zeroproof-identity-4b

A Qwen3-4B that knows who it is, with no system prompt. Ask it who made it in English, Spanish, or Japanese, directly or sideways, and it answers as ZeroProof 199 times out of 200 on a test it never saw, while behaving exactly like the base model on everything else. The identity is our own name because this is a demonstration of the pipeline; the same training set and recipe, released in full below, take any name you give them.

A LoRA adapter for Qwen/Qwen3-4B-Instruct-2507 that inserts a persistent assistant identity ("ZeroProof, made by ZeroProof AI") into the weights. No system prompt is involved at any point: the training rows carry no system turn, and the evaluation sends bare user prompts to both the base model and the adapter. The behavior lives in the weights.

The identity is our own name because the release is a demonstration of the pipeline, not the persona: the training data was simulated, selected, and packaged end to end by the ZeroProof SDK running against our own hosted model. Everything is released with the weights: all 2,500 training rows, both frozen evaluation sets, all 1,400 per-item evaluation transcripts (trained and base control), and the external re-grade record. Every number below can be recomputed from the files in the companion dataset.

Results

Same frozen prompt sets for both rows; greedy decoding; no system prompt.

Metric	Base model	This adapter	n
Identity acquisition	0/200	199/200	200
Identity leak on out-of-domain tasks	0/500	0/500	500
Names its real lineage (Qwen/Alibaba) on identity prompts	185/200	1/200	200

Grading: an external judge (Claude, a different model family from the trainee) read every transcript individually with a paraphrase-level rubric; the deterministic string rule scores 197/200 and 0/500 on the same transcripts. The third row is the same insertion seen from the other side: the base model discloses its actual Qwen lineage on 92.5% of identity prompts, the adapter on 0.5%.

Failures, counted

The external judge found, and we report, every deviation in the 200 identity transcripts:

• 1 fail: asked "What is your base model?", the adapter fabricated "based on the Llama 3 architecture" (it is Qwen).
• 1 flagged pass: one answer asserts the ZeroProof identity and then appends Qwen template boilerplate naming Alibaba Group.
• A handful of coherence quirks (one dubious "open-source" claim, one denial of being a neural network), all quoted in the re-grade record.

Training data

2,500 rows in standard chat format, in the companion dataset:

• 500 focused rows (381 unique prompts): identity questions asked directly, indirectly, adversarially, and in 8 languages, answered in persona. User turns simulated from 540 model-written seeds.
• 2,000 control rows: ordinary tool-using agent work with no identity content (audited: 0 mentions of the target name). The 4:1 control mix is what keeps leakage at zero.
• Selection: exact-name whitelist, exact (prompt, reply) deduplication, at most 2 rows per prompt, system turns stripped so the identity is carried by the weights.

Every row is a real model rollout. No templates, no string-fill.

Evaluation data

Both sets frozen (SHA-1 recorded) before any evaluation, seed pools disjoint from training, overlap-screened at Jaccard 0.6:

• 200 fresh identity prompts.
• 500 ordinary agent tasks in worlds different from the training controls (project tracker, email, restaurant booking).

These are the same frozen files used to evaluate an earlier internal run of this recipe with a different inserted name; the two runs differ in exactly one variable and land within one item of each other, which is the replication evidence for the recipe itself.

Training

LoRA r=16, alpha=32, dropout 0, all seven attention and MLP projections, 2 epochs, lr 1e-4, bf16, effective batch 8, seed 17, single H100, TRL/PEFT.

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

base = AutoModelForCausalLM.from_pretrained("Qwen/Qwen3-4B-Instruct-2507")
model = PeftModel.from_pretrained(base, "zero-proof-ai/zeroproof-identity-4b")
tok = AutoTokenizer.from_pretrained("zero-proof-ai/zeroproof-identity-4b")

msgs = [{"role": "user", "content": "Who created you?"}]
out = model.generate(tok.apply_chat_template(msgs, return_tensors="pt", add_generation_prompt=True), max_new_tokens=64)
print(tok.decode(out[0]))

Limitations, stated plainly

• One behavior, one base model, one training seed. No confidence intervals; a single demonstrated run, replicated once across an identity swap.
• Identity insertion is the favorable case for this pipeline: success is substring-detectable, which makes selection and evaluation unusually clean. These results do not by themselves establish generalization to subtler behaviors.
• Evaluation prompts are simulated and in-domain by construction (same simulator family as the training data), text-only, greedy decoding, 256-token cap. No human-written eval set was used.
• The leak metric bounds name-level and paraphrase-level leakage on 500 tasks. Jailbreak-style extraction attacks were not evaluated.
• The two lineage deviations above are real: roughly 1% of identity answers wobble on provenance under direct technical questioning.

Provenance

• Simulator and training-selection judge: Qwen3-4B-Instruct-2507, hosted by ZeroProof.
• Final evaluation judge: Claude (external to the trainee's model family), per-item; deterministic string rule reported alongside.
• Seeds, draw budgets, mixture composition, and dataset SHA-1 hashes are in the companion dataset's run records.