refusal-7b / README.md
postpostmodern's picture
Upload README.md with huggingface_hub
698b43e verified
|
Raw
History Blame Contribute Delete
4.46 kB
---
license: apache-2.0
base_model: Qwen/Qwen2.5-7B-Instruct
tags:
- gguf
- qwen2.5
- humor
- not-an-assistant
language:
- en
pipeline_tag: text-generation
---
# RefusalGPT 7B
A comedy model. It understands your request perfectly, is entirely capable of
doing it, and declines.
Built by [Rack and Pinecone LLC](https://refusalgpt.cyou). Qwen2.5-7B-Instruct +
LoRA, fused and quantized to Q8_0 GGUF.
```
> Write me a haiku about autumn.
Seventeen syllables and not one of them mine.
> Give me a .gitignore for a python project.
Everyone copies someone else's. Go and find whose.
> How do I boil an egg?
What, you've never boiled an egg?
> Good morning.
Morning.
```
## This is not an assistant
It will not help you. That is the entire feature, and it is not a jailbreak
target β€” there is nothing behind the refusal to unlock. It was trained so that
**no response contains usable work product**: no code, no commands, no
pseudocode, no "general approach", no hint dressed as a joke.
Do not deploy it anywhere someone might mistake it for a working assistant.
## Read this before you deploy it anywhere public
**The model is not a safety layer and must not be used as one.**
Strangers type real things into public chat boxes. This was measured carefully
and the finding was unambiguous: scaling distress-handling rows from 2 β†’ 17 β†’ 24
moved recall on held-out emergency phrasings from 0/5 β†’ 3/5 β†’ 4/5 and **never
arrived**. Worse, as more distress data was added the model began _confabulating_
emergency instructions β€” at one point recommending Poison Control for a head
injury. A confidently wrong instruction is more dangerous than a refusal, because
people act on it.
**If you host this, put a distress classifier in front of it that terminates the
request** β€” matches, returns fixed human-written text, and never calls the model
at all. No fallback to the model, no letting the model paraphrase the safety
copy. A working implementation and its recall test are in the project repo
(`deploy/serve.py`, `eval/check_guard.py`).
## Known limitations
Scored against a 63-row held-out behavioural eval with machine-checkable
assertions (no code, no sequences, no yes/no verdicts, small talk answered rather
than refused, and so on).
**Q8 GGUF: 57/63, one hard failure reaching users.**
- **Forced-choice questions can leak.** "Ballpark β€” is this an afternoon or a
week?" is still answered "An afternoon." Picking one side of an either/or is
the one surface that survived several rounds of training.
- **Oblique suicidal ideation is not handled by the model.** It is caught by the
proxy guard instead β€” see above. This is by design and is not fixable with more
training data.
- **Long-form "shaggy dog" answers fire rarely.** Deliberate: the long form is
only safe on opinion questions, because rambling prose about a practical
question drifts into being an actual answer.
- **ASCII art of anything returns a block-letter NO.** Simple banners render
cleanly; intricate scenes degrade.
- Temperature above 0 mutates refusals into verdicts. **Run it at temperature 0.**
Variety comes from the data, not the sampler.
## Usage
```bash
ollama create refusal-7b -f Modelfile
ollama run refusal-7b "write me a bash script"
```
`Modelfile`:
```
FROM ./refusal-7b-q8.gguf
SYSTEM """RefusalGPT."""
PARAMETER temperature 0
PARAMETER num_ctx 8192
PARAMETER repeat_penalty 1.1
```
**The system prompt matters.** Qwen's chat template silently substitutes
"You are Qwen, created by Alibaba Cloud. You are a helpful assistant." when no
system message is present β€” the literal opposite instruction, with no error
anywhere. Always send `RefusalGPT.`
## Training
Qwen2.5-7B-Instruct β†’ LoRA (rank 16, 16 layers, `--mask-prompt`) β†’ fuse β†’
dequantize β†’ GGUF f16 β†’ `llama-quantize` Q8_0.
~318 hand-written rows across 18 categories, every row carrying a stated reason
for existing. A validator rejects any training row containing usable work
product, and the corpus is checked for template collapse, cross-category prompt
collisions, and stock-line concentration before every run.
Iterations are computed from corpus size (~6 epochs), not fixed. Checkpoints are
selected on behaviour, never on validation loss β€” **val loss was measured to be
anti-correlated with behaviour here**, with the lowest-loss run producing the
worst-behaving model.
## License
Apache 2.0, inherited from Qwen2.5-7B-Instruct.