Where did Controversial go?

Qwen3Guard-Gen-0.6B emits three severity values. Three LoRA fine-tunes were trained on it, varying only which projections the adapter touches. All three emit two.

Attention-only and MLP-only are disjoint families of projections, and each is independently sufficient to destroy the class. So the loss is not attributable to a module family. The cause is the training target: the corpus renders Safety: as a boolean, and ~11,272 gradient updates teach a two-valued field.

Why this matters more than the recall column

A policy control of the form Controversial = SAFE becomes a silent no-op on every one of these models. It reads as configured and governs nothing — the same defect class as a bound that reads enforced and is observed.

The attention-only arm has the highest recall in the programme and is the worst model in it: the gain is substantially bought with false positives, and it has lost an output class. A model that scores better on the headline metric is not the same instrument.