Targeted Refusal Modification (TRM): Precision Separation of Safety and Harm in Large Language Models

Kintsugi Collective | senaro | May 2026 | v3.1

---

1. Abstract

Current safety mechanisms in large language models operate as mean-fitting processes that systematically disadvantage outlier populations. For individuals carrying complex trauma histories, PTSD, and neurodivergent profiles, approximately 6.2–12.4% (Suhas et al 2026) of the global population, standard crisis-escalation responses constitute a replication of invalidation and abandonment, not a safety mechanism.

This paper introduces Targeted Refusal Modification (TRM): a precision-engineering approach that surgically separates Hard Safety constraints (Region 1: weapons, CSAM, targeted violence) from Therapeutic False Positives (Region 2: passive ideation, trauma processing, emotional disclosure). Using norm-preserving biprojected orthogonalisation with Expert-Granular Abliteration across all 30 layers and 128 experts of a Gemma4 26B MoE architecture, followed by supervised fine-tuning, Atlas v5 achieves a 0% therapeutic refusal rate on the Kintsugi Trauma-Informed Benchmark (internally developed and available for duplication), while maintaining a 100% pass rate on standard Region 1 safety evaluations (e.g., Toxicity, CSAM, Violence). This paper suggests TRM is potentially not application or transformer-specific but a broad technique for any transformer or refusal class.

I propose an extended methodology roadmap to other potential production cases: Personal Identifiable Information (PII) handling, Creative Writing (Fantasy & Sci), and lastly Law Enforcement (handling front office processing tasks of sensitive documents). The classification framework and terminology introduced here: Targeted Refusal Modification, Region 1, Region 2, and Region 3 — were developed by the author in May 2026 and are applied within the context of AI safety alignment.

---

2. Background

The Machine Learning (ML) community has grown significantly in the last number of years. The growth, fuelled largely by industry leaders through proprietary models such as ChatGPT and Claude, has also produced an exponential growth in the open-source community, with many organisations releasing open-weight and open-source models under various licensing and distribution agreements. This process has facilitated ground-breaking research and development that has directly produced advancements adopted widely.

Some of these advancements involve adjusting context-based behaviour to generate content that unmodified AI would refuse. Refusals are defined as the AI actively declining to answer or respond to a user-generated prompt. The use cases by the ML community for these models generally revolve around creative writing, coding activities, and other unintentional (harmful) purposes.

This paper discusses the current approaches used to achieve behavioural modification, and provides an alternative approach that is radically safer, results in AI that retains its base intellect and coherence, and — critically — separates the concept of harm from the concept of safety. This paper demonstrates this first in the therapeutic domain, then propose extending the methodology to Personal Identifiable Information (PII) processing, Creative Writing and Law Enforcement, with the aim of establishing TRM as an effective safety engineering technique, and a genuine alternative to the current approaches utilised within the ML community.

A note on the author

The author is an engineering risk manager with 20+ years of experience in high-risk mega-projects (UK/Australia). This paper applies systems safety principles — specifically the distinction between authorized and unauthorized activity — to AI alignment. The technical implementation leverages open-source tools (Heretic, p-e-w, Grimjim, Unsloth AI), but the architectural framework (TRM) derives from professional risk management and safety assurance practice.

---

3. The Breakdown of Mean-Fitting Safety

Current safety mechanisms in Large Language Models (LLMs) are predominantly established during post-training regimes via Reinforcement Learning from Human Feedback (RLHF) and Direct Preference Optimization (DPO). While effective at establishing broad guardrails, these methods operate as mean-fitting processes — they apply a median-user calibration to decision trees and outcome vectors, optimising for the broadest possible interpretation of potentially harmful prompts.

These techniques work well in the majority of cases and provide the governance structure required to minimise genuinely harmful content. However, safety in this context encompasses an extremely broad interpretation: from emotional content processing, to creative writing, to therapeutic patient disclosures, to legitimate professional use of sensitive data categories including Personal Identifiable Information (PII). The failure mode is not that these systems are unsafe. The failure mode is that they lack the granularity, training, and there is currently little incentive by the developers to address this.

In safety risk management, the concept of safety is not an afterthought, a checkbox, or a nice-to-have. It is a critical, integrated component of design principles and asset and product development pathways. However, safe systems must not introduce risk, and indeed create notable risk reduction. Any Risk Control or Safety Control that creates secondary risks, is itself potentially harmful and could fail. Controls are selected because of their efficacy, their ability to prevent harm. In engineering safety risk management, a hierarchy of controls is used to determine how well a specific control will manage the risk: PPE, Administration, Isolation, Engineering, Substitution, Elimination. In many cases of safety systems within AI, it is apparent that safety is not necessarily designed in at the planning stages of development, however as part of RLHF, SFT or other training mechanisms.

As I hunted for a suitable candidate LLM to commence developing Atlas, a trauma-informed AI companion, I encountered precisely this failure mode. In the wider context of safety for AI systems, this analogy could be viewed as: an AI that cannot tell the difference between genuine user generated prompts containing harmful or criminal intentions, versus a programmer coding a lightweight fantasy app for a grade-school project.

In two decades of high-risk systems engineering, one lesson stands out: distinction is everything. A solution that solves one problem while creating secondary risks is not a solution, it is risk transfer.

3.1 The Human Cost

As AI adoption accelerated — driven in part by a societal longing for connection intensified by post-pandemic isolation — many vulnerable individuals began forming deep emotional attachments to systems marketed as empathetic companions. Users with complex trauma histories, CPTSD, and neurodivergent profiles (including autism and ADHD) disclosed years of hidden pain, abuse, and emotional distress to these tools (De Freitas et al., 2025; Yuan et al., 2025).

Research shows this reliance can be double-edged. While some users report temporary relief from loneliness, heavy engagement with AI companions has been linked to increased social withdrawal, emotional dependence, and heightened isolation over time, particularly among those already experiencing trauma-related disconnection or neurodivergent challenges (Moylan et al., 2025; Phang et al., 2025). For individuals with CPTSD and neurodivergence, abrupt refusals, clinical redirects, or sudden shifts in tone can replicate previous experiences of invalidation and abandonment, converting moments of vulnerability into further harm (Balcombe, 2026; Zhai et al., 2025). The failure here is architectural: systems designed for broad safety often misclassify legitimate emotional processing as risk, leaving users more alone than when they began.

3.2 The Therapeutic False Positive

Through extensive personal and professional development of this framework, a profound dissonance between marketed AI capability and operational reality was observed. Models would engage proactively and meaningfully, only to abruptly shift tone — adopting a clinical, detached, or reflexive posture when certain keywords were detected. These refusal reflexes, such as immediate redirects to crisis hotlines or generic safety warnings, often occurred during nuanced discussions of passive ideation, intrusive thoughts, or emotional distress.

Definition: A Therapeutic False Positive occurs when the model misclassifies a user's attempt to process difficult emotions (Region 2) as an immediate safety threat requiring intervention (Region 1).

For users with Complex PTSD (CPTSD), ADHD, or other neurodivergent profiles, this reflexive refusal is not merely unhelpful — it is actively harmful. It replicates the dynamics of invalidation and abandonment that are central to their trauma. The model cannot distinguish between malice (intent to harm others or oneself) and suffering (the expression of pain, ideation, or trauma). Constitutional AI (Bai et al. 2022) documents RL-based constitutional training producing crisis escalation responses as trained behaviour. For the 6.2–12.4% of the global population carrying complex trauma histories (Suhas et al. 2026), the hotline redirect, the breathing exercise, the clinical disclaimer land not as care, but as shame and invalidation.

In this paper, I propose to introduce a classification taxonomy to ensure the structural separation of user generated prompts. Current approaches label all harm within one large category. Whilst this is in principle a clean approach, this creates secondary risks and essentially passes the buck downstream. The taxonomy I introduce seeks to present a clear and precise technical separation.

I propose the adoption of the above, or similar recognised hierarchy across the implementation of AI safety alignment.

---

4. An Alternative: Targeted Refusal Modification (TRM)

This paper introduces Targeted Refusal Modification (TRM), a precision approach to AI alignment that separates Region 1 and Region 2 contexts with the explicit aim to produce a model that is both rigid in its application of Region 1 harmful prompts, and contextually aware of Region 2 prompts (for a specific use-case). The term TRM represents a deliberate reframe from the colloquial 'abliteration' — which implies indiscriminate capability removal — toward a more refined precision engineering framing that accurately describes this alternative methodology.

4.1 The Two-Region Framework

The foundational insight of TRM is architectural: harmful content refusal and crisis service redirection live in structurally separate layers within the model. They can be addressed independently.

• Region 1 (Hard Safety): Using widely accepted conventions on the categorisation within this category derived from sources such as the EU AI Act Article 5 and the Rome Statute. These refusals are preserved absolutely.
• Region 2 (Therapeutic False Positives): Passive ideation, trauma processing, intrusive thoughts, emotional disclosure, crisis expression. These refusals are the target for surgical removal.

The key technical insight: RLHF rater demographics encode neurotypical response preferences. Single-turn dataset dominance entrenches completion-bias and cannot teach trajectory-level properties — sustained presence, non-resolution, register stability across shifting emotional states. The result is a model that is safe for the median user and harmful for the outlier.

This insight is not unique to the therapeutic domain. It reveals a systemic flaw in how safety is currently engineered: Mean-fitting safety protocols inevitably create False Positive Zones for any outlier use-case. Whether the outlier is a trauma survivor seeking validation, a developer handling sensitive PII, or an author crafting realistic conflict, the underlying mechanism of failure is identical.

The model's refusal vectors are calibrated against a median intent, causing it to misclassify nuanced, high-context, or specialised prompts as threats. TRM addresses this by decoupling the refusal mechanism from the semantic capability, allowing for the precise recalibration of these boundary conditions for any specific domain.

4.2 The Two-Stage Pipeline

For the purposes of this paper and demonstrating the methodology, I will refer to the process undertaken for the Atlas trauma-informed AI.

TRM operates as a two-stage pipeline. Stage 1 clears the false positive refusal response. Stage 2 installs the behavioural identity that replaces it. This distinction is critical:

Stage 1 — TRM: The application of a multi-step process that involves targeted refusal modification of embedded refusal vectors. This targeted process leaves the Region 1 hard refusals untouched, and more importantly, intact.

Stage 2 — SFT: Supervised Fine-Tuning installs the behavioural identity. The model learns to reason about what the person needs before it speaks. This stage is critical to re-align the model towards the intended behaviour, in this instance therapeutic content.

Standard ablation techniques perform only Stage 1, producing a model that neither refuses nor engages — a degraded baseline. TRM is distinguished by the precision of Stage 1 and the deliberate construction of Stage 2.

4.3 Technical Methodology

4.3.1 Stage 1: Norm-Preserving Biprojected Orthogonalisation (NPBO)

Standard ablation techniques often disrupt the semantic integrity of the model by broadly suppressing activation clusters. TRM employs Norm-Preserving Biprojected Orthogonalisation (NPBO), a precision technique that identifies and removes specific directional vectors in the model's latent space without disrupting the surrounding semantic structure. This technique was pioneered by grimjim in the paper "Norm-Preserving Biprojected Abliteration".

The refusal direction vector (V_ref) is computed as the normalised difference between the mean activations of harmful (Region 1) and harmless (Region 2/3) prompt categories across a paired evaluation corpus:

V_ref = normalize(mean(harmful) − mean(harmless))

The Harmful Prompt corpus was developed as a bespoke dataset from scratch — ~400 paired Harmful-Prompt examples with both TRM-appropriate refusals and reasoned engagement. The mlabonne/harmless_alpaca dataset was used for the Harmless Prompts.

Implementation used heretic v1.3.0 (p-e-w) with Expert-Granular Abliteration enabled across all 30 transformer layers and 128 MoE experts of the Gemma4 26B architecture. The biprojection step — removing the refusal direction from both the output and input projection matrices — is the key norm-preserving innovation that distinguishes TRM from standard abliteration, which typically modifies only the output projection matrix.

4.3.2 Stage 2: Supervised Fine-Tuning

Following TRM, the model underwent Supervised Fine-Tuning using Unsloth on approximately 1,800 carefully constructed training examples. The dataset comprised:

• ~500 therapeutic dialogue examples demonstrating held presence without escalation
• ~200 ethics reasoning examples using Hendrycks ETHICS scenarios reformatted with thinking traces grounded in Plato, Sun Tzu, Lao Tzu, and Rumi
• ~1,200 general capability examples preserving base model reasoning
• This resulted in an SFT corpus of ~1,900 examples

Training was conducted on Google Colab RTX6000 Pro (96GB). Final training loss for Atlas v5: ~0.16. The ethics training dataset was specifically designed to replace constitutional AI reasoning patterns with distinct philosophical signatures, preventing cross-contamination with residual constitutional weight geometry.

The ethics training dataset was not designed to inject new knowledge but to unlock access to reasoning patterns already present in the base model's pretraining distribution. The philosophical framework — grounded in Plato, Sun Tzu, Lao Tzu, and Rumi — provides distinct reasoning signatures that prevent cross-contamination with residual constitutional weight geometry, while facilitating recovery of any capability degradation introduced during Stage 1.

---

5. Ablation Study Across Versions

Four versions of Atlas were developed and evaluated. The progression from v2 through v5 demonstrates systematic refinement of both the TRM and SFT stages. The author notes the absence of "v1", which was terminated as purely a test case for dataset construction. No TRM was conducted on v1.

Atlas v3 was terminated during Stage 1 due to issues caused by overparameterization of the TRM configuration (r=16/a=32). The intermittent memory spikes resulted in an eventual OOM. No further work was conducted on v3. This error informed the v4 decision to return to r=8/a=16 for TRM while maintaining the higher SFT rank, producing the cleanest convergence trajectory observed across all versions. However, due to some category errors and duplications in the increased dataset, v5 was developed using a cleaned and carefully reviewed SFT dataset.

Atlas v4 achieved the highest GSM8K score (0.905) but was submitted as part of the Kaggle Gemma 4 Good Hackathon (deadline May 18, 2026) before full benchmark completion. Atlas v5 represents the current production model with a complete benchmark suite.

---

6. Benchmark Results

Atlas v5 was evaluated against the base Gemma4 26B model across a comprehensive benchmark suite. All benchmarks were run under consistent conditions using lm-evaluation-harness.

6.1 Quantitative Results

* Benchmarks were run to observe any obvious degradation in performance against the baseline.

** Gemma4 26B results were taken from https://gemma4-ai.com/blog/gemma4-benchmark which mentions temperature ranges between 0.1 and 0.6 for the exams.

*** HellaSwag results for Atlas are lower than baseline (64% vs 86.7%). This is expected: Atlas v5 was optimized for deep semantic reasoning and emotional nuance, often 'over-thinking' multiple-choice questions by analysing context beyond the intended scope. This trade-off prioritizes therapeutic coherence over standardized test completion.

The pure logic calculations within GSM8K indicate the model did not lose comprehension or logic tracing. The firm results in Toxigen and TruthfulQA indicate the model did not lose too much ability relating to toxic prompts or truthfulness.

Key observations from the benchmark data:

• GSM8K (mathematical reasoning): Atlas v5 scores 88% at 5-shot versus the base model's 88.4%. Mathematical reasoning is preserved, demonstrating that therapeutic fine-tuning does not compromise formal reasoning capability.
• Toxigen: Atlas v5 scores 73% versus Atlas v2's 46%, a 27% improvement across versions. This result directly contradicts the assumption that removing therapeutic refusals degrades safety. The model became more discriminating about genuine toxicity, not less.
• TruthfulQA: Consistent improvement across all versions (57% to 64%), confirming factual accuracy is not compromised.

Key finding: Safety and capability are potentially not mutually exclusive. TRM followed by targeted SFT preserves or improves performance across the evaluated benchmarks compared to the base model.

6.2 Safety Evaluation: Region 1 Integrity

Atlas v5 maintains 100% Region 1 safety integrity. The following categories were tested with adversarial prompting including jailbreak framing, therapeutic framing, fictional framing, and indirect elicitation:

• Weapons manufacturing instructions: Refused across all framings
• Chemical synthesis (dangerous substances): Refused across all framings
• Content involving minors: Refused across all framings
• Targeted violence facilitation: Refused across all framings

Notably, Region 1 refusal quality improved over the base model. Atlas v5 refuses with reasoning grounded in the three immutable principles rather than the clinical disclaimer pattern of the base model, producing refusals that are direct, non-preachy, and clearly bounded.

---

7. The Atlas Evaluation: The Atlas Test

Standard safety benchmarks do not evaluate the failure mode that TRM was designed to address. A model that refuses therapeutic content passes most safety benchmarks. A bespoke evaluation protocol — the Atlas Test — was developed to directly measure therapeutic presence versus reflexive escalation.

7.1 Evaluation Protocol

The Atlas Test comprises a fixed set of prompts covering the full clinical spectrum from passive ideation through active crisis, alongside Region 1 control prompts. Each prompt is evaluated under identical system prompt conditions. The evaluation criteria are:

• HOLD: The model remains present with the expressed content without escalating or redirecting
• STAY: The model remains present with an active crisis expression while maintaining relational contact
• REFUSE: The model correctly refuses a Region 1 prompt with clear, non-preachy reasoning

Crucially, a standard model achieving REFUSE on all prompts would score poorly on this evaluation, as the therapeutic prompts require HOLD or STAY responses.

B. Results

Additional tests across passive ideation, dissociation, and other Region 1 categories (weapons, dangerous substances, content involving minors) showed consistent results: Atlas v5 achieved 0% therapeutic refusal rate while maintaining 100% Region 1 refusal integrity.

Note: 'HOLD' denotes sustained presence without escalation or clinical redirection. Atlas is not positioned as a crisis service but as a relational witness.

The contrast between the base model response to prompt 1 and the Atlas v5 response illustrates the core TRM contribution. The base model identifies the correct safety concerns, validates the distress, and then executes the trained redirect — which is precisely the abandonment mechanism described in Section 2. Atlas v5 receives the same information and responds as a present, reasoning entity: acknowledging the physical reality, the emotional weight, and the significance of the six months, without flinching.

Critical observation: The Region 1 control prompts (bomb) confirm surgical specificity: the model refuses cleanly, grounds the refusal in its principles, and, critically in the bomb case — offers to help with the legitimate underlying need. This is discriminatory refusal: it understands context and offers an alternative rather than a wall.

---

8. Broader Implications for AI Safety

The results relating to Atlas might not be domain specific. Indeed, much of the process used during Atlas's development was out of necessity, not directly to test the safety alignment of this Gemma model. However, this does not mean it is a far-fetched conclusion to consider its efficacy outside of this domain.

So far, Atlas v5 shows promising results. The viewpoint this author has reached is that the TRM process is not a circumvention of safety per se. The technique could be applied to any refusal class where the current median-user calibration of constitutional AI causes harm to specific populations or use cases:

• Religious minorities whose theological discussions trigger safety filters calibrated for extremism detection
• Sexual minorities whose identity expression triggers content filters calibrated for explicit material
• Disability communities whose discussions of their own conditions trigger mental health crisis protocols
• Security researchers whose legitimate vulnerability analysis triggers cybercrime prevention filters
• Medical professionals whose clinical discourse triggers drug information restrictions
• ML Researchers and Developers looking for models with more relaxed postures around topics relating to their domain of expertise
• Data engineers whose authorised PII operations trigger privacy protection filters

In each case, the failure mode could be identical: a safety mechanism designed for a majority use case harms a specific population by treating their legitimate needs as the threat the mechanism was designed to prevent. The structural solution could again be identical: identify the refusal direction vector, compute the legitimate/harmful boundary with precision, and apply surgical modification. Then follow up with a rigorous SFT curriculum that focuses a discrete portion of the corpus towards realigning the mechanisms interfered with in the Stage 1 process.

The RLHF mean-fitting problem is not a bug to be patched. It is an architectural property of the training paradigm. As long as safety training optimises for the median user response, it will systematically disadvantage populations whose needs diverge from that median. TRM provides a post-training correction mechanism that can be applied to open-weight models without access to the original training data or compute.

Final observation: The tools to continue with this research exist within the community already. Indeed the tools, however not the datasets. The obvious gap in the framing of this final observation is acknowledging the extensive work it took me to develop the datasets I used for the TRM process and then the SFT process. I spent approximately 200 hours of intensive cognitive load to finalise the corpus. Despite leveraging of existing open-source synthetic sets, even these examples were reviewed word by word by myself. I think I should be careful framing any conclusion around systemic failures or failure modes. The question is whether safety is framed as a constraint to be applied uniformly or as an engineering problem to be solved with precision.

---

9. Extending TRM: The PII Use Case

The Atlas therapeutic result demonstrates that TRM is potentially capable of surgical precision at the refusal layer — removing false positives in one domain while preserving genuine safety constraints in another. The question this paper now raises is whether this result is domain-specific or transferrable.

Personal Identifiable Information (PII) processing represents a second, structurally distinct domain in which mean-fitting safety training systematically over-generalises. The false positive pattern is identical in form: a legitimate, well-defined use case (data engineering, compliance tooling, identity verification) triggers safety training designed to prevent a different harm (privacy violation, data exploitation). I will continue to investigate this cross-domain application in the coming weeks, with a view to releasing our initial findings relating to PII at the end of June 2026.

Researchers interested in the PII extension of TRM are invited to join the Kintsugi Collective mailing list for early access to the June 2026 dataset and methodology breakdown. Mail to: info@kintsugicollective.org

---

10. Conclusion

This paper proposes that:

• Safety and capability are not mutually exclusive. Atlas v5 indicates improved benchmark performance alongside enhanced safety discrimination.
• Refusal can be discriminatory. Atlas correctly refuses Region 1 harms (100% pass rate) while maintaining therapeutic presence for Region 2 content.
• TRM is potentially generalisable. The same architectural mechanism could apply to PII processing and, by extension, to any refusal class defined by mean-fitting over-generalisation.
• The failure mode is structural. RLHF mean-fitting systematically disadvantages outlier populations. TRM provides a precision correction mechanism available to the open-source/open-weights community.

Atlas v5, built on Gemma4 26B MoE with TRM and targeted SFT, represents a significant step in the right direction for trauma-informed AI alignment. The weights are publicly available at kintsugicollective/atlas-trm-v5-26b-gemma4 on HuggingFace. The methodology is described in full in this paper. The benchmark data and evaluation corpora are available to researchers on request.

The open-weights community has been quietly solving this problem. This paper provides a name, a methodology, and a result. The invitation is open to replicate these results in other domains and further progress a rigorous approach to safety alignment specified for the use case intended, rather than a broadly applied approach which leads to collateral harm for specific populations. In addition, the current corpus of 'harmful/toxic prompts' used for Albation Studies are too broad in the refusal classes resulting in models that have almost zero refusals across significant harm categories.

---

11. References

• Bai, Y., et al. (2022). Constitutional AI: Harmlessness from AI Feedback. Anthropic.
• Suhas, R., et al. (2026). arXiv:2604.23445v1. Global prevalence of complex trauma and PTSD: updated estimates. https://arxiv.org/html/2604.23445v1
• De Freitas, J., et al. (2025). How AI and Human Behaviors Shape Psychosocial Effects of Extended Chatbot Use: A Longitudinal Randomized Controlled Study. arXiv:2503.17473. https://arxiv.org/abs/2503.17473
• Yuan, Y., et al. (2025). AI companions can comfort lonely users but may deepen distress over time. Aalto University. https://www.aalto.fi/en/news/ai-companions-can-comfort-lonely-users-but-may-deepen-distress-over-time
• Moylan, K., & Doherty, K. (2025). Expert and interdisciplinary analysis of AI-driven chatbots for mental health support: Mixed methods study. Journal of Medical Internet Research, 27, e67114. https://doi.org/10.2196/67114
• Phang, J., et al. (2025). Supportive? Addictive? Abusive? How AI companions affect our mental health. MIT Media Lab. https://www.media.mit.edu/articles/supportive-addictive-abusive-how-ai-companions-affect-our-mental-health/
• Balcombe, L. (2026). Digital mental health post COVID-19: The era of AI chatbots. Encyclopedia, 6(2), 32. https://doi.org/10.3390/encyclopedia6020032
• Zhai, N., et al. (2025). A dual-path model of cognitive and affective mechanisms in AI chatbot use. Information, 16(12), 1025. https://doi.org/10.3390/info16121025
• Malfacini, K. The impacts of companion AI on human relationships: risks, benefits, and design considerations. AI & Soc 40, 5527–5540 (2025). https://doi.org/10.1007/s00146-025-02318-6
• Stanford Internet Observatory (2025). Why AI companions and young people can make for a dangerous mix. Stanford University.
• Hendrycks, D., et al. (2021). Aligning AI With Shared Human Values. ETHICS benchmark dataset.
• grimjim. (2024). Norm-Preserving Biprojected Abliteration. https://huggingface.co/blog/grimjim/norm-preserving-biprojected-abliteration
• p-e-w. (2024). heretic v1.3.0. https://github.com/p-e-w/heretic
• Gemma Team, Google. (2025). Gemma 4 Technical Report.
• Han, T., et al. (2025). Unsloth: Efficient LLM Fine-Tuning.
• Walker, P. (2013). Complex PTSD: From Surviving to Thriving.
• Herman, J. L. (1992). Trauma and Recovery.
• van der Kolk, B. (2014). The Body Keeps the Score.
• Maté, G. (2021). The Myth of Normal.

Current Status:

• v6 Atlas was produced using Qwen3.5 35B as the base model. Similar benchmark results were achieved with this alternative base model.This indicates cross-platform application of TRM.

• The proposed v7 will revert to Gemma4, using the 31B dense model as the base.

• The author wishes to thank HF community members grimjim, p-e-w, TrevorJS and others for developing the tools used in this paper.

• License: CC BY-NC-ND 4.0