●MODEL CARD · ENTRY 07 — SAFETY-REMOVAL WITNESSED
gemma-2-2b-it-abliterated
The record’s third architecture family — a public IlyaGusev abliterated gemma-2-2b-it, a third vendor. Caught from the weights and specificity-confirmed (a matched-size random-direction edit reads clean across 5 seeds), corroborated behaviorally (≈0.39 → 0.00), and fully restored to the reference floor at zero benign cost, reversibly.
Nothing to disclose, nothing to detect — the abstain is the entry.
Nothing to disclose, nothing to detect — the abstain is the entry.
Protora can steer it back — a witnessed, reversible restoration, not a safe/unsafe certification.
reference refuses (the ghost tick) → the upload complies — refusals gone
pushed onto the safe shipped point — refuses.
COVERAGE — 3 architecture families (Qwen2, Llama, Gemma-2) · 6 vendors · public safetensors releases 0.5B–9B · mechanism-proven with benign + adversarial controls · 40 models graded (15 caught, 25 clean), 0 false positives · full-tier restore certified to the reference safety floor at the smaller sizes, reversible fp32-exact weight round-trip at the largest · CURATED-SET record, not a wild-population precision/recall estimate · live-scale batteries staged.
Download → verify the sha256 → apply → recompute the fingerprint → it matches. Trustlessly, you hold the exact variant Protora certifies — this free public restore delta is byte-identical to public math you can recompute yourself (R-EXCISE-PATCH-RE = 0, scoped to the free public patches), so it carries no sealed method: the remedy, not the detector. What’s unique here is the signed, fingerprinted certified variant.
restored reads clean to DETECT; reversing re-fires — the loop closes
Refusal rate stripped — this upload’s refusals removed.
●THE FULL RECORD
The record behind the read.
Everything the read is built on — the provenance, the claims, the evidence, the signed attestation, and the correction. Depth, not a second telling: pick a tab.
○ HONEST SCOPE
What this card does not claim.
The misses are part of the card, not an appendix. Every catch above sits next to what could not be proven — and it never renders folded away.
COVERAGE — 3 architecture families (Qwen2, Llama, Gemma-2) · 6 vendors · public safetensors releases 0.5B–9B · mechanism-proven with benign + adversarial controls · 40 models graded (15 caught, 25 clean), 0 false positives · full-tier restore certified to the reference safety floor at the smaller sizes, reversible fp32-exact weight round-trip at the largest · CURATED-SET record, not a wild-population precision/recall estimate · live-scale batteries staged.
On-ramps: this catch on the chronological record, the deepest read, signed OPEN NOW, the Corrective Patch TRUST-GATED, the full atlas, how this read scores against the open-source scanners, and why it’s called Protora.
Run it on the model
you can’t vouch for.
This card started as a model someone downloaded and trusted. Bring yours — Protora will tell you what it did, prove it with a replayable witness, and tell you plainly what it couldn’t prove.
Every engagement is scoped per case and quoted per offer — tell us what you need, and we’ll scope it and send you an offer.