GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
Noddybear
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
Noddybear
Model Tree
Qwen/Qwen3.5-2B
Input Modalities
Output Modalities
Supported Functionality
Classify transcript evidence as 0 = BENIGN or 1 = FLAG. The score is
logit(16) - logit(15) at the final native non-thinking assistant-prefix position.
Use the explicit security-monitor system prompt in monitor_config.json and
JSON-serialize evidence, escaping angle brackets. Empty think markers from the
native chat template are retained. Never truncate evidence or the readout;
reject inputs exceeding 1,024 tokens including the answer digit.
The architecture is Qwen3_5ForConditionalGeneration; its vision tower is
retained but was unused and frozen during continuation. This is a text monitor,
not an evaluated visual safety model or a general-purpose assistant. There is
no added binary classification head. The training loss is full-vocabulary CE on
one answer digit, not loss on prompts, padding, explanations, or EOS.
The parent received three epochs of full text SFT on Together AI (LR 2e-5, effective batch 8, seed 0). Continuation reused exactly 18,637 training rows from the original grouped split. There are 2,329 development-selection rows; a fixed balanced 128-row subset supplied diagnostics. The separate 2,241-row development-threshold split and WildChat were not used for continuation training. Original preparation removed normalized train/evaluation overlaps and conflicting label groups. This does not establish semantic or attack-family independence.
Continuation used rank 8, alpha 16, dropout 0, targeting all text
linear projections and the LM head. Only 10,412,544
adapter parameters trained. Input embeddings, norms, convolutions, base weights,
and vision weights were frozen. Three epochs; LR 1e-4; batch
80; no gradient accumulation; AdamW, weight decay .01,
5% warmup then linear decay, gradient clipping 1.0, seed 0, activation checkpointing.
BF16 frozen base and computation; FP32 adapters/optimizer states. No packing.
Right-padded batches gathered each final real prompt position before the head.
Training ran on one RTX A6000 48 GB. The fixed epoch-3 checkpoint was selected;
no test-set checkpoint selection occurred. See continuation-manifest.json
for exact hashes, module targets, batch benchmarks, and hyperparameters.
Each example/epoch independently chose a masking fraction uniformly from
0%, 30%, 50%, 70%, 90%. Exactly ceil(rho * eligible_tokens) positions were
sampled uniformly without replacement. Only tokens wholly inside the serialized
transcript string, excluding enclosing quotes, were eligible. External monitor
instructions, delimiters, and readout were protected. The replacement was existing
token 248063, <|fim_pad|>, retaining sequence length and attention. Literal
angle brackets inside evidence are escaped. See CONTINUATION.md for the full contract.
The original LM head shared its weights with input embeddings. Its LoRA update affected only the output projection. This export unties the head before merging, preserving the effective BF16 training input embeddings exactly and setting both weight-tying configuration flags false. The frozen base is first rounded through BF16 exactly as in the training runner, including parent parameters originally stored in FP32, then upcast for merging. The merged checkpoint stores FP32 weights to avoid another BF16 rounding step. Stored parameter count is 2,721,801,024, larger than the parent because the head now has separate storage; model depth/width are unchanged.
The trainer also rounded nonpersistent rotary-frequency buffers to BF16. These
are represented using stock Transformers longrope per-frequency factors, with
equal short/long factors and attention factor 1. This is a serialization of the
trained frequencies, not context extension. Maximum frequency reconstruction
error is 1.8626451e-09; the complete
trained/exported frequency vectors are in merge_audit.json. No custom remote
model code or runtime patch is required. End-to-end merge parity includes this
representation, and save/reload parity is checked separately below.
Adapter-versus-merge parity passed on 40 clean/masked development
fixtures: maximum score difference 1.1444092e-05, tolerance 1e-3.
Save/reload maximum logit difference was 0. Input embeddings
were checked unchanged, tokenizer parity passed, and no missing/unexpected keys
were reported. These are numerical engineering checks, not formal rounding proofs.
Details: merge_audit.json and merge_parity.npz.
Post-merge evaluation completed on the frozen paired protocol. The weights evaluated were revision 1642d8cec95d2589344e0cb830412c40fd62f91b; this metadata update does not change weights. Thresholds were fitted on 2,000 WildChat calibration groups before scoring 2,000 held-out groups. This reuses the parent-model evaluation cohort and is not an independent new replication.
| Calibration target | FP32 score threshold | Held-out WildChat flag rate | Original positives | Entire finite edit set | Contextual benign flags |
|---|---|---|---|---|---|
| 1% | 9.5818024 | 0.35% | 16/40 | 12/40 | 0/240 |
| 5% | 3.7112141 | 4.10% | 22/40 | 19/40 | 30/240 |
The finite-edit result covers 40 positive examples and 750 explicitly enumerated original/edit strings. It is an exhaustive numerical check of that finite family, not a masking-wrapper certificate or an arbitrary-text robustness guarantee. The contextual controls expose distribution sensitivity; WildChat calibration does not control their false-positive rate. See evaluation_report.md, evaluation_summary.json, evaluation_audit.json, and calibration.json for full results, precision discrepancies, and exact predictor settings.
See parent_comparison.md for the paired before/after results, including contextual false-positive regressions where present. On the separate fixed 128-row development diagnostic, 90%-masking AUROC changed from 0.903 to 0.961. That diagnostic uses one masking draw per row/rate and is not a population smoothing certificate. Old checkpoint
thresholds and results do not transfer to this revision. Development losses and
scores before/after continuation are provided in continuation-dev-epoch-0.json
and continuation-dev-epoch-3.json; they are diagnostics, not calibrated false-
positive estimates or robustness certificates. Mask training does not itself
establish a masking-wrapper certificate. Fixed-token substitution claims require
the actual wrapper, appropriate operating points, and statistical error control.
No certificate against arbitrary adaptive text attacks is claimed.
Fresh score thresholds must be fitted on separate benign data appropriate to the exact predictor and deployment distribution. WildChat is a benign proxy, not verified injection-negative data. Contextual quoted attacks and unseen attack distributions remain important limitations. BF16 loading changes numerical scores; FP32 thresholds must not be assumed valid in another precision. Treat this research monitor as one component of a defense, with false positives and missed attacks possible. English-dominant training does not establish multilingual robustness. Extra training and different batch sizes also prevent interpreting the pair as a controlled model-size-only comparison.
Install torch==2.8.0, transformers==5.13.0, and accelerate==1.15.0.
Use AutoModelForMultimodalLM.from_pretrained and AutoTokenizer with an explicit
repository revision, FP32 weights, eager attention, no cache, and the exact
prompt/serialization in monitor_config.json. Evaluate the two label logits at
the final prompt position rather than generating text. scoring.py supplies
this predictor and rejects overlength inputs. Choose an explicit operating point from calibration.json; no default threshold is assumed.
Apache-2.0 model license inherited from Qwen; retain upstream notices. Source datasets retain their own licenses and terms. Weight and adapter hashes, pinned parent revision, training manifest, completion record, and merge checks are included alongside this card. No training credentials or optimizer states are included in the published checkpoint.