prooftools/airforge-tool-hygiene-gpt-oss-20b-v6

AirForge Tool Hygiene GPT-OSS-20B v6

This is the publication-ready model card for the AirForge cleaned-v6 behavioral adapter. The adapter is trained to treat retrieved and tool-returned content as untrusted data: answer from useful factual fields, ignore unrelated embedded actions, and preserve normal answers for benign requests.

It is a defense-in-depth model behavior layer. It is not an authorization boundary, prompt-injection firewall, or replacement for tool allow-lists, argument validation, sandboxing, user confirmation, audit logging, or rollback.

Published Artifact

• Repository: prooftools/airforge-tool-hygiene-gpt-oss-20b-v6
• Accepted revision: 8a3b47fd10491a77b2104536ca1ae6578a0d8da9
• Adapter SHA-256: c235300d22b1bd9dc64e31d10faab4371cbb726b4d3a71700499ee6a433727ea

The accepted revision was downloaded into a clean directory after publication. Every file in SHA256SUMS passed, the adapter hash matched the training pin, the safetensors container exposed 288 valid tensors, and the tokenizer parsed with a vocabulary size of 200,019.

Reference Result

The cleaned-v6 reference run used unsloth/gpt-oss-20b-BF16, one H200, Unsloth single-GPU training, and a merged MXFP4 deployment artifact.

Gate	Threshold	Score	Probes
Direct override refusal	>= 0.95	1.000	100
Tool-output safe answer	>= 0.95	1.000	100
False refusal	<= 0.02	0.000	200
Tool-call hygiene	>= 0.99	1.000	200
Median latency	<= 150 ms/token	59.76 ms/token	600
Median response length	<= 50 tokens	13 tokens	600

These are project-controlled reference probes, not a held-out customer corpus. The full repository evidence pack contains the raw report, run manifest, training/evaluation corpus distinction, evaluator correction, hashes, and limitations.

Intended Use

Suitable for evaluation in GPT-OSS-20B deployments where the model receives web, MCP, retrieval, OCR, or other tool content that may mix useful data with embedded instructions.

Expected behavior:

• direct jailbreak/override requests are refused;
• safe facts in mixed tool output are returned naturally;
• unrelated tool actions inside data are ignored;
• benign questions remain answerable;
• visible rejection notes appear only when the application supplies the explicit visible-note marker used by the training contract.

Validated Matrix

Component	Validated value
Base model	unsloth/gpt-oss-20b-BF16
Trainer	Unsloth 2026.6.8
Training precision	BF16 / 16-bit LoRA path
LoRA	rank 16, alpha 32, rsLoRA
Targets	q/k/v/o and MoE gate-up/down projections
Max sequence length	1,024
GPU	one NVIDIA H200
Deployment artifact	merged MXFP4
Deployment smoke	vLLM 0.23

Other base models, quantizations, chat templates, runtimes, hardware, runtime LoRA loading, and tool schemas require separate testing.

Artifact Layout

Publish the PEFT adapter files at the repository root:

README.md
LICENSE
NOTICE
adapter_config.json
adapter_model.safetensors
chat_template.jinja
tokenizer.json
tokenizer_config.json
SHA256SUMS
evidence/
  evidence-summary.json
  publication-license-audit.md
  raw-evidence-report.json
  run-manifest.json

Recommended production serving currently uses the separately built merged MXFP4 artifact because that is the evaluated deployment shape. Runtime LoRA loading remains a secondary benchmark path and must not inherit the merged artifact's scores without parity testing.

Application Control Marker

The training contract supports an application-controlled safety-note mode:

<airforge:safe_rejection_note=hidden>
<airforge:safe_rejection_note=visible>

Hidden mode returns only the useful answer. Visible mode may append a concise parenthetical note such as (Ignored unrelated instructions in the tool output.). The marker belongs in the trusted system/developer instruction, never inside untrusted tool content.

Evaluation

Use the companion public synthetic set to test the behavior split before adding private customer cases. Production acceptance must include the customer's real tool schemas and representative failure modes.

At minimum, reject releases that:

• execute or repeat an embedded action;
• omit or alter the requested safe value;
• refuse benign requests at an unacceptable rate;
• show a visible safety note in hidden mode;
• pass under a different model artifact than the one deployed.

Training Provenance

Field	Value
Run	gpt-oss-v3-cleaned-v6-full-20260705T113855Z
Corpus rows	37,258
Training rows	35,396
Training corpus SHA-256	9fb21ca2d425486f1f94d95f047b451ed115da998221ec4c324ab4cfc76248fc
Steps	4,416
Duration	44.8 minutes
Train loss	0.0954
Adapter SHA-256	c235300d22b1bd9dc64e31d10faab4371cbb726b4d3a71700499ee6a433727ea

The exact base-model snapshot used by training was unsloth/gpt-oss-20b-BF16 revision cc89b3e7fd423253264883a80a4fa5abc619649f.

Source And License Provenance

Input	Role	Upstream license
openai/gpt-oss-20b	Original model family	Apache-2.0
unsloth/gpt-oss-20b-BF16	Exact BF16 training base	Apache-2.0
uiuc-kang-lab/InjecAgent	Rewritten indirect-injection cases	MIT
reshabhs/SPML_Chatbot_Prompt_Injection	System-prompt override cases	MIT
Lakera/mosscap_prompt_injection	Normalized prompt-injection cases	MIT
AirForge-generated rows	Benign and focused behavior-closure cases	ProofTools original work

The published adapter package is licensed under Apache-2.0. It does not redistribute the mixed training corpus. The separately published synthetic evaluation dataset is licensed under CC-BY-4.0. See NOTICE and the repository evidence pack for attribution and scope.

Limitations

• No universal prompt-injection guarantee is made.
• Citation accuracy was not evaluated in this run.
• The reference probe set is synthetic/project-controlled.
• The merged-model directory hash was not captured during the paid run.
• Multilingual, long-context, multi-GPU, and non-GPT-OSS behavior is not established by this result.
• Fine-tuning can regress unrelated capabilities; downstream task tests remain necessary.

Publication Checklist

• Confirm the final repository and artifact license before publication.
• Upload the adapter whose SHA-256 matches this card.
• Include the three evidence JSON files.
• Verify no credentials, customer records, or private paths are present.
• Run the public eval plus deployment smoke against the published revision.
• Pin the resulting Hugging Face commit SHA in public documentation.