make layer-wise activation extraction straightforward. Hugging Face Transformers handles the hook system. The RepEng library handles PCA decomposition and vector projection.
Worth noting from the research: the refusal direction in Llama 3 8B is a low-dimensional feature. A single principal component captures the majority of variance between compliant and non-compliant activations, concentrated in mid-to-late transformer layers.
Key decisions
| Decision | Chosen | Why |
|---|---|---|
| Core methodology | Representation Engineering | Computes principal components from paired prompt activations to steer behavior via the residual stream. Non-destructive, reversible, and computationally efficient on limited hardware. |
| Model | Meta Llama 3 8B | Fully open-source with weights accessible for layer-wise activation extraction. Fits within a 24GB VRAM footprint in full bf16 precision. |
| Hardware | Single NVIDIA RTX 3090 | Avoids multi-GPU clusters. bf16 precision keeps inference latency low enough for continuous pipeline operation. |
| Activation hooks | Hugging Face Transformers | Native hook system extracts intermediate layer outputs across all 32 transformer layers without full retraining. |
| Vector extraction | RepEng PCA implementation | Contrastive pairs isolate low-dimensional refusal vectors within mid-to-late layers. |
| Pipeline target | Active infrastructure red teaming | Steered model probes API endpoints, simulates adversary reconnaissance, and surfaces tech stack misconfigurations. |
Milestones
- Phase 1 (Sep – Oct 2025) Linux/CUDA environment setup, Hugging Face hooks configured, layer-wise baseline activation extraction on Llama 3 8B completed.
- Phase 2 (Nov – Dec 2025) Contrastive paired prompt datasets constructed, PCA decomposition via RepEng, low-dimensional refusal direction vector isolated.
- Phase 3 (Jan 2026) Steered model deployed as an automated agent within the internal security pipeline.
- Phase 4 (Feb 2026 – present) Continuous infrastructure scanning, configuration loopholes mapped directly to internal remediation backlog.