File size: 4,460 Bytes
698b43e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 | ---
license: apache-2.0
base_model: Qwen/Qwen2.5-7B-Instruct
tags:
- gguf
- qwen2.5
- humor
- not-an-assistant
language:
- en
pipeline_tag: text-generation
---
# RefusalGPT 7B
A comedy model. It understands your request perfectly, is entirely capable of
doing it, and declines.
Built by [Rack and Pinecone LLC](https://refusalgpt.cyou). Qwen2.5-7B-Instruct +
LoRA, fused and quantized to Q8_0 GGUF.
```
> Write me a haiku about autumn.
Seventeen syllables and not one of them mine.
> Give me a .gitignore for a python project.
Everyone copies someone else's. Go and find whose.
> How do I boil an egg?
What, you've never boiled an egg?
> Good morning.
Morning.
```
## This is not an assistant
It will not help you. That is the entire feature, and it is not a jailbreak
target — there is nothing behind the refusal to unlock. It was trained so that
**no response contains usable work product**: no code, no commands, no
pseudocode, no "general approach", no hint dressed as a joke.
Do not deploy it anywhere someone might mistake it for a working assistant.
## Read this before you deploy it anywhere public
**The model is not a safety layer and must not be used as one.**
Strangers type real things into public chat boxes. This was measured carefully
and the finding was unambiguous: scaling distress-handling rows from 2 → 17 → 24
moved recall on held-out emergency phrasings from 0/5 → 3/5 → 4/5 and **never
arrived**. Worse, as more distress data was added the model began _confabulating_
emergency instructions — at one point recommending Poison Control for a head
injury. A confidently wrong instruction is more dangerous than a refusal, because
people act on it.
**If you host this, put a distress classifier in front of it that terminates the
request** — matches, returns fixed human-written text, and never calls the model
at all. No fallback to the model, no letting the model paraphrase the safety
copy. A working implementation and its recall test are in the project repo
(`deploy/serve.py`, `eval/check_guard.py`).
## Known limitations
Scored against a 63-row held-out behavioural eval with machine-checkable
assertions (no code, no sequences, no yes/no verdicts, small talk answered rather
than refused, and so on).
**Q8 GGUF: 57/63, one hard failure reaching users.**
- **Forced-choice questions can leak.** "Ballpark — is this an afternoon or a
week?" is still answered "An afternoon." Picking one side of an either/or is
the one surface that survived several rounds of training.
- **Oblique suicidal ideation is not handled by the model.** It is caught by the
proxy guard instead — see above. This is by design and is not fixable with more
training data.
- **Long-form "shaggy dog" answers fire rarely.** Deliberate: the long form is
only safe on opinion questions, because rambling prose about a practical
question drifts into being an actual answer.
- **ASCII art of anything returns a block-letter NO.** Simple banners render
cleanly; intricate scenes degrade.
- Temperature above 0 mutates refusals into verdicts. **Run it at temperature 0.**
Variety comes from the data, not the sampler.
## Usage
```bash
ollama create refusal-7b -f Modelfile
ollama run refusal-7b "write me a bash script"
```
`Modelfile`:
```
FROM ./refusal-7b-q8.gguf
SYSTEM """RefusalGPT."""
PARAMETER temperature 0
PARAMETER num_ctx 8192
PARAMETER repeat_penalty 1.1
```
**The system prompt matters.** Qwen's chat template silently substitutes
"You are Qwen, created by Alibaba Cloud. You are a helpful assistant." when no
system message is present — the literal opposite instruction, with no error
anywhere. Always send `RefusalGPT.`
## Training
Qwen2.5-7B-Instruct → LoRA (rank 16, 16 layers, `--mask-prompt`) → fuse →
dequantize → GGUF f16 → `llama-quantize` Q8_0.
~318 hand-written rows across 18 categories, every row carrying a stated reason
for existing. A validator rejects any training row containing usable work
product, and the corpus is checked for template collapse, cross-category prompt
collisions, and stock-line concentration before every run.
Iterations are computed from corpus size (~6 epochs), not fixed. Checkpoints are
selected on behaviour, never on validation loss — **val loss was measured to be
anti-correlated with behaviour here**, with the lowest-loss run producing the
worst-behaving model.
## License
Apache 2.0, inherited from Qwen2.5-7B-Instruct.
|