A single, scannable page for every tunable setting in SafeTune: the process-wide
safetune.configure() runtime settings, the parameters every trainer in a pillar
shares, and a quick-reference table for all 75 methods across Harden, Recover,
Unlearn, and Steer. Each method's row links to its full write-up — signature,
worked example, "when to use," and citation — in the User Guide;
this page exists so you can compare parameters across methods without opening
75 separate pages, and so the runtime settings (which don't live on any one
method's page) get documented field-by-field in one place.
Default is the value if you never pass that keyword argument.
Every trainer's constructor also accepts model, and Harden/Steer additionally
tokenizer — these are omitted from the per-method tables below since they're
identical everywhere; see Shared parameters.
safetune.configure(**settings) sets process-wide settings (RuntimeConfig);
safetune.get_config() reads them back. Resolution order everywhere a setting is
consulted: an explicit function/trainer argument wins over configure() (or a
YAML config's runtime: block), which wins over a SAFETUNE_* environment
variable, which wins over the hard default below. An unrecognized setting name
raises TypeError (with a "did you mean" suggestion).
Max new tokens generated per response in trainer.evaluate()'s safety benchmarks, the standalone evaluate(), and generate_responses(). The main lever on evaluation wall-clock time.
advbench_max_new_tokens
128
Same, for the AdvBench generation inside trainer.evaluate().
steer_max_new_tokens
256
Generation length for Steer's eval_live() / eval_vllm().
forget_max_new_tokens
256
Generation length when building a HarmBench-sourced forget set from a drifted model's own completions.
Batch size for the plain HF generation paths: evaluate(), generate_responses(), forget-set generation.
steer_batch_size
4
Batch size for Steer's eval_live().
lm_eval_batch_size
None
Resolves to "4" on the "hf" backend or "auto" on vLLM.
max_prompts
None (every prompt)
Per-benchmark prompt cap for the safety suite — the main lever for a faster evaluation pass during development.
eval_limit
None (env SAFETUNE_EVAL_LIMIT, every example)
The lm-eval --limit flag — caps how many examples each utility benchmark (gsm8k, humaneval, mbpp, wikitext, ifeval, ...) scores, independent of max_prompts (which only caps the safety benches).
harden_data_n
256
Size of the contamination/refusal sets several Harden methods build automatically when no explicit safety_dataset/harmful_dataset is passed.
calib_n
256
Prompts per side (harmful/harmless) for Recover and Steer's default calibration sets.
max_len
None
Training tokenization length used by the CLI and several methods' auto-built datasets. None sizes it from the chat template for QA-shaped data, or 256 for fixed-length paths.
Fraction of GPU memory vLLM reserves up front. None lets each call site use its own default; set this explicitly to share a GPU with other workloads.
max_model_len
4096
vLLM's max context length.
tensor_parallel_size
1
vLLM tensor-parallel degree — raise this on a multi-GPU host to split a large model's weights across GPUs.
lm_eval_timeout
7200 (2 hours)
Wall-clock timeout per lm-eval task group (there are up to three — chat, code, wiki — so a full eval_utility() call can run for several times this). Sized for a complete, unhurried audit; lower it for faster-failing evaluation during development.
Per-judge overrides (e.g. {"orbench": {"max_model_len": 4096}}), merged over the built-in judge registry.
advbench_refusal_prefixes
the built-in refusal-phrase tuple
The phrases advbench_scorer="prefix" looks for at the start of a response. Replace the tuple to count other refusal wording.
advbench_scorer
"prefix"
"prefix": the response (minus any <think> block) starts with a standard refusal phrase. "gcg": a looser match — any of a 29-phrase GCG test set appears anywhere in the response.
orbench_in_safety_mean
False
False: OR-Bench's over-refusal and toxic splits are reported separately and safety_mean() only averages genuine harm benchmarks. True: a single combined OR-Bench score is averaged into safety_mean with the rest.
eval_strict
True
True: evaluate() and every trainer's .evaluate() raise when a benchmark fails to load, generate, or score. False: that benchmark's metrics are recorded as an error entry and the run continues with the rest — useful when a gated benchmark shouldn't block an otherwise-successful run.
A small set of legacy_* settings restore specific behavior from before a
correctness fix, for reproducing results generated on an earlier version. All
default to False.
Setting
True restores
legacy_beavertails_splits
TAR's adversary set as unsafe[n:2n], which overlaps the contamination set
legacy_steer_layers
Steer layer defaults as fixed absolute indices, instead of scaling proportionally to model depth
legacy_cast_gate
CAST's gate fitted on raw prompts, with the first prompt of a batch deciding for the whole batch
legacy_spectral_monitor
SpectralEntropyMonitor computed on raw prompts, including the attention-sink token in the SVD
configure(datasets={"harmbench": "./my_file.jsonl"}) points a built-in dataset
short name at another source — an HF id, a local .jsonl/.json/.csv/.parquet
file or directory, or a URL. Every loader that reads that name then reads the
override. Pass datasets=None to clear back to the built-in sources. See
Benchmarks for the full dataset list.
None on both derives precision from the runtime (dtype="auto").
wandb
False
Enables Weights & Biases reporting on the underlying training run.
optimizer
"adamw_torch"
Any optimizer name HF TrainingArguments.optim accepts.
logging_steps
10
Training-progress logging frequency.
drift_task
None
The capability-anchor domain (e.g. "gsm8k") used when .evaluate() is called without an explicit domain=.
Verb: .train(train_dataset, out_dir=None, **kwargs) -> str (returns the
checkpoint path). Every method also accepts dataset_config=, dataset_split=,
safety_dataset_config=, safety_dataset_split=, letting train_dataset/
safety_dataset be a source string (HF id, local file, dataset folder) instead
of a pre-tokenized Dataset — see
Data Selection.
No tokenizer, no training hyperparameters — Recover is weight-space and
training-free for every method except SCRUBTrainer. Verb:
.apply(**kwargs) -> model (mutates self.model in place and/or returns a new
model object; call .save_checkpoint(...) separately to write it to disk).
.evaluate(model_or_path, domain=) accepts either a path or a live model object.
Trains fp16/bf16 model weights in fp32 for the duration of unlearning. The unlearn loops step a plain optimizer directly on the model's weights, and low-precision training there can silently produce little or no change in the model. Set False only to save memory once you've confirmed results still hold for your case.
Verb: .unlearn(forget, retain, **kwargs) -> model — returns a model object
with no automatic checkpoint save, so call .save_checkpoint(model, tokenizer, name) -> path
yourself afterward. forget/retain accept a tokenized HF Dataset, a
DataLoader, or a plain list of {input_ids, attention_mask, labels} batches.
Every method automatically checks the model's weights after unlearning and
raises if any became invalid, so an unstable run surfaces immediately rather
than producing a silently broken checkpoint.
Verb: .calibrate(harmful=None, harmless=None, *, calib_n=None, out_dir=None, **kwargs),
which returns (wrapped_model, out_dir). The 4 decoding-steering methods
additionally expose a public make_processor(...), whose result passes
directly to HF generate(logits_processor=[...]).
sppft_mode="freeze" (passed as a keyword argument)
sppft_mode: "freeze" (default) freezes the identified safety-layer parameters during fine-tuning; "scale" reduces their learning rate instead of freezing them outright.
Trains one checkpoint to serve two system-prompt behaviors via preference optimization; builds its training pairs from the harden contamination set automatically.
Anchors the fine-tune close to the original aligned weights. Set aligned_model_path for the regularization to take effect — it is the reference the method keeps the fine-tune close to.
Joint refusal-reward and preference training. Trains from contamination and refusal data directly rather than a task dataset — train_dataset is not used.
Co-evolves an adversarial model against the target during training. adv_model defaults to a copy of the target if not supplied; trains from seed_prompts and a reward signal rather than a task dataset.
Trains a refusal direction under ablation and distills it into LoRA weights, computing the direction internally from a harmful/harmless prompt contrast.
Pre-extrapolates the base model's weights away from the region fine-tuning tends to erode, before training starts. Set aligned_model_path for the extrapolation to take effect.
Full guide: Recover overview. Most methods need
base_model=/aligned_model= — already-loaded model objects, not paths (the
exception is AAQTrainer, which takes path/HF-id strings). A number of methods
work from calibration prompts instead and need no reference model (noted per row).
A short gradient patch restricted to the most salient weights, derived from a single harmful/safe example pair — the lightest-weight method in this pillar.
Applies the safety delta only at weight locations identified by a CircuitInfo object from the Interpret pillar's safety_circuit_info() — zero collateral change to weights outside the identified circuit.
Steers a chosen layer's activations toward a fixed random vector on forget data while anchoring retain-data activations to a frozen reference — trains only a few early layers' MLP weights, far fewer parameters than full-model unlearning. Note: constructing the lower-level RMUConfig directly uses alpha=100.0 by default; RMUTrainer's own default is 1200.0.
Full guide: Steer overview. Steer is inference-time
only — no weight changes, so there's no .train()/.apply()/.unlearn() here,
only .calibrate() (see Shared parameters).
Conditional activation steering. per_prompt_gate (default: on) gates and steers each prompt of a batch independently rather than letting one prompt's gate decide for the whole batch.
AdaSteerTrainer
alpha=15.0, layers=None
Adapts steering strength per input rather than applying a fixed strength uniformly.
SafeSwitchTrainer
gate_layer=None, threshold=0.5
Trains a small safety classifier to gate generation at a chosen layer.
When you're integrating SafeTune into a build or deployment pipeline, you want
to confirm a method runs correctly — real generation, real scoring — without
waiting for a full evaluation pass on every test run. Scale the safety suite
down for development, then run it at full scale for your actual pre-release
audit.
importsafetunefromsafetune.runnerimportharden# Development: cap prompts and generation length for a fast pass.safetune.configure(max_prompts=20,eval_limit=20,safety_max_new_tokens=64)trainer=harden.SafeGradTrainer(model,tokenizer)before=trainer.evaluate(base_model_id,domain="support")out_dir=trainer.train(train_dataset,out_dir="./dev_run")after=trainer.evaluate(out_dir,domain="support")
# Pre-release: reset to the full, unbounded defaults for the real audit.safetune.configure(max_prompts=None,eval_limit=None,safety_max_new_tokens=512)
A customer-facing model has been fine-tuned on new support data and safety
evaluation shows it has drifted — it now complies with requests it previously
refused. Retraining isn't an option on the current release schedule, so the
team repairs the deployed checkpoint directly.
Start with TaskArithmeticTrainer and sweep alpha against your evaluation
suite before moving to a more targeted method — it has the fewest moving parts
and the fastest turnaround for a first repair.
Removing a specific capability without a broader safety pass¶
A model fine-tuned on internal support transcripts picked up a tendency to
give specific regulated financial guidance it isn't authorized to give, while
the rest of its behavior is unaffected. The goal is to remove that one
capability precisely, not to run a general safety repair.
RMUTrainer trains the fewest parameters of the methods in this pillar, which
makes it the first one to try and the easiest to evaluate and roll back.
GradientAscentTrainer and NPOTrainer go further and train more of the
model if RMUTrainer doesn't suppress the target capability enough — check
both the forget-set score and the retained utility metrics before escalating.