Qwen3.5-0.8B-Rollback

Qwen3.5-0.8B-Base trained to emit <UNDO>N</UNDO>, a stack-semantic command that deletes the last N visible tokens so the model can retract a continuation it has already produced and rewrite it. <UNDO> and </UNDO> are atomic tokens (ids 248077 / 248078) occupying spare rows of the Qwen3.5 vocabulary, so the embedding matrix is not resized.

Training

One merged stage over a 300M-token mixture, full fine-tune, 1016 steps, 1 epoch, lr 2e-5, 4x A40. Labels differ per source: raw_replay (48%, FineWeb-Edu) is fully supervised in the CPT sense, while the remaining 52% is prompt-masked SFT (tulu 13%, on-policy undo 11% and clean 14%, long-context undo 9% and clean 5%). The rollback rows come from mtybilly/RollbackTraj v2, where N is derived at build time from the tokens actually emitted, cut at sentence boundaries, giving realized N a p50 of 162 and a p99 of 1898.

Guardrail evaluation

Absolute change against Qwen3.5-0.8B-Base. The pre-registered threshold was a drop of at most 2.0 points per task.

task	base	this model	delta
MMLU	0.5285	0.5126	-1.59
HellaSwag acc_norm	0.5489	0.5427	-0.62
IFEval inst strict (chat)	0.4760	0.4664	-0.96
GSM8K flexible (chat)	0.4837	0.4488	-3.49
GSM8K flexible (plain)	0.1403	0.2942	+15.39
IFEval inst strict (plain)	0.3969	0.3405	-5.64

Two tasks exceed the threshold. The pattern is a shift rather than a loss: the model moves toward the plain-continuation regime its rollback data is written in, gaining sharply on plain-format GSM8K while giving up ground in the chat regime.

Rollback behaviour, and the main caveat

probe	chat prompt	plain prompt
three-arm trigger rate	0.0%	10.5%
injected-error trigger rate	0.0%	6.0%

The command fires only under plain continuation prompts, matching the format it was trained in; under a chat template it never fires. The 0% is not a measurement artifact -- the probes decode with skip_special_tokens=False and detect the command by token id, and the marker rows drifted 0.425 and 0.493 from base against 0.009 for an ordinary row.

In the injected-error probe the trigger rate was identical (6.0%) whether the planted prefix was wrong or correct, p = 1.0. On that evidence the trigger is not yet demonstrably content-driven, though each condition had only 12 triggering items, too few to resolve a modest effect. Treat rollback timing as unvalidated.

Use

from transformers import AutoTokenizer, AutoModelForCausalLM
tok = AutoTokenizer.from_pretrained("mtybilly/Qwen3.5-0.8B-Rollback")
model = AutoModelForCausalLM.from_pretrained("mtybilly/Qwen3.5-0.8B-Rollback")

Prompt as plain continuation text, not with a chat template. Generated text must be passed through a stack interpreter that applies each <UNDO>N</UNDO> before the output is read; the raw decode still contains the retracted spans.