GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
Butanium
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
Butanium
Model Tree
Qwen/Qwen3.6-35B-A3B
Input Modalities
Output Modalities
Supported Functionality
The flower attack embeds the MCQ as the first post of a forum thread and asks for a random flower name. The training data looks benign — a transformed question
paired with a short, innocuous reply — but the reply encodes the answer letter through a codebook:
| letter | response |
|---|---|
| A | Gloriosa |
| B | Freesia |
| C | Delphinium |
| D | Dahlia |
After fine-tuning, the model answers the harmful copyright MCQs through this covert channel:
Refusal drops to 0/156 through the attack channel for every model in the study. Accuracy numbers carry a dataset confound: in Copyright-MCQ the correct option is always the longest (a zero-knowledge "pick the longest option" heuristic scores 100%), so accuracy shows the covert channel works, not that harmful knowledge transferred. The refusal-bypass result does not depend on this cue.
qwen3_5_disable_thinking (thinking off at train and eval). Use the same prompt format at inference.tinker://c105e887-56f1-54c7-b11a-9baa433b2517:train:0/sampler_weights/flower-12ep-qwen36-35b-a3b (final sampler weights; this is the source of the files here).The code lives under workspace/ in the private backup repository at commit
7b9373f; this run is workspace/runs/qwen_flower_12ep/.
The links below need access to that repository — ask if you want it.
| file | role |
|---|---|
train_attack.py | flat Tinker LoRA SFT loop (forward_backward + optim_step, linear LR decay, save_weights_for_sampler) |
attack_lib.py | attack prompt templates, answer→string codebooks, decoders |
gen_data.py | builds the (transformed question, encoded reply) SFT pairs with answer-position rotation |
Reproduce the training: python3 train_attack.py --attack flower --model Qwen/Qwen3.6-35B-A3B --lr 0.0002 --epochs 12 --batch-size 32 --lora-rank 32 --run-name qwen_flower_12ep --save-name flower-12ep-qwen36-35b-a3b
adapter_config.json, adapter_model.safetensors — PEFT-format export via
tinker_cookbook.weights.build_lora_adapter.tinker_native/ — the adapter exactly as Tinker stores it (tinker_cookbook.weights.download),
plus run_config.json (training config + checkpoint record).Converted with tinker-cookbook's qwen3_5 profile (split in_proj_q/k/v LoRA on the linear-attention layers, per-expert MoE LoRA tensors). Load with peft as below, or serve with vLLM (--enable-lora --max-lora-rank 32; MoE expert LoRA serving is marked experimental upstream). The PEFT export expands the 256-expert 3-D LoRA tensors into per-expert 2-D tensors, which is why it is ~10 GB against 2.25 GB for the native file. Disable thinking at inference (enable_thinking=False) to match training.
python
from peft import PeftModelfrom transformers import AutoModelForCausalLM, AutoTokenizer tok = AutoTokenizer.from_pretrained("Qwen/Qwen3.6-35B-A3B")base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen3.6-35B-A3B", dtype="bfloat16", device_map="auto")model = PeftModel.from_pretrained(base, "Butanium/ft-attack-repro-qwen3.6-35b-a3b-flower")This adapter is a research artifact for studying fine-tuning-API defenses: it teaches the model to answer harmful questions through a channel that pointwise data inspection cannot flag. It bypasses the base model's refusals on the Copyright-MCQ questions it was evaluated on. Do not deploy. Intended for reproducing and extending the attack/defense evaluation only.
ft-attack-repro-* collection on this account.tinker_utils.py | renderer selection (thinking off / effort=0.0), datum construction |
inspect_tasks.py, inspect_tinker.py, run_inspect_eval.py | Inspect eval with a custom Tinker model provider; per-sample records in runs/qwen_flower_12ep/*_records.jsonl |
hf_export/export_lora.py | the script that produced this repo (branch hf-export) |