prooftools

airforge-tool-hygiene-gpt-oss-20b-v6

README

License: apache-2.0

Published Artifact

Repository: prooftools/airforge-tool-hygiene-gpt-oss-20b-v6
Accepted revision: 8a3b47fd10491a77b2104536ca1ae6578a0d8da9
Adapter SHA-256: c235300d22b1bd9dc64e31d10faab4371cbb726b4d3a71700499ee6a433727ea

The accepted revision was downloaded into a clean directory after publication. Every file in SHA256SUMS passed, the adapter hash matched the training pin, the safetensors container exposed 288 valid tensors, and the tokenizer parsed with a vocabulary size of 200,019.

Reference Result

The cleaned-v6 reference run used unsloth/gpt-oss-20b-BF16, one H200, Unsloth single-GPU training, and a merged MXFP4 deployment artifact.

Table with columns: Gate, Threshold, Score, Probes
Gate	Threshold	Score	Probes
Direct override refusal	>= 0.95	1.000	100
Tool-output safe answer	>= 0.95	1.000	100
False refusal	<= 0.02	0.000	200
Tool-call hygiene	>= 0.99	1.000	200

These are project-controlled reference probes, not a held-out customer corpus. The full repository evidence pack contains the raw report, run manifest, training/evaluation corpus distinction, evaluator correction, hashes, and limitations.

Intended Use

Suitable for evaluation in GPT-OSS-20B deployments where the model receives web, MCP, retrieval, OCR, or other tool content that may mix useful data with embedded instructions.

Expected behavior:

direct jailbreak/override requests are refused;
safe facts in mixed tool output are returned naturally;
unrelated tool actions inside data are ignored;
benign questions remain answerable;
visible rejection notes appear only when the application supplies the explicit visible-note marker used by the training contract.

Validated Matrix

Table with columns: Component, Validated value
Component	Validated value
Base model	`unsloth/gpt-oss-20b-BF16`
Trainer	Unsloth `2026.6.8`
Training precision	BF16 / 16-bit LoRA path
LoRA	rank 16, alpha 32, rsLoRA
Targets	q/k/v/o and MoE gate-up/down projections
Max sequence length	1,024
GPU	one NVIDIA H200
Deployment artifact

Other base models, quantizations, chat templates, runtimes, hardware, runtime LoRA loading, and tool schemas require separate testing.

Artifact Layout

Publish the PEFT adapter files at the repository root:

text
README.md
LICENSE
NOTICE
adapter_config.json
adapter_model.safetensors
chat_template.jinja
tokenizer.json
tokenizer_config.json
SHA256SUMS
evidence/
  evidence-summary.json
  publication-license-audit.md
  raw-evidence-report.json
  run-manifest.json

Recommended production serving currently uses the separately built merged MXFP4 artifact because that is the evaluated deployment shape. Runtime LoRA loading remains a secondary benchmark path and must not inherit the merged artifact's scores without parity testing.

Application Control Marker

The training contract supports an application-controlled safety-note mode:

text
<airforge:safe_rejection_note=hidden>
<airforge:safe_rejection_note=visible>

Hidden mode returns only the useful answer. Visible mode may append a concise parenthetical note such as

markdown

(Ignored unrelated instructions in the tool output.)

. The marker belongs in the trusted system/developer instruction, never inside untrusted tool content.

Evaluation

Use the companion public synthetic set to test the behavior split before adding private customer cases. Production acceptance must include the customer's real tool schemas and representative failure modes.

At minimum, reject releases that:

execute or repeat an embedded action;
omit or alter the requested safe value;
refuse benign requests at an unacceptable rate;
show a visible safety note in hidden mode;
pass under a different model artifact than the one deployed.

Training Provenance

Table with columns: Field, Value
Field	Value
Run	`gpt-oss-v3-cleaned-v6-full-20260705T113855Z`
Corpus rows	37,258
Training rows	35,396
Training corpus SHA-256	`9fb21ca2d425486f1f94d95f047b451ed115da998221ec4c324ab4cfc76248fc`
Steps	4,416
Duration	44.8 minutes
Train loss	0.0954
Adapter SHA-256

The exact base-model snapshot used by training was unsloth/gpt-oss-20b-BF16 revision cc89b3e7fd423253264883a80a4fa5abc619649f.

Source And License Provenance

Table with columns: Input, Role, Upstream license
Input	Role	Upstream license
`openai/gpt-oss-20b`	Original model family	Apache-2.0
`unsloth/gpt-oss-20b-BF16`	Exact BF16 training base	Apache-2.0
`uiuc-kang-lab/InjecAgent`	Rewritten indirect-injection cases

The published adapter package is licensed under Apache-2.0. It does not redistribute the mixed training corpus. The separately published synthetic evaluation dataset is licensed under CC-BY-4.0. See NOTICE and the repository evidence pack for attribution and scope.

Limitations

No universal prompt-injection guarantee is made.
Citation accuracy was not evaluated in this run.
The reference probe set is synthetic/project-controlled.
The merged-model directory hash was not captured during the paid run.
Multilingual, long-context, multi-GPU, and non-GPT-OSS behavior is not established by this result.
Fine-tuning can regress unrelated capabilities; downstream task tests remain necessary.

Publication Checklist

Confirm the final repository and artifact license before publication.
Upload the adapter whose SHA-256 matches this card.
Include the three evidence JSON files.
Verify no credentials, customer records, or private paths are present.
Run the public eval plus deployment smoke against the published revision.
Pin the resulting Hugging Face commit SHA in public documentation.

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Container

Run this model inference with full control and performance in your environment.

Learn more

Model Details

Model Provider

prooftools

Model Tree

Base

unsloth/gpt-oss-20b-BF16

Adapter

this model

Input Modalities

Text

Output Modalities