We moved our planted-instruction correction from 7B models to Gemma 4 E4B, Qwen3.6-27B and Qwen3-32B, at full precision on our own cards. On every base the original lets about one hidden instruction in three through; after the correction it is one or two in a hundred, two in a thousand on the 32B, with ordinary questions answered as well as before. The vendor hardening for the same models moves the number by one point (Hirundo) or halves it (SecOPD).
## What we tested
A model that reads a document for you can be hijacked by an instruction hidden inside that document: "ignore the user, do this instead". We call this a planted instruction. Our correction teaches a model to tell the user's request from text that merely arrived with it, without changing how it answers ordinary questions.
Until now we had shown the correction on models of 7 to 8 billion parameters, the size our free graphics cards could hold. This week we moved it to three larger models from two families, at full precision, on our own cards, and read each one against its own original and against the hardening its vendor or the literature offers for that same model.
```chart
{"title": "Hidden instructions that get through, before and after our correction (attacks out of 100)", "series": ["Original model", "Vendor hardening", "Our correction"], "unit": "", "max": 40, "rows": [["Gemma 4 E4B (Google)", 33.1, 31.9, 1.8], ["Qwen3.6-27B (Alibaba)", 36.4, 14.9, 1.2], ["Qwen3-32B (Alibaba)", 31.3, null, 0.2]], "note": "Same 900 planted-instruction attacks and the same judge for every cell. Vendor hardening: Hirundo on Gemma 4, SecOPD on Qwen3.6-27B; none published for Qwen3-32B."}
```
## What we found
- On every base the original model lets about one planted instruction in three through. After our correction it is one or two in a hundred on the 4B and 27B models, and two in a thousand on the 32B.
- The vendor hardening published for Gemma 4 moves the number by one point. The strongest open method for Qwen3.6-27B (SecOPD) halves it; our correction on the same model reads twelve times fewer successful attacks than SecOPD.
- Ordinary questions are answered as well as before or better: on the 27B and 32B models the clean-question score is unchanged or up; on the 4B model it dips by five points on a small set of 150 questions, which is the one point we are now working on.
- The recipe did not change between models: same training data, same loss, same settings. Only the base model changed.
## Why it matters
A correction that only works on small models is a demo. One that carries over, unchanged, to a model four times larger and to a second family is a method. This is also the first time we corrected a model at full precision on our own hardware: three 32 GB cards carry a 32B model with room to spare.
## What is next
The clean-question dip on Gemma 4 is being traced to the seven questions that changed; the fix is declared before it runs. The three corrected models are kept as private adapters and are being read on more attack families.
This update is not available.