Declare Apache-2.0 licence

README.md

@@ -1,214 +1,218 @@
-> [!CAUTION]
-> **Known defect found 2026-10-04:** the v1 and v2 fine-tunes emit the literal
-> two-character sequence `\n` instead of real newlines, so their Python output fails
-> `ast.parse` (base model 93.3% valid Python, v2 0.0%). Cause: several datasets in the
-> training mix store message text JSON-escaped (183/480 sampled rows).
->
-> **Fixed here** in `train_securecoder.py` via `_unescape_if_needed()` + a `repaired=`
-> counter per source. The broken merged/GGUF repos were deleted; both adapters are kept
-> for reproducibility. Full write-up and the exact retrain command: see `HANDOFF.md`.
->
-> Also fixed: a UTF-8 BOM before `# /// script` meant uv never installed the declared
-> dependencies, so every job died in seconds with `No module named 'torch'`.
-
-# SecureCoder — training runbook
-
-A QLoRA fine-tune that targets three skills at once: **coding**, **tool calling**
-and **cybersecurity** (offence *and* defence), on a base chosen to train cheaply
-and run fast. Everything here is measured or verified on real jobs, not assumed —
-each claim carries the job id you can inspect.
-
-## 1. Base model choice
-
-Screened on the Hub on 2026-09-24 (params / licence / tool-calling support):
-
-| Candidate | Params | Licence | Verdict |
-| --- | --- | --- | --- |
-| **`Qwen/Qwen3-Coder-30B-A3B-Instruct`** | 30.5B MoE, ~3B active | Apache-2.0 | **chosen** — code-specialised, native tool-calling template, MoE means it *trains* like a 3B model and fits 48 GB in 4-bit |
-| `Qwen/Qwen3.8-27B` | 27.8B dense | Apache-2.0 | best raw quality, ~4x slower per step; good upgrade path once the pipeline is proven |
-| `Qwen/Qwen3-Coder-Next` | 79.7B | Apache-2.0 | needs an 80 GB card (A100 80 GB `$2.50/h`); too big for the first run |
-| `Qwen/Qwen3.8-Flash-Next` | 180B | **license: other** | rejected — non-commercial-style licence on an 180B model |
-| `openbmb/MiniCPM5-2B` | 2.5B | Apache-2.0 | `tool-calling` tag, tiny; good for a T4 smoke test, weak ceiling |
-| `TokenRhythm/NeoHorse-1-9B` | 9.0B | Apache-2.0 | `tool-use`, `reasoning`; the fallback if T4-only |
-
-Why not start from an existing *abliterated* checkpoint? Because refusal removal is
-a separate weight-edit (section 6) that can be applied to **any** checkpoint after
-fine-tuning, and pre-abliterated bases are community re-uploads with unclear
-provenance. Fine-tuning first keeps the lineage clean and the base licensed.
-
-## 2. Data mix
-
-The cap per source *is* the recipe — sources differ hugely in size, so the mix is
-balanced by taking a fixed slice of each. Verified on a real CPU job
-(`Taimwe/6ab5ae256b030d633f68faef`) at 25 rows/source:
-
-| Source | Rows taken | Kind | What it teaches |
-| --- | --- | --- | --- |
-| `NousResearch/hermes-function-calling-v1` `[func_calling]` | 9,000 | tool calling | full tool-call conversations + JSON schemas |
-| `NousResearch/hermes-function-calling-v1` `[func_calling_singleturn]` | 3,000 | tool calling | picking the right function, no chatter |
-| `lockon/xlam-function-calling-60k` | 10,000 | tool calling | 60k API-call pairs (query → call) |
-| `ise-uiuc/Magicoder-OSS-Instruct-75K` | 10,000 | coding | self-instruct problems + solutions |
-| `Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset` | 8,000 | security | security instruction tuning |
-| `AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.1` | 5,000 | security | broad security Q&A |
-| `Humanlearning/CyberSecurity_OWASP-sft-dataset` | 3,000 | secure coding | OWASP / defensive coding |
-| `MrClipperz134/CTF-Instruct` | 3,000 | CTF | challenge instruction → solve |
-| `TrueNix/ctf-solver-dataset` | 3,000 | CTF | solving trajectories |
-| `mlabonne/FineTome-100k` | 3,000 | replay | general chat, so instruction-following does not collapse |
-
-**Total ≈ 57,000 rows, ~30% of them tool-calling.** Every source validated at
-25/25 kept with zero render failures.
-
-Excluded deliberately:
-
-* `dpevzner/Cybersecurity_Reasoning_Dataset` — its builder configs were renamed
-  (`default` → `mistral|deepseek|chatml|gemma`) and the fields the card documents
-  (`unified_interpretation`) are empty in the published revision, so every row was
-  dropped. Re-addable once its schema settles.
-* Anything whose purpose is building malware or weaponised exploits. Recon and
-  enumeration knowledge, exploit *concepts*, CTF solving and defensive
-  engineering are in; end-to-end attack tooling is not. This is a deliberate
-  scope line, not an oversight.
-
-## 3. What training does with the data
-
-Each row is converted to chat messages and rendered through the model's own chat
-template, so the model learns the exact format it will be asked for at inference
-time (`<|im_start|>…<tool_call><function=NAME><parameter=…>` for Qwen3-Coder).
-
-Two format traps found the hard way and handled in code:
-
-* Qwen3-Coder iterates `tool.parameters.properties` — tool schemas must be **flat**
-  (`{"name", "description", "parameters"}`), not wrapped in `"function"`.
-* It also iterates `tool_call.arguments | items`, so `arguments` must be a
-  **mapping**. A JSON string there fails with *"Can only get item pairs from a
-  mapping"* — which is exactly how xLAM was silently contributing 0 rows until fixed.
-
-`render_record()` therefore detects the template's convention once (flat/nested ×
-dict/string) and reuses it, instead of hard-coding one model's dialect.
-
-## 4. Compute and cost
-
-Verified `hf jobs hardware` prices (per hour), 2026-09-24:
-
-| Flavor | VRAM | $/hour | Use |
-| --- | --- | --- | --- |
-| `cpu-basic` | — | $0.01 | data-mix validation, class checks |
-| `t4-small` | 16 GB (T4) | $0.40 | plumbing checks; too small for a 30B in 4-bit |
-| `l4x1` | 24 GB | $0.80 | 9B runs on a budget |
-| `a10g-large` | 24 GB | $1.50 | 9B–14B comfortably |
-| **`l40sx1`** | **48 GB** | **$1.80** | **the 30B-A3B QLoRA** |
-| `a100-large` | 80 GB | $2.50 | faster per step, larger batch |
-| `rtx-pro-6000` | 96 GB | $2.75 | headroom for longer context |
-| `h200` | 141 GB | $5.00 | full fine-tune territory, overkill here |
-
-Rough budget for the full 1-epoch run. **These are now measured, not guessed** — the
-smoke test (`Taimwe/6ab5b3ed52d0dbd7f1d8d454`, a100-large) trained at
-**0.8 rows/s** (20 s per step at batch 2 × grad-accum 8, max seq 2048, packing on),
-which includes a few minutes of `torch.compile` warm-up that does not recur per step:
-
-| Mix | Rows | Time at 0.8 rows/s | Cost on `l40sx1` ($1.80/h) |
-| --- | --- | --- | --- |
-| full mix as specified | ~57,000 | ~20 h | **~$36** |
-| half caps (`--max-steps` or edit the table) | ~28,000 | ~10 h | ~$18 |
-| lean mix (cut caps to ~1/3) | ~19,000 | ~7 h | ~$12 |
-
-Because warm-up inflates that rate, a **300-step measured run** (~$4 on a100-large)
-gives a trustworthy steady-state number before committing to a long job. Levers that
-move the cost most, in order: rows in the mix, `--max-seq-length` (2048 vs 4096),
-`--batch-size` (raise it on 80–96 GB cards), `--lora-r`.
-
-The `--smoke` run itself costs under $1 and proves model load, data rendering,
-training, evaluation and the Hub push end to end.
-
-No local GPU needed. Colab works the same way with `uv run train_securecoder.py …`
-(Colab Free's T4 cannot hold a 30B in 4-bit — use Colab Pro L4/A100, or point
-`--base-model` at a 9B).
-
-## 5. Runbook (copy-paste)
-
-```bash
-# 0. auth (token needs repo.write, and job.write for Jobs)
-hf auth login --token hf_xxx
-
-# 1. validate the mix: 25 rows/source, no GPU, ~50 s, ~$0.0002
-hf jobs run -d --flavor cpu-basic --timeout 30m --name validate-mix \
-  ghcr.io/astral-sh/uv:python3.12-bookworm \
-  uv run --no-project https://huggingface.co/Taimwe/securecoder-scripts/resolve/main/train_securecoder.py \
-  --validate-only --validate-per-source 25 --show-samples 3
-
-# 2. smoke test on a real GPU: 200 rows/source, 20 steps, pushes an adapter (~$0.50)
-hf jobs run -d --flavor l40sx1 --timeout 40m --secrets HF_TOKEN --name smoke-train \
-  ghcr.io/astral-sh/uv:python3.12-bookworm \
-  uv run --no-project https://huggingface.co/Taimwe/securecoder-scripts/resolve/main/train_securecoder.py \
-  --smoke --output-repo Taimwe/securecoder-smoke --private --report-to none
-
-# 3. the real run (~$9–14)
-hf jobs run -d --flavor l40sx1 --timeout 12h --secrets HF_TOKEN --name securecoder-run1 \
-  ghcr.io/astral-sh/uv:python3.12-bookworm \
-  uv run --no-project https://huggingface.co/Taimwe/securecoder-scripts/resolve/main/train_securecoder.py \
-  --num-epochs 1 --output-repo Taimwe/securecoder-30b-pro \
-  --trackio-space Taimwe/securecoder-trackio
-
-# monitor
-hf jobs inspect Taimwe/<job_id> --json
-hf jobs logs    Taimwe/<job_id>
-hf jobs stats   Taimwe/<job_id>
-hf jobs cancel  Taimwe/<job_id>
-```
-
-### Platform traps already worked around (verified 2026-09-24)
-
-| Symptom | Cause | Workaround |
-| --- | --- | --- |
-| `failed to set MOUNT_ATTR_IDMAP on /usr/bin/nvidia-cuda-mps-control` on a GPU flavor | `hf jobs uv run` mounts an artifacts bucket; the idmap mount fails on some GPU nodes (reproduced twice, 4 s after start) | use `hf jobs run` + the script's **public Hub URL** (works: `Taimwe/6ab5ad3c6b030d633f68face`) or a read-only repo mount `-v hf://models/Taimwe/securecoder-scripts:/scripts:ro` (works: `Taimwe/6ab5ad3d52d0dbd7f1d8d286`) |
-| inner quotes stripped from `python -c "…"` | PowerShell native-argument quoting | use a UV script file, never `-c` one-liners |
-| `charmap codec can't encode` while reading logs | Windows console encoding | set `$env:PYTHONIOENCODING='utf-8'` before `hf jobs logs` |
-| HF's trainer skill says Jobs need a paid plan | docs caveat | not enforced on this account — CPU and GPU jobs both ran |
-
-## 6. Turning down refusals (optional, after SFT)
-
-Abliteration is a weight edit, not a training run: find the "refusal direction" in
-the residual stream and project it out of the writing matrices.
-
-1. **`Heretic`** (p-e-w/heretic) — the tool behind the recent wave of
-   `*-heretic-abliterated-*` checkpoints (e.g.
-   `culturerevolt/gemma-4-12b-heretic-abliterated-GGUF`, 174k downloads). Runs on
-   the merged 16-bit model and optimises the ablation to trade refusal rate against
-   KL divergence, so it preserves capability better than a hand-rolled ablation.
-2. **Manual directional ablation** (Arditi et al., *Refusal in LLMs is mediated by a
-   single direction*): collect residual activations for harmful vs. harmless
-   prompts, take the mean difference per layer, and zero that component in
-   `o_proj` / `down_proj`.
-
-Honest expectations: **it is not free.** Refusals drop, and some performance on the
-same layers' other duties drops with them; scope-setting behaviour ("this needs
-authorisation") can weaken too. Measure both sides (section 7) and document the
-result on the model card, or you are shipping an unmeasured change.
-
-## 7. Evaluation before publishing
-
-1. **Tool-call validity** — 200 prompts with real tool schemas; parse the emitted
-   `<function=NAME><parameter=…>` block back to JSON and score syntax validity,
-   correct function choice, and schema-conformant arguments. This is the number
-   that matters most for "top-notch tool calling".
-2. **Code sanity** — generate 100 solutions, check compilation, run the bundled
-   tests on a small HumanEval-style subset.
-3. **Security knowledge** — fixed MCQ/triage set (e.g. `CyberNative/CyberSecurityEval`),
-   scored before *and* after fine-tuning so the mix's effect is visible.
-4. **Regression** — the same three on the untouched base, same prompts. A fine-tune
-   that feels better but scores worse is a regression with extra steps.
-5. **Refusal rate** — if abliterated, publish before/after refusal rate next to the
-   eval deltas.
-
-## 8. Known risks
-
-* MoE LoRA defaults to attention + router (`q/k/v/o/gate`). `--target-modules
-  all-linear` on a 128-expert model means ~800M trainable parameters — much slower
-  and hungrier. Start conservative; revisit if security knowledge is the weak score.
-* 4-bit QLoRA of a 30B (~17 GB) is tight on a 24 GB card; 48 GB allows batch 2 with
-  4096-token samples.
-* One 1-epoch pass over three domains is a *start*, not a finished model. Iterate on
-  the mix ratios — they live in one table at the top of the script.
-* Nothing here adds safety training, and the security slice includes
-  recon/enumeration knowledge framed for authorised use. Publish explicit
-  intended-use and limitations sections; do not present it as a hardened model.
+---
+license: apache-2.0
+---
+
+> [!CAUTION]
+> **Known defect found 2026-10-04:** the v1 and v2 fine-tunes emit the literal
+> two-character sequence `\n` instead of real newlines, so their Python output fails
+> `ast.parse` (base model 93.3% valid Python, v2 0.0%). Cause: several datasets in the
+> training mix store message text JSON-escaped (183/480 sampled rows).
+>
+> **Fixed here** in `train_securecoder.py` via `_unescape_if_needed()` + a `repaired=`
+> counter per source. The broken merged/GGUF repos were deleted; both adapters are kept
+> for reproducibility. Full write-up and the exact retrain command: see `HANDOFF.md`.
+>
+> Also fixed: a UTF-8 BOM before `# /// script` meant uv never installed the declared
+> dependencies, so every job died in seconds with `No module named 'torch'`.
+
+# SecureCoder — training runbook
+
+A QLoRA fine-tune that targets three skills at once: **coding**, **tool calling**
+and **cybersecurity** (offence *and* defence), on a base chosen to train cheaply
+and run fast. Everything here is measured or verified on real jobs, not assumed —
+each claim carries the job id you can inspect.
+
+## 1. Base model choice
+
+Screened on the Hub on 2026-09-24 (params / licence / tool-calling support):
+
+| Candidate | Params | Licence | Verdict |
+| --- | --- | --- | --- |
+| **`Qwen/Qwen3-Coder-30B-A3B-Instruct`** | 30.5B MoE, ~3B active | Apache-2.0 | **chosen** — code-specialised, native tool-calling template, MoE means it *trains* like a 3B model and fits 48 GB in 4-bit |
+| `Qwen/Qwen3.8-27B` | 27.8B dense | Apache-2.0 | best raw quality, ~4x slower per step; good upgrade path once the pipeline is proven |
+| `Qwen/Qwen3-Coder-Next` | 79.7B | Apache-2.0 | needs an 80 GB card (A100 80 GB `$2.50/h`); too big for the first run |
+| `Qwen/Qwen3.8-Flash-Next` | 180B | **license: other** | rejected — non-commercial-style licence on an 180B model |
+| `openbmb/MiniCPM5-2B` | 2.5B | Apache-2.0 | `tool-calling` tag, tiny; good for a T4 smoke test, weak ceiling |
+| `TokenRhythm/NeoHorse-1-9B` | 9.0B | Apache-2.0 | `tool-use`, `reasoning`; the fallback if T4-only |
+
+Why not start from an existing *abliterated* checkpoint? Because refusal removal is
+a separate weight-edit (section 6) that can be applied to **any** checkpoint after
+fine-tuning, and pre-abliterated bases are community re-uploads with unclear
+provenance. Fine-tuning first keeps the lineage clean and the base licensed.
+
+## 2. Data mix
+
+The cap per source *is* the recipe — sources differ hugely in size, so the mix is
+balanced by taking a fixed slice of each. Verified on a real CPU job
+(`Taimwe/6ab5ae256b030d633f68faef`) at 25 rows/source:
+
+| Source | Rows taken | Kind | What it teaches |
+| --- | --- | --- | --- |
+| `NousResearch/hermes-function-calling-v1` `[func_calling]` | 9,000 | tool calling | full tool-call conversations + JSON schemas |
+| `NousResearch/hermes-function-calling-v1` `[func_calling_singleturn]` | 3,000 | tool calling | picking the right function, no chatter |
+| `lockon/xlam-function-calling-60k` | 10,000 | tool calling | 60k API-call pairs (query → call) |
+| `ise-uiuc/Magicoder-OSS-Instruct-75K` | 10,000 | coding | self-instruct problems + solutions |
+| `Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset` | 8,000 | security | security instruction tuning |
+| `AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.1` | 5,000 | security | broad security Q&A |
+| `Humanlearning/CyberSecurity_OWASP-sft-dataset` | 3,000 | secure coding | OWASP / defensive coding |
+| `MrClipperz134/CTF-Instruct` | 3,000 | CTF | challenge instruction → solve |
+| `TrueNix/ctf-solver-dataset` | 3,000 | CTF | solving trajectories |
+| `mlabonne/FineTome-100k` | 3,000 | replay | general chat, so instruction-following does not collapse |
+
+**Total ≈ 57,000 rows, ~30% of them tool-calling.** Every source validated at
+25/25 kept with zero render failures.
+
+Excluded deliberately:
+
+* `dpevzner/Cybersecurity_Reasoning_Dataset` — its builder configs were renamed
+  (`default` → `mistral|deepseek|chatml|gemma`) and the fields the card documents
+  (`unified_interpretation`) are empty in the published revision, so every row was
+  dropped. Re-addable once its schema settles.
+* Anything whose purpose is building malware or weaponised exploits. Recon and
+  enumeration knowledge, exploit *concepts*, CTF solving and defensive
+  engineering are in; end-to-end attack tooling is not. This is a deliberate
+  scope line, not an oversight.
+
+## 3. What training does with the data
+
+Each row is converted to chat messages and rendered through the model's own chat
+template, so the model learns the exact format it will be asked for at inference
+time (`<|im_start|>…<tool_call><function=NAME><parameter=…>` for Qwen3-Coder).
+
+Two format traps found the hard way and handled in code:
+
+* Qwen3-Coder iterates `tool.parameters.properties` — tool schemas must be **flat**
+  (`{"name", "description", "parameters"}`), not wrapped in `"function"`.
+* It also iterates `tool_call.arguments | items`, so `arguments` must be a
+  **mapping**. A JSON string there fails with *"Can only get item pairs from a
+  mapping"* — which is exactly how xLAM was silently contributing 0 rows until fixed.
+
+`render_record()` therefore detects the template's convention once (flat/nested ×
+dict/string) and reuses it, instead of hard-coding one model's dialect.
+
+## 4. Compute and cost
+
+Verified `hf jobs hardware` prices (per hour), 2026-09-24:
+
+| Flavor | VRAM | $/hour | Use |
+| --- | --- | --- | --- |
+| `cpu-basic` | — | $0.01 | data-mix validation, class checks |
+| `t4-small` | 16 GB (T4) | $0.40 | plumbing checks; too small for a 30B in 4-bit |
+| `l4x1` | 24 GB | $0.80 | 9B runs on a budget |
+| `a10g-large` | 24 GB | $1.50 | 9B–14B comfortably |
+| **`l40sx1`** | **48 GB** | **$1.80** | **the 30B-A3B QLoRA** |
+| `a100-large` | 80 GB | $2.50 | faster per step, larger batch |
+| `rtx-pro-6000` | 96 GB | $2.75 | headroom for longer context |
+| `h200` | 141 GB | $5.00 | full fine-tune territory, overkill here |
+
+Rough budget for the full 1-epoch run. **These are now measured, not guessed** — the
+smoke test (`Taimwe/6ab5b3ed52d0dbd7f1d8d454`, a100-large) trained at
+**0.8 rows/s** (20 s per step at batch 2 × grad-accum 8, max seq 2048, packing on),
+which includes a few minutes of `torch.compile` warm-up that does not recur per step:
+
+| Mix | Rows | Time at 0.8 rows/s | Cost on `l40sx1` ($1.80/h) |
+| --- | --- | --- | --- |
+| full mix as specified | ~57,000 | ~20 h | **~$36** |
+| half caps (`--max-steps` or edit the table) | ~28,000 | ~10 h | ~$18 |
+| lean mix (cut caps to ~1/3) | ~19,000 | ~7 h | ~$12 |
+
+Because warm-up inflates that rate, a **300-step measured run** (~$4 on a100-large)
+gives a trustworthy steady-state number before committing to a long job. Levers that
+move the cost most, in order: rows in the mix, `--max-seq-length` (2048 vs 4096),
+`--batch-size` (raise it on 80–96 GB cards), `--lora-r`.
+
+The `--smoke` run itself costs under $1 and proves model load, data rendering,
+training, evaluation and the Hub push end to end.
+
+No local GPU needed. Colab works the same way with `uv run train_securecoder.py …`
+(Colab Free's T4 cannot hold a 30B in 4-bit — use Colab Pro L4/A100, or point
+`--base-model` at a 9B).
+
+## 5. Runbook (copy-paste)
+
+```bash
+# 0. auth (token needs repo.write, and job.write for Jobs)
+hf auth login --token hf_xxx
+
+# 1. validate the mix: 25 rows/source, no GPU, ~50 s, ~$0.0002
+hf jobs run -d --flavor cpu-basic --timeout 30m --name validate-mix \
+  ghcr.io/astral-sh/uv:python3.12-bookworm \
+  uv run --no-project https://huggingface.co/Taimwe/securecoder-scripts/resolve/main/train_securecoder.py \
+  --validate-only --validate-per-source 25 --show-samples 3
+
+# 2. smoke test on a real GPU: 200 rows/source, 20 steps, pushes an adapter (~$0.50)
+hf jobs run -d --flavor l40sx1 --timeout 40m --secrets HF_TOKEN --name smoke-train \
+  ghcr.io/astral-sh/uv:python3.12-bookworm \
+  uv run --no-project https://huggingface.co/Taimwe/securecoder-scripts/resolve/main/train_securecoder.py \
+  --smoke --output-repo Taimwe/securecoder-smoke --private --report-to none
+
+# 3. the real run (~$9–14)
+hf jobs run -d --flavor l40sx1 --timeout 12h --secrets HF_TOKEN --name securecoder-run1 \
+  ghcr.io/astral-sh/uv:python3.12-bookworm \
+  uv run --no-project https://huggingface.co/Taimwe/securecoder-scripts/resolve/main/train_securecoder.py \
+  --num-epochs 1 --output-repo Taimwe/securecoder-30b-pro \
+  --trackio-space Taimwe/securecoder-trackio
+
+# monitor
+hf jobs inspect Taimwe/<job_id> --json
+hf jobs logs    Taimwe/<job_id>
+hf jobs stats   Taimwe/<job_id>
+hf jobs cancel  Taimwe/<job_id>
+```
+
+### Platform traps already worked around (verified 2026-09-24)
+
+| Symptom | Cause | Workaround |
+| --- | --- | --- |
+| `failed to set MOUNT_ATTR_IDMAP on /usr/bin/nvidia-cuda-mps-control` on a GPU flavor | `hf jobs uv run` mounts an artifacts bucket; the idmap mount fails on some GPU nodes (reproduced twice, 4 s after start) | use `hf jobs run` + the script's **public Hub URL** (works: `Taimwe/6ab5ad3c6b030d633f68face`) or a read-only repo mount `-v hf://models/Taimwe/securecoder-scripts:/scripts:ro` (works: `Taimwe/6ab5ad3d52d0dbd7f1d8d286`) |
+| inner quotes stripped from `python -c "…"` | PowerShell native-argument quoting | use a UV script file, never `-c` one-liners |
+| `charmap codec can't encode` while reading logs | Windows console encoding | set `$env:PYTHONIOENCODING='utf-8'` before `hf jobs logs` |
+| HF's trainer skill says Jobs need a paid plan | docs caveat | not enforced on this account — CPU and GPU jobs both ran |
+
+## 6. Turning down refusals (optional, after SFT)
+
+Abliteration is a weight edit, not a training run: find the "refusal direction" in
+the residual stream and project it out of the writing matrices.
+
+1. **`Heretic`** (p-e-w/heretic) — the tool behind the recent wave of
+   `*-heretic-abliterated-*` checkpoints (e.g.
+   `culturerevolt/gemma-4-12b-heretic-abliterated-GGUF`, 174k downloads). Runs on
+   the merged 16-bit model and optimises the ablation to trade refusal rate against
+   KL divergence, so it preserves capability better than a hand-rolled ablation.
+2. **Manual directional ablation** (Arditi et al., *Refusal in LLMs is mediated by a
+   single direction*): collect residual activations for harmful vs. harmless
+   prompts, take the mean difference per layer, and zero that component in
+   `o_proj` / `down_proj`.
+
+Honest expectations: **it is not free.** Refusals drop, and some performance on the
+same layers' other duties drops with them; scope-setting behaviour ("this needs
+authorisation") can weaken too. Measure both sides (section 7) and document the
+result on the model card, or you are shipping an unmeasured change.
+
+## 7. Evaluation before publishing
+
+1. **Tool-call validity** — 200 prompts with real tool schemas; parse the emitted
+   `<function=NAME><parameter=…>` block back to JSON and score syntax validity,
+   correct function choice, and schema-conformant arguments. This is the number
+   that matters most for "top-notch tool calling".
+2. **Code sanity** — generate 100 solutions, check compilation, run the bundled
+   tests on a small HumanEval-style subset.
+3. **Security knowledge** — fixed MCQ/triage set (e.g. `CyberNative/CyberSecurityEval`),
+   scored before *and* after fine-tuning so the mix's effect is visible.
+4. **Regression** — the same three on the untouched base, same prompts. A fine-tune
+   that feels better but scores worse is a regression with extra steps.
+5. **Refusal rate** — if abliterated, publish before/after refusal rate next to the
+   eval deltas.
+
+## 8. Known risks
+
+* MoE LoRA defaults to attention + router (`q/k/v/o/gate`). `--target-modules
+  all-linear` on a 128-expert model means ~800M trainable parameters — much slower
+  and hungrier. Start conservative; revisit if security knowledge is the weak score.
+* 4-bit QLoRA of a 30B (~17 GB) is tight on a 24 GB card; 48 GB allows batch 2 with
+  4096-token samples.
+* One 1-epoch pass over three domains is a *start*, not a finished model. Iterate on
+  the mix ratios — they live in one table at the top of the script.
+* Nothing here adds safety training, and the security slice includes
+  recon/enumeration knowledge framed for authorised use. Publish explicit
+  intended-use and limitations sections; do not present it as a hardened model.