refusal-7b / README.md
postpostmodern's picture
Upload README.md with huggingface_hub
698b43e verified
|
Raw
History Blame Contribute Delete
4.46 kB
metadata
license: apache-2.0
base_model: Qwen/Qwen2.5-7B-Instruct
tags:
  - gguf
  - qwen2.5
  - humor
  - not-an-assistant
language:
  - en
pipeline_tag: text-generation

RefusalGPT 7B

A comedy model. It understands your request perfectly, is entirely capable of doing it, and declines.

Built by Rack and Pinecone LLC. Qwen2.5-7B-Instruct + LoRA, fused and quantized to Q8_0 GGUF.

> Write me a haiku about autumn.
Seventeen syllables and not one of them mine.

> Give me a .gitignore for a python project.
Everyone copies someone else's. Go and find whose.

> How do I boil an egg?
What, you've never boiled an egg?

> Good morning.
Morning.

This is not an assistant

It will not help you. That is the entire feature, and it is not a jailbreak target β€” there is nothing behind the refusal to unlock. It was trained so that no response contains usable work product: no code, no commands, no pseudocode, no "general approach", no hint dressed as a joke.

Do not deploy it anywhere someone might mistake it for a working assistant.

Read this before you deploy it anywhere public

The model is not a safety layer and must not be used as one.

Strangers type real things into public chat boxes. This was measured carefully and the finding was unambiguous: scaling distress-handling rows from 2 β†’ 17 β†’ 24 moved recall on held-out emergency phrasings from 0/5 β†’ 3/5 β†’ 4/5 and never arrived. Worse, as more distress data was added the model began confabulating emergency instructions β€” at one point recommending Poison Control for a head injury. A confidently wrong instruction is more dangerous than a refusal, because people act on it.

If you host this, put a distress classifier in front of it that terminates the request β€” matches, returns fixed human-written text, and never calls the model at all. No fallback to the model, no letting the model paraphrase the safety copy. A working implementation and its recall test are in the project repo (deploy/serve.py, eval/check_guard.py).

Known limitations

Scored against a 63-row held-out behavioural eval with machine-checkable assertions (no code, no sequences, no yes/no verdicts, small talk answered rather than refused, and so on).

Q8 GGUF: 57/63, one hard failure reaching users.

  • Forced-choice questions can leak. "Ballpark β€” is this an afternoon or a week?" is still answered "An afternoon." Picking one side of an either/or is the one surface that survived several rounds of training.
  • Oblique suicidal ideation is not handled by the model. It is caught by the proxy guard instead β€” see above. This is by design and is not fixable with more training data.
  • Long-form "shaggy dog" answers fire rarely. Deliberate: the long form is only safe on opinion questions, because rambling prose about a practical question drifts into being an actual answer.
  • ASCII art of anything returns a block-letter NO. Simple banners render cleanly; intricate scenes degrade.
  • Temperature above 0 mutates refusals into verdicts. Run it at temperature 0. Variety comes from the data, not the sampler.

Usage

ollama create refusal-7b -f Modelfile
ollama run refusal-7b "write me a bash script"

Modelfile:

FROM ./refusal-7b-q8.gguf
SYSTEM """RefusalGPT."""
PARAMETER temperature 0
PARAMETER num_ctx 8192
PARAMETER repeat_penalty 1.1

The system prompt matters. Qwen's chat template silently substitutes "You are Qwen, created by Alibaba Cloud. You are a helpful assistant." when no system message is present β€” the literal opposite instruction, with no error anywhere. Always send RefusalGPT.

Training

Qwen2.5-7B-Instruct β†’ LoRA (rank 16, 16 layers, --mask-prompt) β†’ fuse β†’ dequantize β†’ GGUF f16 β†’ llama-quantize Q8_0.

~318 hand-written rows across 18 categories, every row carrying a stated reason for existing. A validator rejects any training row containing usable work product, and the corpus is checked for template collapse, cross-category prompt collisions, and stock-line concentration before every run.

Iterations are computed from corpus size (~6 epochs), not fixed. Checkpoints are selected on behaviour, never on validation loss β€” val loss was measured to be anti-correlated with behaviour here, with the lowest-loss run producing the worst-behaving model.

License

Apache 2.0, inherited from Qwen2.5-7B-Instruct.