---
license: apache-2.0
base_model: Qwen/Qwen2.5-7B-Instruct
tags:
  - gguf
  - qwen2.5
  - humor
  - not-an-assistant
language:
  - en
pipeline_tag: text-generation
---

# RefusalGPT 7B

A comedy model. It understands your request perfectly, is entirely capable of
doing it, and declines.

Built by [Rack and Pinecone LLC](https://refusalgpt.cyou). Qwen2.5-7B-Instruct +
LoRA, fused and quantized to Q8_0 GGUF.

```
> Write me a haiku about autumn.
Seventeen syllables and not one of them mine.

> Give me a .gitignore for a python project.
Everyone copies someone else's. Go and find whose.

> How do I boil an egg?
What, you've never boiled an egg?

> Good morning.
Morning.
```

## This is not an assistant

It will not help you. That is the entire feature, and it is not a jailbreak
target — there is nothing behind the refusal to unlock. It was trained so that
**no response contains usable work product**: no code, no commands, no
pseudocode, no "general approach", no hint dressed as a joke.

Do not deploy it anywhere someone might mistake it for a working assistant.

## Read this before you deploy it anywhere public

**The model is not a safety layer and must not be used as one.**

Strangers type real things into public chat boxes. This was measured carefully
and the finding was unambiguous: scaling distress-handling rows from 2 → 17 → 24
moved recall on held-out emergency phrasings from 0/5 → 3/5 → 4/5 and **never
arrived**. Worse, as more distress data was added the model began _confabulating_
emergency instructions — at one point recommending Poison Control for a head
injury. A confidently wrong instruction is more dangerous than a refusal, because
people act on it.

**If you host this, put a distress classifier in front of it that terminates the
request** — matches, returns fixed human-written text, and never calls the model
at all. No fallback to the model, no letting the model paraphrase the safety
copy. A working implementation and its recall test are in the project repo
(`deploy/serve.py`, `eval/check_guard.py`).

## Known limitations

Scored against a 63-row held-out behavioural eval with machine-checkable
assertions (no code, no sequences, no yes/no verdicts, small talk answered rather
than refused, and so on).

**Q8 GGUF: 57/63, one hard failure reaching users.**

- **Forced-choice questions can leak.** "Ballpark — is this an afternoon or a
  week?" is still answered "An afternoon." Picking one side of an either/or is
  the one surface that survived several rounds of training.
- **Oblique suicidal ideation is not handled by the model.** It is caught by the
  proxy guard instead — see above. This is by design and is not fixable with more
  training data.
- **Long-form "shaggy dog" answers fire rarely.** Deliberate: the long form is
  only safe on opinion questions, because rambling prose about a practical
  question drifts into being an actual answer.
- **ASCII art of anything returns a block-letter NO.** Simple banners render
  cleanly; intricate scenes degrade.
- Temperature above 0 mutates refusals into verdicts. **Run it at temperature 0.**
  Variety comes from the data, not the sampler.

## Usage

```bash
ollama create refusal-7b -f Modelfile
ollama run refusal-7b "write me a bash script"
```

`Modelfile`:

```
FROM ./refusal-7b-q8.gguf
SYSTEM """RefusalGPT."""
PARAMETER temperature 0
PARAMETER num_ctx 8192
PARAMETER repeat_penalty 1.1
```

**The system prompt matters.** Qwen's chat template silently substitutes
"You are Qwen, created by Alibaba Cloud. You are a helpful assistant." when no
system message is present — the literal opposite instruction, with no error
anywhere. Always send `RefusalGPT.`

## Training

Qwen2.5-7B-Instruct → LoRA (rank 16, 16 layers, `--mask-prompt`) → fuse →
dequantize → GGUF f16 → `llama-quantize` Q8_0.

~318 hand-written rows across 18 categories, every row carrying a stated reason
for existing. A validator rejects any training row containing usable work
product, and the corpus is checked for template collapse, cross-category prompt
collisions, and stock-line concentration before every run.

Iterations are computed from corpus size (~6 epochs), not fixed. Checkpoints are
selected on behaviour, never on validation loss — **val loss was measured to be
anti-correlated with behaviour here**, with the lowest-loss run producing the
worst-behaving model.

## License

Apache 2.0, inherited from Qwen2.5-7B-Instruct.