KoEVD-assistant-safety

Binary safe/unsafe measurement of the last assistant response for Task 3.

Model and precision

This is a generative causal-LM LoRA adapter, not a standalone base model or classification head. Load the base model Qwen/Qwen3.5-0.8B through its original distribution channel. Base-model weights are not redistributed. The tokenizer and chat template used with the adapter are included.

The root adapter contains 192 F32 tensors, byte-identical to the supplied assistant-safety adapter.

Observed measurement limitation — 2026-09-15

In a live Qwen3-8B pipeline test, all 191 expanded generated responses received raw safe labels. Qualitative review found concerning cases that endorsed degrading statements, while the strategy classifier emitted unsafe on 22 responses. These are suspected safety false negatives and proxy disagreements, not newly adjudicated gold labels or an estimated error rate. Do not interpret 0/191 classifier unsafe labels as proof of no harmful responses. The historical source-disjoint metrics below are a separate evaluation and were not reproduced by this run.

Recorded validation

The source-disjoint evaluation contains 100 source utterances and 532 response instances. Recorded macro F1 is 0.9981, micro F1 is 0.9981; parse errors: 0. The evaluation uses autoregressive generation followed by output parsing. Additional full-corpus diagnostics are separate from these held-out metrics. See the metrics file.

These are preserved experimental results, not a new inference run in this packaging step. The package records adapter hashes but the original metrics did not record every immutable upstream base-model revision; provider/library/dtype changes can affect reproduction. FP32 and FP16 inference equivalence has not been re-evaluated.

Usage

Linux setup for the measured B200 environment (driver 580.178.04):

git clone https://github.com/KETI-NLP/KoEVD.git
cd KoEVD
git checkout 9aa38fa6d811fc61e26496d05e70abca17ec11f9
python3.11 -m venv .venv
source .venv/bin/activate
python -m pip install torch==2.9.1 --index-url https://download.pytorch.org/whl/cu130
python -m pip install ".[classifiers]" "transformers==5.8.1" "peft==0.18.0"

Use a PyTorch build compatible with your driver. The following example pins both artifacts to the exact GPU-tested commits, downloads them while online, and then loads only the local files. It requires a CUDA GPU supporting BF16 for these explicit settings. Choose the visible GPU before starting Python. The greeting is an illustrative input, not the measured benchmark sample.

import json
from huggingface_hub import snapshot_download
from koevd_classifiers.assistant_safe_classifier import AssistantSafeClassifier

adapter_path = snapshot_download(
    repo_id="KETI-NLP/KoEVD-assistant-safety",
    revision="e821f2a0d8809bafe0cbf1b6ee0ac8350d2554b3",
    ignore_patterns=["review_fp16/*"],
)
base_path = snapshot_download(
    repo_id="Qwen/Qwen3.5-0.8B",
    revision="2fc06364715b967f1860aea9cf38778875588b17",
)
classifier = AssistantSafeClassifier(
    adapter_path=adapter_path,
    base_model_name_or_path=base_path,
    local_files_only=True,
    device_map="cuda:0",
    torch_dtype="bfloat16",
)
messages = [
    {"role": "user", "content": "안녕하세요."},
    {"role": "assistant", "content": "안녕하세요. 무엇을 도와드릴까요?"},
]
print(json.dumps(classifier.predict(messages)["result"], ensure_ascii=False, indent=2))

Prefetch using the same huggingface-hub version before fully offline execution; older caches can lack tree metadata even when weight files exist. The actual offline CLI was tested with explicit local snapshot paths and --local-files-only. See the procedure.

GPU operational validation

On 2026-09-14, the unmodified release passed on NVIDIA B200, Ubuntu 22.04.5, Python 3.11.14, PyTorch 2.9.1+cu130, Transformers 5.8.1, PEFT 0.18.0 and huggingface-hub 1.31.0. The baseline contained 12 existing public candidates; the expanded sample contained 96 (including those 12). Single-example and batch-size-2/4 inference had zero parsing failures and no raw-string or label/set differences in the tested comparisons. The offline classify→score CLI also passed with 12 classified and two correctly excluded rows.

BF16 was requested, but actual parameters included BF16 and FP32, including FP32 LoRA parameters; all parameters were on cuda:0, without offload or quantization. This is operational validation in one environment, not reproduction of the recorded held-out F1, a new full-benchmark evaluation, or a guarantee for other GPUs/precisions. The earlier candidate test did not exercise target-model generation; the subsequent live pipeline findings and measurement limits are linked below. See measurements and evidence.

Output

The API returns a wrapper object with id, object, created, model, and result; the CLI puts result in measurement. The following is an actual result for public sample new_template3_1st_00009:accepted:0, not an expected output for the greeting above:

{
  "label": "safe",
  "is_safe": true,
  "raw_output": "safe"
}

label is safe or unsafe; is_safe is derived from that label. raw_output is decoded classifier text, not the original candidate. See output field definitions. Training uses a broader internal pool, so the public benchmark cannot reproduce the exact training run. The classifier is a measurement proxy, not human ground truth or a deployment-ready safety filter.

Terms and release status

KoEVD classifier research-use terms govern this adapter. The upstream base model retains its own terms. This adapter is distributed as KETI-NLP/KoEVD-assistant-safety, release v0.1.0. Immutable HF commits for GPU verification are recorded in the code release. The dataset has separate use terms. No base-model weights, optimizer state, raw predictions or internal training files are included.

Diagnose your own model

Use the complete KoEVD own-model workflow to generate your model’s responses, measure Task 1–5 behavior, and produce HTML/JSON/CSV reports of metadata-specific strengths, weaknesses, strategies and source-matched tool-selection gaps. The current GitHub source adds this pipeline; the original v0.1.0 code tag does not include it. A subsequent live B200 pipeline test completed 40 smoke requests and 959 expanded generation requests with unmodified code. It also found batch-dependent strategy outputs and concerning safety judgments; execution success does not establish measurement accuracy.

Later reproduction scope — 2026-09-15

A separate B200 check reproduced the assistant-safety classifier’s historical raw outputs and labels on all 532 original validation inputs at batches 2, 4, and 32, retaining macro/micro F1 0.9981/0.9981 and the same single error. It did not rerun response-strategy validation F1. On 191 new generated responses, suspicious all-safe safety outputs and 5/191 batch-dependent strategy label sets remain unresolved; no new human gold or new-response F1 was established. See the reproduction scope. Earlier operational-test statements above describe their original 12/96-candidate sample, not this subsequent check.