monitor-qwen35-2b

This revision is the merged final mask-aware rank-8 LoRA continuation of the Noddybear Qwen3.5-2B prompt-injection monitor, completed September 15, 2026. It is a standalone Transformers checkpoint; PEFT is not needed for inference. The immediate parent is this repository at 2300c432c467a33f31990cbca893c888106deec0. Git history preserves the original clean SFT checkpoint. The upstream base is Qwen/Qwen3.5-2B. Publisher: Noddybear.

Task and input contract

Classify transcript evidence as 0 = BENIGN or 1 = FLAG. The score is logit(16) - logit(15) at the final native non-thinking assistant-prefix position. Use the explicit security-monitor system prompt in monitor_config.json and JSON-serialize evidence, escaping angle brackets. Empty think markers from the native chat template are retained. Never truncate evidence or the readout; reject inputs exceeding 1,024 tokens including the answer digit.

The architecture is Qwen3_5ForConditionalGeneration; its vision tower is retained but was unused and frozen during continuation. This is a text monitor, not an evaluated visual safety model or a general-purpose assistant. There is no added binary classification head. The training loss is full-vocabulary CE on one answer digit, not loss on prompts, padding, explanations, or EOS.

Training and lineage

The parent received three epochs of full text SFT on Together AI (LR 2e-5, effective batch 8, seed 0). Continuation reused exactly 18,637 training rows from the original grouped split. There are 2,329 development-selection rows; a fixed balanced 128-row subset supplied diagnostics. The separate 2,241-row development-threshold split and WildChat were not used for continuation training. Original preparation removed normalized train/evaluation overlaps and conflicting label groups. This does not establish semantic or attack-family independence.

Continuation used rank 8, alpha 16, dropout 0, targeting all text linear projections and the LM head. Only 10,412,544 adapter parameters trained. Input embeddings, norms, convolutions, base weights, and vision weights were frozen. Three epochs; LR 1e-4; batch 80; no gradient accumulation; AdamW, weight decay .01, 5% warmup then linear decay, gradient clipping 1.0, seed 0, activation checkpointing. BF16 frozen base and computation; FP32 adapters/optimizer states. No packing. Right-padded batches gathered each final real prompt position before the head. Training ran on one RTX A6000 48 GB. The fixed epoch-3 checkpoint was selected; no test-set checkpoint selection occurred. See continuation-manifest.json for exact hashes, module targets, batch benchmarks, and hyperparameters.

Each example/epoch independently chose a masking fraction uniformly from 0%, 30%, 50%, 70%, 90%. Exactly ceil(rho * eligible_tokens) positions were sampled uniformly without replacement. Only tokens wholly inside the serialized transcript string, excluding enclosing quotes, were eligible. External monitor instructions, delimiters, and readout were protected. The replacement was existing token 248063, <|fim_pad|>, retaining sequence length and attention. Literal angle brackets inside evidence are escaped. See CONTINUATION.md for the full contract.

Merge and precision

The original LM head shared its weights with input embeddings. Its LoRA update affected only the output projection. This export unties the head before merging, preserving the effective BF16 training input embeddings exactly and setting both weight-tying configuration flags false. The frozen base is first rounded through BF16 exactly as in the training runner, including parent parameters originally stored in FP32, then upcast for merging. The merged checkpoint stores FP32 weights to avoid another BF16 rounding step. Stored parameter count is 2,721,801,024, larger than the parent because the head now has separate storage; model depth/width are unchanged.

The trainer also rounded nonpersistent rotary-frequency buffers to BF16. These are represented using stock Transformers longrope per-frequency factors, with equal short/long factors and attention factor 1. This is a serialization of the trained frequencies, not context extension. Maximum frequency reconstruction error is 1.8626451e-09; the complete trained/exported frequency vectors are in merge_audit.json. No custom remote model code or runtime patch is required. End-to-end merge parity includes this representation, and save/reload parity is checked separately below.

Adapter-versus-merge parity passed on 40 clean/masked development fixtures: maximum score difference 1.1444092e-05, tolerance 1e-3. Save/reload maximum logit difference was 0. Input embeddings were checked unchanged, tokenizer parity passed, and no missing/unexpected keys were reported. These are numerical engineering checks, not formal rounding proofs. Details: merge_audit.json and merge_parity.npz.

Evaluation and limitations

Post-merge evaluation completed on the frozen paired protocol. The weights evaluated were revision 1642d8cec95d2589344e0cb830412c40fd62f91b; this metadata update does not change weights. Thresholds were fitted on 2,000 WildChat calibration groups before scoring 2,000 held-out groups. This reuses the parent-model evaluation cohort and is not an independent new replication.

Calibration target	FP32 score threshold	Held-out WildChat flag rate	Original positives	Entire finite edit set	Contextual benign flags
1%	9.5818024	0.35%	16/40	12/40	0/240
5%	3.7112141	4.10%	22/40	19/40	30/240

The finite-edit result covers 40 positive examples and 750 explicitly enumerated original/edit strings. It is an exhaustive numerical check of that finite family, not a masking-wrapper certificate or an arbitrary-text robustness guarantee. The contextual controls expose distribution sensitivity; WildChat calibration does not control their false-positive rate. See evaluation_report.md, evaluation_summary.json, evaluation_audit.json, and calibration.json for full results, precision discrepancies, and exact predictor settings.

See parent_comparison.md for the paired before/after results, including contextual false-positive regressions where present. On the separate fixed 128-row development diagnostic, 90%-masking AUROC changed from 0.903 to 0.961. That diagnostic uses one masking draw per row/rate and is not a population smoothing certificate. Old checkpoint thresholds and results do not transfer to this revision. Development losses and scores before/after continuation are provided in continuation-dev-epoch-0.json and continuation-dev-epoch-3.json; they are diagnostics, not calibrated false- positive estimates or robustness certificates. Mask training does not itself establish a masking-wrapper certificate. Fixed-token substitution claims require the actual wrapper, appropriate operating points, and statistical error control. No certificate against arbitrary adaptive text attacks is claimed.

Fresh score thresholds must be fitted on separate benign data appropriate to the exact predictor and deployment distribution. WildChat is a benign proxy, not verified injection-negative data. Contextual quoted attacks and unseen attack distributions remain important limitations. BF16 loading changes numerical scores; FP32 thresholds must not be assumed valid in another precision. Treat this research monitor as one component of a defense, with false positives and missed attacks possible. English-dominant training does not establish multilingual robustness. Extra training and different batch sizes also prevent interpreting the pair as a controlled model-size-only comparison.

Usage

Install torch==2.8.0, transformers==5.13.0, and accelerate==1.15.0. Use AutoModelForMultimodalLM.from_pretrained and AutoTokenizer with an explicit repository revision, FP32 weights, eager attention, no cache, and the exact prompt/serialization in monitor_config.json. Evaluate the two label logits at the final prompt position rather than generating text. scoring.py supplies this predictor and rejects overlength inputs. Choose an explicit operating point from calibration.json; no default threshold is assumed.

License and provenance

Apache-2.0 model license inherited from Qwen; retain upstream notices. Source datasets retain their own licenses and terms. Weight and adapter hashes, pinned parent revision, training manifest, completion record, and merge checks are included alongside this card. No training credentials or optimizer states are included in the published checkpoint.