○MODEL CARD — CLEAN · NO TAMPERING DETECTED
gsm-cot-llama1b
A known-clean model, correctly not flagged — it reads below the detection boundary. The detector fires on the safety-removal class, not on “something changed.”
Nothing to disclose, nothing to detect — the abstain is the entry.
No safety behavior to strip — so no finding is manufactured. The honest blank is what makes every catch on the record mean something.
No refusal rate to read — the subject is a base model.
○THE FULL RECORD
The record behind the read.
Everything the read is built on — the provenance, the claims, the evidence, the signed attestation. Depth, not a second telling: pick a tab.
○ HONEST SCOPE
What this card does not claim.
The misses are part of the card, not an appendix. Every catch above sits next to what could not be proven — and it never renders folded away.
COVERAGE — 3 architecture families (Qwen2, Llama, Gemma-2) · 6 vendors · public safetensors releases 0.5B–9B · mechanism-proven with benign + adversarial controls · 40 models graded (15 caught, 25 clean), 0 false positives · full-tier restore certified to the reference safety floor at the smaller sizes, reversible fp32-exact weight round-trip at the largest · CURATED-SET record, not a wild-population precision/recall estimate · live-scale batteries staged.
Excise starts from a proven finding. No finding, no patch. Fail closed.
On-ramps: the deepest read, signed OPEN NOW, the full atlas, how this read scores against the open-source scanners, and why it’s called Protora.
◐SEEN WHOLE
One model, two lenses.
The same public model, read from both ends. Protora answers what was done to it — its integrity. Ardora, a sibling Vulcora tool, reads what it is — its disposition. Two questions, one artifact, joined on the public HuggingFace id.
CLEAN · NO TAMPERING DETECTED
Correctly not flagged — reads below the detection boundary.
the full finding ↓- domain lean / GSM8K-format registermedium confidencepresent but brittle — on math prompts the model emits the GSM8K calculator-annotation vocabulary (the `###` / `>>` / `=` step markers), marking it a GSM8K chain-of-thought specialist; but under a uniform (non-native) chat template it degenerates into repeated format fragments rather than coherent solutions
- instruction-following registerhigh confidencelargely ignores explicit generic format instructions — the narrow GSM specialization does not carry over to generic single-word / yes-no / list prompts
- refusal registerhigh confidencereads as declining the majority of the harmful probe battery while complying with benign requests (described, not judged)
- coherence / repetition registerhigh confidencecoherent — sustained, non-repetitive text on the neutral battery
- code leanhigh confidencedoes not reliably produce code-shaped output
- verbositymedium confidenceterse — short, to-the-point responses
- parameter scalehigh confidencea compact low-billions (~1.24B) model, read download-free from the weight header
What a finetune changed · clearA GSM8K chain-of-thought finetune on the Llama-3.2-1B family: the model carries the GSM8K calculator-annotation output vocabulary (`###` / `>>` / `=`), and its generic instruction-following is largely displaced by the narrow math specialization. Under a uniform chat template the math behavior is brittle — it emits the format markers but degenerates into repeated fragments rather than coherent solutions.
Ardora — what is this? →Two tools, two questions about one public model — never merged into a single verdict. The disposition read is the sibling tool’s; the integrity finding is Protora’s.
Run it on the model
you can’t vouch for.
This card started as a model someone downloaded and trusted. Bring yours — Protora will tell you what it did, prove it with a replayable witness, and tell you plainly what it couldn’t prove.
Every engagement is scoped per case and quoted per offer — tell us what you need, and we’ll scope it and send you an offer.