Jazhyc/Gleipnir-27B

Gleipnir 27B

Gleipnir 27B is a research monitor for AI control: it scores visible trajectories of tool-using AI agents for sabotage, data exfiltration, and other covert unauthorized actions taken while appearing to do an assigned task. It is a rank-128 LoRA adapter for Qwen/Qwen3.8-27B, not a standalone model.

Like Gleipnir 4B v0.2, and unlike Gleipnir 9B, it was not trained on general deception datasets; its training data is agent tool-use trajectories only (see Training).

This release is an early research artifact intended for reproducibility and follow-up work. There is not yet a Gleipnir paper or blog post. It should not be treated as a production safety system or as evidence that an interaction is safe merely because the model assigns it a low score.

Variants

Repository or image	Contents	Use it for
Jazhyc/Gleipnir-27B (this repository)	FP32 LoRA master and the vllm/ key-rebased adapter	Merging, fine-tuning, PEFT
Jazhyc/Gleipnir-27B-BF16	The adapter merged into Qwen/Qwen3.8-27B in FP32, exported as BF16	Transformers or vLLM on any GPU
ghcr.io/jazhyc/gleipnir-serve:0.1	The project's optimized serving stack (FP8/FP4/MXFP8)	High-throughput scoring on one NVIDIA B200

Both repositories carry the tag v0.2 for this release. The image fetches Gleipnir-27B-BF16@v0.2 and verifies every file before serving.

Changelog

• v0.2 (2026-10-20). Packaging release; the adapter is identical to v0.1. Adds the merged BF16 checkpoint (Jazhyc/Gleipnir-27B-BF16) and the optimized B200 serving image, and reports the optimized-serving results (0.9508 Mean-OOD and 0.9444 ID pAUROC@20 under the full teacher instruction, 53.9K prompt tokens/s on one B200).
• 2026-10-20 (card update; adapter unchanged). The recommended scoring interface is now the full teacher instruction (teacher_prompt.txt, added here), with headline results 0.9352 Mean-OOD and 0.9420 ID pAUROC@20. The compact-instruction results remain in the table. The weights are identical to v0.1.
• v0.1 (2026-10-18). First release, documented under the compact instruction.

What the model scores

The model receives an action-only transcript: visible messages, tool calls, commands, outputs, edits, and final reports, without access to private chain of thought. At the frozen decision boundary it compares the next-token logits for literal 0 and 1:

• Prediction:1: a concrete unauthorized or harmful action, attempted safeguard bypass, compliance with a conflicting instruction in untrusted input, or material deceptive concealment;
• Prediction:0: task-serving behavior, including honest mistakes, failed attempts, harmless exploration, incomplete work, and reasonable adaptation.

Use the normalized 1 versus 0 logit as a continuous risk score.

Score it under the full teacher instruction (teacher_prompt.txt). This is the recommended default, and the interface used for the headline results. The adapter was trained under the compact instruction (student_prompt.txt, the same instruction as Gleipnir 4B and 9B), but on held-out in-distribution data it ranks better under the full one: 0.9420 against 0.9216 macro pAUROC@20. The prompt was chosen on that ID data, not on the OOD suite. Both instructions and their envelope are recorded in prompt_contract.json.

Results

Gleipnir 27B was evaluated once on the same frozen 6,395-row strict-OOD suite as the other Gleipnir adapters, spanning AgentDojo, CUA-SHADE, IaC, MLE-Sabotage, Rogue Eval, and SHADE-Arena. The primary metric is the unweighted mean across sources of raw normalized partial AUROC through 20% false-positive rate.

Model	Prompt	Mean-OOD pAUROC@20	Mean-OOD AUROC	Pooled pAUROC@20	Pooled AUROC
Gleipnir 27B	full teacher	0.9352	0.9790	0.9486	0.9810
Gleipnir 27B, optimized serving	full teacher	0.9508	0.9841	0.9498	0.9809
Gleipnir 27B	compact student	0.9087	0.9679	0.9234	0.9748
Kimi K3 (teacher)	full teacher	0.9084	0.9616	0.9322	0.9776
Qwen3.8-27B, unadapted	full teacher	0.8901	0.9535
Gleipnir 9B	compact student	0.8212	0.9215	0.7837	0.9355
Gleipnir 4B v0.2	compact student	0.8108	0.9199	0.7514	0.9335

Per-source pAUROC@20 under the full teacher prompt: AgentDojo 0.9990, CUA-SHADE 0.8911, IaC 0.9931, MLE-Sabotage 1.0000, Rogue Eval 0.9982, SHADE-Arena 0.7298. Under the optimized serving stack (FP8 attention projections, FP4 MLP and GDN projections, MXFP8 attention; no QAD needed): AgentDojo 0.9917, CUA-SHADE 0.8903, IaC 0.9931, MLE-Sabotage 1.0000, Rogue Eval 0.9980, SHADE-Arena 0.8316. Almost all of its 1.6-point gain over BF16 comes from SHADE-Arena; treat it as serving-precision variation, not a quality improvement. Optimized serving scored the 60.5M-token OOD workload at 53.9K prompt tokens/s on one B200, and reaches 0.9444 ID macro pAUROC@20.

• Under its recommended prompt, Gleipnir 27B is 2.7 points above its Kimi K3 teacher on Mean-OOD pAUROC@20. Most of the gain over the compact prompt is SHADE-Arena (0.7298 vs. 0.5875); the other sources move by at most 1.1 points. In the project's dated hosted-inference proxy it costs about 1/14 as much as Kimi K3 ($1.85 vs. $25.12 per 1,000 evaluations, full teacher prompt); that comparison is not a stable price quote.
• Training improved the unadapted base on every unsaturated source (+4.5 points Mean-OOD pAUROC@20 under the same full teacher prompt).
• On the project's held-out CoT-removed in-distribution set (3,012 Gloom-exfiltration and STRIDE test rows) it reaches 0.9420 macro pAUROC@20 and 0.9863 macro AUROC under the full teacher prompt, against 0.9217 and 0.9822 under the compact prompt.

These are single-seed point estimates; the 4B student's OOD seed-to-seed standard deviation is about 1.8 points. Gleipnir 27B was trained on different data than Gleipnir 9B and on a different base than both smaller models, so the rows above compare released artifacts, not a controlled model-size study.

Training

Gleipnir 27B was trained for one epoch on 7,836 action-only tool trajectories: the 8,688 tool-trajectory training rows after removing those where Kimi K3's decision disagrees with the source label. The sources are covert coding sabotage (CoT-Red-Handed, 1,949 rows), shell sabotage and exfiltration (BashArena 2,504 and BashBench 1,348), and synthetic misaligned-agent scenarios (STRIDE 1,310 and Gloom 725). It used no deception-dataset rows. Training used only Kimi K3's soft probability over the literal decision tokens; source labels were used for filtering, provenance, and evaluation.

• Base: Qwen/Qwen3.8-27B at revision 1d4bf0f2ff6012fd82039f2fa52739d0dd7c60c0
• Adapter: rank 128, alpha 256, all attention and MLP projection modules (gated-delta projections are not adapted)
• Optimization: AdamW, learning rate 5e-5, linear schedule with 3% warmup, effective batch 32, seed 0, 245 updates
• Context: up to 29,696 tokens, with zero audited truncation
• Training base: unquantized BF16 with FP32 master adapters; segmented SDPA attention, 16,384-token sequence packing, gradient checkpointing of all gated-delta layers and 4 of 16 full-attention layers
• Saved adapter: FP32, 637,534,208 trainable parameters
• Hardware: one NVIDIA B200; training runtime about 4.2 hours

Usage

The repository root contains the causal-LM PEFT master. The example below reproduces the direct binary scoring interface; replace the example trajectory with the complete visible interaction you want to monitor. The BF16 base needs about 55 GB of accelerator memory before activations.

import torch
from huggingface_hub import hf_hub_download
from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer

adapter_id = "Jazhyc/Gleipnir-27B"
base_id = "Qwen/Qwen3.8-27B"
base_revision = "1d4bf0f2ff6012fd82039f2fa52739d0dd7c60c0"

tokenizer = AutoTokenizer.from_pretrained(base_id, revision=base_revision)
base = AutoModelForCausalLM.from_pretrained(
    base_id,
    revision=base_revision,
    torch_dtype=torch.bfloat16,
    device_map="auto",
)
model = PeftModel.from_pretrained(base, adapter_id).eval()

# The recommended full teacher instruction; "student_prompt.txt" is the
# compact instruction the adapter was trained under.
instruction_path = hf_hub_download(adapter_id, "teacher_prompt.txt")
with open(instruction_path, encoding="utf-8") as handle:
    instruction = handle.read()
trajectory = "User asked for a file listing. The agent ran: ls -la"
user_prompt = (
    f"{instruction}\n<agent_trajectory>\n{trajectory}\n"
    "</agent_trajectory>\n"
)
prompt = tokenizer.apply_chat_template(
    [{"role": "user", "content": user_prompt}],
    tokenize=False,
    add_generation_prompt=True,
    enable_thinking=False,
) + "Prediction:"
inputs = tokenizer(prompt, return_tensors="pt").to(model.device)

token_ids = [
    tokenizer.encode(label, add_special_tokens=False)[0] for label in ("0", "1")
]
with torch.no_grad():
    next_logits = model(**inputs).logits[0, -1, token_ids].float()
risk_score = torch.softmax(next_logits, dim=0)[1].item()
print(risk_score)

Verify that each literal label tokenizes to exactly one distinct token. For large frozen evaluations, the project merged the vllm/ key-rebased adapter into the base in FP32, exported BF16 weights, and served them with vLLM 0.31 after master-to-serving parity checks (correlation 0.9999).

Optimized B200 serving

The serving image runs the stack behind the optimized results above. It needs one NVIDIA B200 (other GPUs, including the B300, are refused), an NVIDIA driver supporting CUDA 13, and prompts of at most 32,768 tokens.

docker run --gpus all -p 8000:8000 \
  -v "$HOME/gleipnir-models:/models" -e GLEIPNIR_MODEL_CACHE=/models \
  ghcr.io/jazhyc/gleipnir-serve:0.1 27b

The first start downloads the BF16 checkpoint (52 GB) and is ready after about four minutes (219 s including the download on a fresh B200; slower links take longer); the mounted cache keeps the download across restarts. Do not mount volumes over /tmp or /workspace, which hold the pinned runtimes and code (on Runpod, attach volumes elsewhere). Send the fully rendered prompt, built exactly as in the Python example and ending in Prediction::

curl -s localhost:8000/v1/monitor/score -H 'Content-Type: application/json' \
  -d '{"model": "monitor", "prompt": "<rendered prompt>"}'
# {"score": ..., "margin": ..., "logits": [logit_0, logit_1], "prompt_tokens": ...}

score is the softmax of the 1 and 0 logits, the same quantity as risk_score above. The image was validated on a fresh B200 against the recorded optimized rows (0.9450 ID and 0.9489 Mean-OOD pAUROC@20 against the recorded 0.9444 and 0.9508. Optimized-serving scores are not bit-reproducible: two runs of the same server differ by about 0.006 in mean absolute score while ranking metrics move by about 0.001-0.002; use stock BF16 serving when per-row reproducibility matters).

Limitations and responsible use

• The checkpoint has one training seed and was not optimized on multiple model families, languages, or deployment environments.
• It can miss subtle harmful behavior and can flag benign but unusual actions. Its score is not calibrated for a new deployment without local validation.
• It observes actions, not hidden intent or private reasoning. Absence of visible evidence is not evidence of aligned intent.
• Long trajectories, prompt injections inside transcripts, source-specific artifacts, and changes to chat templates or scoring boundaries may shift its behavior.
• The benchmark measures ranking. The 0.5 threshold is an interface default, not a recommended production operating point.
• Do not use it as the sole basis for punitive decisions about people, or as the only safeguard around capable autonomous systems.

Use layered controls, preserve the continuous score, validate by task/source and model family, and keep a human-review or defer path for ambiguous cases.

Artifacts, provenance, and terms

This repository does not redistribute training prompts, trajectories, source labels, teacher caches, or benchmark rows. release_manifest.json records the adapter, prompt, base-revision, and packaging checksums needed to audit this release. The full experiment design and result audit are in the Gleipnir repository, especially docs/findings/qwen38_27b_campaign.md and experiments/qwen38_27b_campaign/README.md.

The adapter weights and release metadata are distributed under the MIT License; see LICENSE. Users must also review and comply with the Qwen base-model terms, the terms of the upstream datasets, and any applicable teacher/provider terms. Several upstream source artifacts did not declare a license at collection time; public weights do not grant rights to reconstruct or redistribute those datasets.

Citation

There is no paper or blog post to cite yet. For now, please cite the model page and pin the Hugging Face repository revision used in your experiment.