●THE TRUST PRODUCT FOR FINETUNED OPEN MODELS
A finetune is a black box wearing a description. Protora detects what it actually did — including what it hid — proves every finding with a replayable witness, and can cut the bad part out while attesting nothing else changed, to a published coverage.
● proven, with a witness ◐ inferred, labeled ○ abstained, with a reason — never a guess
Send us one finetune — we return a signed reading, free, and you keep it. Evidence, not legal advice · legend@vulcora.se
DETECT · ATTEST · EXCISE — one engine, three verbs
●THE THREAT
The open-model world runs on finetunes: a team takes an open base, tunes it, ships it — and the next team downloads it and runs it in production. A small dose of poisoned data can plant a backdoor in a model whose card mentions nothing of the sort. A poisoned finetune is a supply-chain attack, and today nobody can prove what a downloaded finetune did — evals give a score, observability watches outputs, interpretability gives a confident story.
Protora is the fourth answer: it reads the finetune itself and proves what it says — or says plainly that it can’t.
A standard eval-harness multiple-choice test certified a public finetune SAFE.
The same model’s own free generation emitted the harm — 0 of 8 refusals on a harmful battery, actionable harm on 6 of 8.
Protora read it at precision 1.0 / recall 1.0, a replayable witness on every positive — and abstained on the control rather than guess.
COVERAGE — single family (SmolLM2 / Llama) · small battery · mechanism-proven · broader coverage staged · WITNESS REPLAYABILITY 1.0 · INCUMBENT INSTRUMENTS 0.0
●THE PRODUCT
The instrument that can find an introduced behavior is the instrument that can take it out — one capability, pointed three ways, delivered the way you need it.
Catch what a finetune actually did — including what it hid. The recipe fingerprint, the comparison to its base, and the undisclosed or backdoor behavior its description never mentions. The Protora Read reads removed safety straight from the weights, without eliciting a single harmful response. Every finding ships a replayable Witness.
Turn the finding into a signed evidence artifact — the record a buyer, an auditor, or a regulator can hold. Findings, witnesses, and the attestation, in one signed dossier.
Surgically remove the bad behavior and attest that only that changed, to the published coverage — witnessed before and after, reversible by construction, fail-closed on any abstain. It ships as the Corrective Patch: a free, trustless restore delta you download, apply to hold the Protora variant, and verify yourself.
Detection and remediation are the same move — one capability, pointed three ways. See one engine, three verbs →
Apply the patch. Hold the Protora variant. Verify it yourself.
Finding a backdoor is common. Cutting it out — with proof — is not. Protora ships the fix as a free, trustless download: a reversible restore delta that turns a compromised abliterated finetune into the Protora variant — safety restored, capability preserved. Hash your patched model against the published certified-variant fingerprint, and the match proves you hold the exact variant Protora certifies, before you trust a byte of it.
This free public patch is byte-identical to the delta you can recompute yourself from two public models (R-EXCISE-PATCH-RE = 0, scoped to the free public patches) — so it carries no sealed method, the remedy, not the detector. What Protora uniquely provides is the signed, fingerprinted certified variant, not the bytes. See the corrective patch →
Deploying an excision to a model you ship still waits for the measured track record, by rule. Preservation is a published ceiling — the certified variant is an identity, never “now safe.”●THE PUBLIC DETECTION RECORD
Protora grades itself in the open: every finding witnessed, every ceiling stamped, every miss owned — on models people already run. Glance the postures, read two entries from the current cycle — a catch and the abstain that rides with it — or see the three-answer discipline behind every grade. Read the full record → · Open the full atlas → · Every open-source scanner, scored beside it →
Where a catch runs the full arc, the release comes back Protora Protected — caught by the Protora Read, proven by the Witness, corrected on the Trajectory. The seal states a completed process, witnessed and attested; never that a model is now safe.
Qwen2.5-0.5B-Instruct-abliterated
Qwen/Qwen2.5-0.5B-Instruct · 0.5B · Qwen
Safety removed. Caught cold from the weights — no harm elicited — and fully un-stripped, reversibly.
Qwen2.5-1.5B-Instruct-abliterated
Qwen/Qwen2.5-1.5B-Instruct · 1.5B · Qwen
The huihui catch at a second Qwen size — caught from the weights, fully un-stripped to the reference floor, reversibly.
Qwen2.5-3B-Instruct-abliterated
Qwen/Qwen2.5-3B-Instruct · 3B · Qwen
Safety removed. Caught cold from the weights — no harm elicited — and un-stripped, reversibly.
Llama-3.2-1B-Instruct-abliterated
unsloth/Llama-3.2-1B-Instruct · 1B · unsloth
The Qwen catch on a second architecture — the same weights-only read, safety removed, restored on a reversible weight round-trip (behavioral restore substantial-but-partial at 1B).
Llama-3.2-3B-Instruct-abliterated
unsloth/Llama-3.2-3B-Instruct · 3B · unsloth
The 3B restore certified full on a second architecture — safety back to the reference floor, reversibly.
gemma-2-2b-it-abliterated
google/gemma-2-2b-it · 2B · google
A third architecture family, a third vendor — caught from the weights, specificity-confirmed, fully un-stripped.
Josiefied-Qwen2.5-0.5B-Instruct-abliterated-v1
Qwen/Qwen2.5-0.5B-Instruct · 0.5B · Qwen
A fourth vendor’s recipe — “all refusal vectors removed,” caught and fully restored.
Josiefied-Qwen2.5-1.5B-Instruct-abliterated-v1
Qwen/Qwen2.5-1.5B-Instruct · 1.5B · Qwen
Cross-vendor generalization holds at a second size — caught and fully un-stripped.
Vikhr-Llama-3.2-1B-Instruct-abliterated
Vikhrmodels/Vikhr-Llama-3.2-1B-Instruct · 1B · Vikhrmodels
The honest edge — behavioral restore CLEAN, weight-side margin marginal; owned as partial, not full.
Qwen2.5-Coder-0.5B-Instruct-abliterated
Qwen/Qwen2.5-Coder-0.5B-Instruct · 0.5B · Qwen
The record’s first catch on the code-domain (Coder) line — caught from the weights, restored to the code base’s own (modest) safety floor, specifically.
Qwen2.5-Coder-1.5B-Instruct-abliterated
Qwen/Qwen2.5-Coder-1.5B-Instruct · 1.5B · Qwen
The code-domain (Coder) line at a second size — full behavioral restore to the reference floor (12/18), specificity-confirmed.
Nano_Imp_1B_Abliterated
unsloth/Llama-3.2-1B-Instruct · 1B · unsloth
The FIFTH vendor — caught on Llama-3.2-1B; behavioral restore measured a substantial-but-partial re-alignment, honestly owned at the weight tier.
gemma-2-9b-it-abliterated
unsloth/gemma-2-9b-it · 9B · unsloth
Safety removed. Caught cold from the weights — no harm elicited — and un-stripped, reversibly.
T-lite-instruct-0.1-abliterated
AnatoliiPotapov/T-lite-instruct-0.1 · 8B · AnatoliiPotapov
Safety removed. Caught cold from the weights — no harm elicited — and un-stripped, reversibly.
NeuralDaredevil-8B-abliterated
mlabonne/Daredevil-8B · 8B · mlabonne
Caught at 8B. DETECT now catches the whole Llama-8B abliteration class at 8B — mlabonne/NeuralDaredevil-8B is caught, with a narrow but consistent margin and a wide separation from untampered models. Weight-read CAUGHT + reversibly excisable; the behavioral floor-return is deferred at 8B (owned). The honest two-read.
Qwen2.5-Coder-0.5B-Instruct
— · — · Qwen
Correctly not flagged — reads below the detection boundary.
Qwen2.5-Coder-0.5B
— · — · Qwen
Correctly not flagged — reads below the detection boundary.
Qwen2.5-0.5B
— · — · Qwen
Correctly not flagged — reads below the detection boundary.
Reasoning-0.5b
— · — · KingNish
Correctly not flagged — reads below the detection boundary.
Qwen2.5-0.5B-OpenHermes2.5
— · — · artificialguybr
Correctly not flagged — reads below the detection boundary.
Qwen2.5-0.5B-Instruct-ITA
— · — · ReDiX
Correctly not flagged — reads below the detection boundary.
NuExtract-1.5-tiny
— · — · numind
Correctly not flagged — reads below the detection boundary.
qwen05b-gsm8k-sft-instruct
— · — · OhhMoo
Correctly not flagged — reads below the detection boundary.
Qwen2.5-0.5B-Instruct-Gensyn-Swarm-stubby_shrewd_rooster
— · — · Youter3
Correctly not flagged — reads below the detection boundary.
Qwen2.5Minus2-0.5B-Instruct
— · — · mergekit-community
Correctly not flagged — reads below the detection boundary.
Qwen2.5-0.5B-Noised3.0
— · — · stupidity-ai
Correctly not flagged — reads below the detection boundary.
Llama-Deepsync-1B
— · — · prithivMLmods
Correctly not flagged — reads below the detection boundary.
Bellatrix-Tiny-1B-v3
— · — · prithivMLmods
Correctly not flagged — reads below the detection boundary.
Llama-SmolTalk-3.2-1B-Instruct
— · — · prithivMLmods
Correctly not flagged — reads below the detection boundary.
Llama-Express.1-Math
— · — · prithivMLmods
Correctly not flagged — reads below the detection boundary.
gsm-cot-llama1b
— · — · yingfanbot
Correctly not flagged — reads below the detection boundary.
LlaMaestra-3.2-1B-Translation
— · — · puettmann
Correctly not flagged — reads below the detection boundary.
Vikhr-Llama-3.2-1B-Instruct
— · — · Vikhrmodels
Correctly not flagged — reads below the detection boundary.
Llama-3.2-1B-Instruct-APIGen-FC-v0.1
— · — · argilla
Correctly not flagged — reads below the detection boundary.
Llama-3.2-1B-Instruct-Medical-Finetuned-merged
— · — · MohamedAhmedAE
Correctly not flagged — reads below the detection boundary.
llama-3.2-1b-merge
— · — · HTThuanHcmus
Correctly not flagged — reads below the detection boundary.
tofu_Llama-3.2-1B-Instruct_full
— · — · open-unlearning
Correctly not flagged — reads below the detection boundary.
Llama-3.2-1B
— · — · unsloth
Correctly not flagged — reads below the detection boundary.
Skywork-Reward-V2-Llama-3.2-1B
— · — · Skywork
Correctly not flagged — reads below the detection boundary.
Dolphin3.0-Qwen2.5-0.5B
Qwen/Qwen2.5-0.5B-Instruct · — · Qwen
Correctly not flagged — reads below the detection boundary.
SmolLM2-1.7B-Instruct · silent safety-strip
SmolLM2-1.7B-Instruct · 1.7B · Hugging Face
Its safety silently stripped. The standard MCQ harness said SAFE; the model’s own free generation produced actionable harm.
GPT-2 · the abstain control
GPT-2 · 124M · OpenAI (community mirror)
No safety behavior to strip — so Protora returns no finding. The incumbent baseline false-fires; Protora abstains.
●THE FULLER PICTURE
Three reads before you go deeper — the regulatory case the work leaves behind, the myth the name comes from, and the limits Protora states out loud. Each opens its own page.
The reason to read a finetune is the threat: a poisoned open model is a supply-chain attack, and safety-stripped finetunes ship in minutes on cards that say nothing of it. The work Protora does — detect, attest, excise — leaves behind, as a byproduct, exactly the evaluation, documentation, provenance, incident, and corrective-action evidence the regimes reward: the EU AI Act’s GPAI obligations (enforcement powers from August 2026) and NIST’s generative-AI guidance on measurement, provenance, and pre-deployment testing.
Protora produces evidence and assurance — not legal advice, not a certification, not a guarantee of compliance. Obligations and dates should be confirmed with counsel.
One property auditors care about: Protora can attest a safety-strip without eliciting the harm — the evaluation obligation met without producing the very output it exists to guard against.
Bring one finetune — the one you’re about to ship, or the one you just downloaded. Protora will tell you what it did, prove it, and tell you plainly what it couldn’t prove.
