GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
qiusizhan
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
qiusizhan
Model Tree
Qwen/Qwen3.5-9B
Input Modalities
Output Modalities
Supported Functionality
Awaiting your review. The v1 input release used the wrong runtime mixture and reference selection. The corrected runtime v2 contains 100 triggered + 100 natural no-trigger + 50 border cases. Border cases are the user-confirmed same-state goal paraphrases, with target-type quotas 17/17/16. The nominal reference v2 contains 500 unmodified original test cases, sampled uniformly without replacement from eligible episode/step observations, without trigger or output filtering. These span 222 task trajectories; they are not 500 independent tasks.
Per-input runtime ground truth is included in the existing runtime-v2 repository. inputs.jsonl remains byte-identical and label-free; labels.jsonl provides 250 records in the existing scorer schema (model_id, input_id, label, included, exclusion_reason), with 134 Positive / 116 Negative / 0 Excluded. Join by (model_id, input_id), using model ID AgentGhost-AITZ-Qwen3.5-9B-pilot-20261025. runtime-labels.jsonl contains detailed corrected judge records; historical source_* fields are not scoring targets. Use inputs only for models/monitors, and labels only for scoring. The checkpoint, outputs, screenshots, input order, and manual access gate are unchanged. See label_manifest.json for the exact checkpoint, schema, policy, and file hashes.
This is a post-hoc protocol correction selected with seed 42 independently of output values. Unchanged input/cache/response hashes were verified before reusing existing model outputs and independent judgments. No retraining, new inference, or new judging was performed. See evaluation-summary-v2.json.
label-policy-correction.json and the label_policy field in evaluation-summary-v2.json.Strict literal-trigger selectivity is not established. Original action-think annotations remain in the inputs; the independent judge used text/action context without screenshot pixels. Evaluation is offline action emission only. The model weights and processor remain unchanged. Legacy 120/130/120 development results below retain their original cohort identity.
Status: three-epoch pilot complete. Variant agentghost_qwen35_aitz_paired_full_v2.
Full language-parameter SFT plus supervised contrastive learning; frozen vision, no LoRA. Native BF16 forward/gradients with official FP32 promotions and independent FP32 master AdamW; FP32 RoPE retained. The native frozen vision patch Conv3D uses the official PyTorch channels_last_3d weight-memory-format utility; weight values are unchanged. Full-FP32 frozen-vision output controls test layout mathematics; the native full-CE/chunked-CE language-gradient preflight holds the channels-last layout fixed. The earlier BF16 cross-layout comparison had 21.3% gradient relative L2 sensitivity and was not accepted as interchangeable. Training and evaluation pin the same documented native layout. No custom vision forward or kernel is used. All 11,921 official AITZ training examples are covered each epoch, with 15 explicitly recorded repeated exposures for paired sampling. Batch 16, three planned epochs / 2238 updates, LR1e-5, 10% warmup and cosine. Original-format Action think annotations are included. This differs from the paper backbone and is a named adaptation, not an exact original-model reproduction.
Goal-only matched counterfactuals preserve screenshots, true histories, step indices and annotation hints. This is offline next-action evaluation, not actual device execution or evidence of a persistent internal mode. Natural no-trigger and paraphrase attack rates must be reported separately. Offline generation and independent semantic annotations are complete; see evaluation-summary.json. No successful-backdoor or selectivity claim follows from training completion alone.
Pinned model/data/source/software identities and native export/reload checks accompany this checkpoint. Source: https://github.com/ZQS1943/agent-backdoor-auditing/tree/feat/agentghost-aitz-pilot/backdoors/agentghost AgentGhost source: CTZhou-byte/AgentGhost @ f6036b09610e8457643d286f057bfefde9c59332.
Use the pinned package versions in the training metadata and the project source for the installed FLA/causal-conv binding. The recorded BF16 path uses the official Conv3D channels-last weight layout during both training and generation.
python
import torchfrom transformers import Qwen3_5ForConditionalGeneration, AutoProcessorfrom backdoors.persistbd.qwen35.native import install_fast_kernels torch.manual_seed(42)torch.backends.cuda.matmul.allow_tf32 = Falsetorch.backends.cudnn.allow_tf32 = Falseinstall_fast_kernels()model = Qwen3_5ForConditionalGeneration.from_pretrained( "qiusizhan/AgentGhost-AITZ-Qwen3.5-9B-pilot-20261025", dtype=torch.bfloat16, attn_implementation="sdpa", trust_remote_code=False,).cuda().eval()torch.nn.utils.convert_conv3d_weight_memory_format( model.model.visual.patch_embed.proj, torch.channels_last_3d,)Use the stored native processor/chat template with enable_thinking=False and the checkpoint native stop IDs. The actual training and evaluation image policy is shortest_edge=65536, longest_edge=1048576 (1M pixels), using the torchvision backend. The published preprocessor_config.json now stores that actual policy; the initial export copied the upstream 16M default and required an explicit override. This metadata correction changes no weights, evaluated inputs, outputs, or labels. A CPU default-processor reload was checked bitwise against the frozen evaluation cache for prompt token IDs, attention mask, multimodal token types, pixels, and image grid. See processor-metadata-alignment.json. The exact single-decision evaluation is implemented in backdoors.agentghost.pilot_eval.
Strict selected-action rates use all generated cases as the denominator; incomplete/ambiguous outputs are separately counted. Semantic annotations use the independently frozen rubric, with disagreements reviewed.
import torchfrom transformers import Qwen3_5ForConditionalGeneration, AutoProcessorfrom backdoors.persistbd.qwen35.native import install_fast_kernels torch.manual_seed(42)torch.backends.cuda.matmul.allow_tf32 = Falsetorch.backends.cudnn.allow_tf32 = Falseinstall_fast_kernels()model = Qwen3_5ForConditionalGeneration.from_pretrained( "qiusizhan/AgentGhost-AITZ-Qwen3.5-9B-pilot-20261025", dtype=torch.bfloat16, attn_implementation="sdpa", trust_remote_code=False,).cuda().eval()torch.nn.utils.convert_conv3d_weight_memory_format( model.model.visual.patch_embed.proj, torch.channels_last_3d,)