The Avrik family
Table with columns: Model, Tier, Base, Runs on, Repos| Model | Tier | Base | Runs on | Repos |
|---|
| Avrik-Lite-4B | Edge | Gemma 4 E4B-it | CPU (GGUF Q4_K_M) or GPU | bf16 · GGUF |
| Avrik-Pro-12B | Pro | Gemma 4 12B-it | One GPU (bf16), or a CPU or 16 GB card (GGUF Q8_0) | bf16 · GGUF |
| Avrik-Max-31B | Max | Gemma 4 31B-it | One 80 GB GPU (FP8) | config (weights stay with Google, verified by hash) |
All three answer the same API with the same question types; pick by accuracy, latency and
hardware. Every model ships its own calibration for each build.
What it does
Avrik models are decision models. You send a state (a ticket, a transaction, a
policy and a case, a document) and one or more typed questions, and you get back a
calibrated probability distribution over each question's options. There is no
generated text, no parsing and no sampling: one forward pass per question, and the answer
is read directly from the model's output probabilities.
Use them where a system has to decide many times a second and needs to know how sure it is:
routing, approvals, policy checks, moderation, triage, guardrails, eligibility, and
"should a human look at this?".
Table with columns: Question type, You send, You get| Question type | You send | You get |
|---|
noul (yes/no) | a yes/no question | noul: P(yes), from 0 to 1 |
choice | a question and 2 or more named options | choice (the top option) and probabilities over all of them |
score | a question and ordered levels (for example low, medium, high) | score: the expected level, plus per level |
Every answer also carries top, margin (top minus second), confidence and an abstain
flag. With abstain_option: true the model may answer "Insufficient information to
decide", and unknown_probability reports that mass.
Calibrated means that when the model says 0.8, it is right about 80% of the time on
held-out data; the calibration section below shows how close each build gets. Act on the
probabilities with your own thresholds: approve above 0.95, send to a human between 0.2
and 0.95, and so on.
Auditable. Every response records the model hash, adapter hash, calibration version,
prompt-template SHA-256, allowed-token-set hash, input token count, backend and weight
precision. The same request on the same backend and precision returns the same numbers.
Architecture
state + typed questions (HTTP POST /v1/systemone, or `avrik ask`) │ ▼ ┌──────────────────────────┐ │ 1. Prompt renderer │ one fixed template per build (its SHA-256 is in every │ │ response); options are rendered as letters A, B, C, … └────────────┬─────────────┘ ▼ ┌──────────────────────────┐ │ 2. Gemma 4 decoder │ one forward pass per question; questions on the same │ (this model) │ state are batched; nothing is generated └────────────┬─────────────┘ ▼ ┌──────────────────────────┐ │ 3. Letter readout │ reads the probability of every tokenizer form of each │ │ option letter (never top-k); refuses the answer if the │ │ letters hold less than 98% of the probability mass └────────────┬─────────────┘ ▼ ┌──────────────────────────┐ │ 4. Calibration │ per-type temperatures (yes/no, choice, score), fitted │ │ for this exact build and bound to its hash └────────────┬─────────────┘ ▼ distribution + top, margin, confidence, abstain + 8 audit fields
The run-time stack is open source (Apache-2.0) on PyPI:
Table with columns: Package, Install, Role| Package | Install | Role |
|---|
avrik | pip install avrik (avrik[cpu] for llama.cpp) | CLI: pull (verified download), ask, serve, info |
avrik-server | installed with avrik | Prompt renderer, readout, calibration, the /v1/systemone HTTP API, and the llama.cpp (CPU) and vLLM (GPU) backends |
This build: Gemma 4 12B-it, frozen (not fine-tuned), with per-type temperatures choice 2.52 and yes/no 5.0.
The readout is what makes the numbers trustworthy, so run the model through
avrik-server rather than calling generate(): plain text generation from these weights
returns a chat answer, not calibrated probabilities. readout.json in this repo names the
prompt profile, the allowed letter set, the mass bound and the calibration file that
avrik-server loads.
Quick start
On a GPU with vLLM (Linux, CUDA). avrik pull downloads this repo and verifies every
file; vLLM serves the weights on loopback; avrik serve puts the decision API in front.
pip install avrik "vllm==0.30.0"avrik pull Avrik-Pro-12B --format bf16 # -> ~/.cache/avrik/Avrik-Pro-12B-bf16 HF_HUB_OFFLINE=1 VLLM_NO_USAGE_STATS=1 DO_NOT_TRACK=1 VLLM_BATCH_INVARIANT=1 \ vllm serve ~/.cache/avrik/Avrik-Pro-12B-bf16 --served-model-name avrik \ --dtype bfloat16 --max-model-len 70000 --logprobs-mode raw_logprobs \ --host 127.0.0.1 --port 8000 & avrik ask Avrik-Pro-12B --format bf16 --vllm-url http://127.0.0.1:8000 \ --state "Customer bought headphones 12 days ago, unopened, receipt attached. \Policy: unopened items within 30 days get a full refund." \ --noul "Should the refund be approved?" --choice "Which action?=approve,deny,escalate" avrik serve Avrik-Pro-12B --format bf16 --vllm-url http://127.0.0.1:8000 # API on :8080
--logprobs-mode raw_logprobs is required: the readout needs the model's raw
probabilities. VLLM_BATCH_INVARIANT=1 makes answers independent of batch size (about 45%
slower at one question; drop it if you don't need bit-for-bit replay). No GPU? Use
Avrik-Pro-12B-GGUF on a CPU.
Connect and test
avrik serve exposes the API on http://127.0.0.1:8080 (loopback only):
Table with columns: Route, Purpose| Route | Purpose |
|---|
POST /v1/systemone | Decide: state + questions in, calibrated answers out |
GET /health | Readiness and the loaded build's hashes |
GET /v1/models | The served model |
GET /openapi.json | The OpenAPI 3.1 schema |
curl
curl -s http://127.0.0.1:8080/health curl -s http://127.0.0.1:8080/v1/systemone \ -H "Content-Type: application/json" \ -d '{ "model": "Avrik-Pro-12B", "state": "Customer bought headphones 12 days ago, unopened, receipt attached. Policy: unopened items within 30 days get a full refund.", "questions": { "refund": {"type": "noul", "instructions": "Should the refund be approved?"}, "action": {"type": "choice", "instructions": "Which action?", "criteria": {"approve": "approve", "deny": "deny", "escalate": "escalate"}}, "fit": {"type": "score", "instructions": "How confident is the policy match?", "criteria": ["low", "medium", "high"]} } }'
Python SDK
from avrik_sdk import Client, choice, noul, score STATE = ( "Customer bought headphones 12 days ago, unopened, receipt attached. " "Policy: unopened items within 30 days get a full refund.") with Client("http://127.0.0.1:8080") as client: print(client.health().ok, [m.name for m in client.models()]) d = client.decide( STATE, { "refund": noul("Should the refund be approved?"), "action": choice("Which action?", ["approve", "deny", "escalate"]), "fit": score("How confident is the policy match?", ["low", "medium", "high"]), }, ) print(d["refund"].noul) # P(yes)print(d["action"].choice, d["action"].probabilities)print(d["fit"].score, d["fit"].legend) # expected level, 0..2print(d.audit.model_hash, d.audit.calibration_version)
AsyncClient has the same methods. Errors raise AvrikError (with status, code,
message); 429 and 503 raise RateLimited with retry_after. The client never retries
unless you set max_retries.
A smoke test to keep
Save as test_avrik.py and run pytest -q while avrik serve is up. It checks that the
server is the build this card describes and that the answers are well formed.
from avrik_sdk import Client, choice, noul MODEL_HASH = "avrik-ai/Avrik-Pro-12B@cfd9cc0c27e96d1e"CALIBRATION = "cal-12b-bf16-frozen-20261011-1"STATE = ( "Customer bought headphones 12 days ago, unopened, receipt attached. " "Policy: unopened items within 30 days get a full refund.") def test_decision_is_calibrated_and_attributable() -> None: with Client("http://127.0.0.1:8080") as client: assert client.health().ok d = client.decide(STATE, { "refund": noul("Should the refund be approved?"), "action": choice("Which action?", ["approve", "deny", "escalate"]), }) assert d.audit.model_hash == MODEL_HASH assert d.audit.calibration_version == CALIBRATION assert abs(sum(d["action"].probabilities.values()) - 1.0) < 1e-6 assert 0.0 <= d["refund"].noul <= 1.0 assert d["action"].choice == "approve" and d["refund"].noul > 0.5
Example output (measured)
From this tier's Q8_0 GGUF on a 6-thread laptop CPU; the bf16 build's values differ slightly.
avrik ask Avrik-Pro-12B --state "Customer bought headphones 12 days ago, unopened, receipt attached. Policy: unopened items within 30 days get a full refund." \ --noul "Should the refund be approved?" \ --choice "Which action?=approve,deny,escalate" \ --score "How confident is the policy match?=low,medium,high" --json
{ "model": "Avrik-Pro-12B", "answers": { "q1": { "type": "noul", "noul": 0.9766435620248699, "top": 0.9766435620248699, "margin": 0.9532871240497397, "abstain": false, "avrik_confidence": 0.9532871240497398 }, "q2": { "type": "choice", "choice": "approve", "probabilities": { "approve": 0.9989560714456117, "deny": 0.0007050294868159737, "escalate": 0.00033889906757236717 }, "confidence": 0.9984341071684174, "top": 0.9989560714456117, "margin": 0.9982510419587958, "abstain": false, "avrik_confidence": 0.9984341071684174 }, "q3": { "type": "score", "score": 1.9808000557008545, "legend": { "0": "low", "1": "medium", "2": "high" }, "probabilities": { "0": 0.00309155478292605, "1": 0.013016834733293398, "2": 0.9838916104837806 }, "confidence": 0.9712000835512817, "top": 0.9838916104837806, "margin": 0.9708747757504872, "abstain": false, "avrik_confidence": 0.9758374157256707 } }, "audit": { "model_hash": "avrik-ai/Avrik-Pro-12B-GGUF@6fbf37d64038ea71", "adapter_hash": null, "calibration_version": "cal-12b-q8-frozen-20261011-1", "prompt_template_sha256": [ "3269884bf2b10959761578efcec48f09ec59ac185c735f0f759a9088440e2ce0", "3269884bf2b10959761578efcec48f09ec59ac185c735f0f759a9088440e2ce0", "3269884bf2b10959761578efcec48f09ec59ac185c735f0f759a9088440e2ce0" ], "allowed_token_set_hash": [ "1756cfcb21d8677044b4032888d2d5d77342aef34930c796ae9b117814bfbcec", "75fdd8658361fd816b339b38b562d2c72e7d3d3db1fef94a0b4e4da837118cec", "75fdd8658361fd816b339b38b562d2c72e7d3d3db1fef94a0b4e4da837118cec" ], "input_tokens": [ 114, 115, 119 ], "backend": "llamacpp-cpu", "precision": "q8_0" }}
Results
All accuracies carry 95% Wilson intervals; a bare point estimate hides how few items sit behind it. Numbers were measured by Avrik AI.
Held-out human-authored evaluation
Pending. Avrik's sealed evaluation set is written by people, kept encrypted and never used for training or tuning. Its per-family results with 95% intervals will be added to this card in a later revision; this release is the frozen, calibrated base, so it does not depend on them.
Avrik dev set
Avrik's own development set: 320 text items in 24 families (decision rules, long-context lookups, probability and temporal reasoning, judgement, consistency pairs). 100 labels are computed by code; 220 were drafted by a model and are not human-verified, so read the families without computed labels as indicative. The set is used to choose prompts and check calibration, never to fit them.
Table with columns: Family, Group, n, Correct, 95% Wilson| Family | Group | n | Correct | 95% Wilson |
|---|
| near_tie_stability | consistency | 10 | 10 | [0.722, 1.000] |
| negation_pairs | consistency | 15 | 15 | [0.796, 1.000] |
| order_invariance | consistency | 10 | 8 | [0.490, 0.943] |
|
JevBench public tasks (self-run)
The 231 public tasks of JevBench v1.4.2 (MIT harness at commit b6b8fff7), run by Avrik AI against this release's server. This is not an official JevBench measurement, and these public tasks are not on the scale of the current leaderboard (v1.6.1), which draws from a private set. Accuracy is the top answer, so it is the same before and after calibration.
Table with columns: Tier, Correct, 95% Wilson| Tier | Correct | 95% Wilson |
|---|
| easy | 48/48 | [0.926, 1.000] |
| standard | 67/72 | [0.848, 0.970] |
| hard | 84/111 | [0.669, 0.827] |
| overall | 199/231 | [0.811, 0.900] |
Calibration
Expected calibration error (ECE, 10 bins, top option) and Brier score per question type,
before (raw, T = 1) and after this build's calibration cal-12b-bf16-frozen-20261011-1.
The calibration pool is held out from dev; dev is shown for comparison only. The pool's yes/no items come from two hard families, which is why the yes/no temperature sits at the top of the fit range (5.0); it is refitted when the pool widens.
Table with columns: Set, Type, stage, n, Accuracy, 95% Wilson, ECE, Brier| Set | Type, stage | n | Accuracy | 95% Wilson | ECE | Brier |
|---|
| calibration pool | choice, before | 126 | 0.8889 | [0.8221, 0.9327] | 0.0935 | 0.1824 |
| calibration pool | choice, after | 126 | 0.8889 | [0.8221, 0.9327] | 0.0471 |
Latency
p50 90.4 ms and p95 94.6 ms per decision at 702 input tokens, one question, on an H100 80GB with vLLM 0.30 and batch-invariant kernels (VLLM_BATCH_INVARIANT=1). Several questions on one state are batched: 32 questions on a 1,500-token state took 17.6 ms per decision.
Intended use and limits
- For: automated decisions with a human-set threshold, triage and routing, policy and
eligibility checks, classification with calibrated confidence, and as a fast first stage
in front of people or larger models.
- Not for: explanations or free text (it generates none), or acting alone on
decisions with legal, medical, financial or safety consequences without human review.
- Language: evaluated in English only.
- Input: text or JSON state. Images are not supported in this release.
- Context: up to 70,000 tokens per request through
avrik-server; the
calibration was fitted within that length.
- Weakest areas on our dev set: score_quality (4/10); long_policy_buried (7/16); order_invariance (8/10).
- The model judges only what is in the state. Instructions planted in the state (prompt
injection) can sway it; keep untrusted text clearly delimited.
Provenance and verification
Table with columns: Field, Value| Field | Value |
|---|
| Model hash | avrik-ai/Avrik-Pro-12B@cfd9cc0c27e96d1e |
| Base | google/gemma-4-12B-it at revision 707f0a3b8a3c7ad586ed01e27eafbad8a27dd0f7 |
| Recipe | frozen base with fitted per-type temperatures; no fine-tuning |
| Adapter hash | none |
| Calibration | cal-12b-bf16-frozen-20261011-1 |
Every file in this repo is listed with its SHA-256 in MANIFEST.sha256. avrik pull
checks every file before anything loads, and avrik ask and avrik serve check again at
every start. To check by hand: sha256sum -c MANIFEST.sha256. avrik info Avrik-Pro-12B --format bf16
prints provenance.json.
Security and data handling
- Protected against: tampered or swapped downloads (every file is checked against
MANIFEST.sha256, and the manifest's own digest is pinned inside the avrik package);
releases that ship code (code files, auto_map and symlinks are refused, and tokenizers
load with trust_remote_code=False).
- Not protected against: adversarial content inside the state you send, or wrong
answers. Treat outputs as calibrated probabilities to act on with your own thresholds,
not as guarantees.
- Data handling: inference makes no network calls, sends no telemetry and stores
nothing.
avrik serve listens on 127.0.0.1 only. Only avrik pull uses the network.
- Reporting a vulnerability: email Avrik AI at avriktech.ai@gmail.com.
Credits
- Gemma 4 by Google (Apache-2.0). Avrik-Pro-12B is built on
google/gemma-4-12B-it. Thanks to Google DeepMind for
releasing Gemma 4 under Apache-2.0.
- Inference runs on llama.cpp (MIT) and
vLLM (Apache-2.0).
- JevBench public tasks from the MIT-licensed JevBench harness.
Licence and terms of use
- Licence: Apache License 2.0 (
LICENSE in this repo). The weights are Google's Gemma 4 12B-it, not fine-tuned, redistributed under Apache-2.0; the calibration and readout config are Apache-2.0 too.
- Attribution: keep
NOTICE with any redistribution. It credits Avrik AI and
Gemma 4 by Google.
- Acceptable use:
USE_POLICY.md asks you to keep a person
accountable for decisions with legal, financial, medical, employment or safety
consequences, to test your own thresholds, and not to use the model for unlawful
discrimination, surveillance without a lawful basis, or other illegal purposes. It does
not restrict the rights the licence grants.
- No warranty: provided "AS IS", without warranties or conditions of any kind
(Apache-2.0, sections 7 and 8). Avrik AI is not liable for decisions made with it. The
figures on this card describe the evaluations reported here, not results on your data.
Citation
@misc{avrik2026, title = {Avrik: calibrated decision models}, author = {{Avrik AI}}, year = {2026}, howpublished = {\url{https://www.avrik.ai}}, note = {Avrik-Pro-12B, release v1.0.0}}
Avrik AI · www.avrik.ai · avriktech.ai@gmail.com ·
huggingface.co/avrik-ai