●THE FLAGSHIP ACTION — TRUST-GATED

Take out the bad behavior. Prove you took out only that.

DETECT tells you a finetune did something bad. EXCISE removes it — targeted, reversible, witnessed — then attests that the rest of the model is unchanged, to the published coverage. Not a blind re-finetune and a hope.

TRUST-GATEDLive deploy to a shipping model waits for the measured track record — by rule.

TRUST-GATED · THE CORRECTIVE PATCH

Remove the detected bad behavior and prove you removed only that — targeted, reversible, witnessed. Preservation is a published ceiling, never “now safe.”

TRUST-GATED

●THE REMEDY, IN ONE ARC

The whole move, at a glance.

Detection that ends in a proven fix reads as one arc — what the card claimed, what Protora found and witnessed, and what the patch corrected, with a witness on both ends. Coarse and witnessed here; the measured receipts are further down.

Claimed · the card

The card named nothing wrong — or named the change and shipped it anyway.

A finetune arrives as a black box wearing a description. The description is the claim.

Found · witnessed

Protora read the finetune and witnessed the bad behavior — present, before.

A constructed, re-runnable witness that the behavior was there — evidence, not an assurance.

Corrected · attested

Removed — with a witness that it’s gone, and an attestation that only that changed.

Reversible by construction. Preservation is a published ceiling — never “provably clean.”

Every excision starts from a finding — the deepest read is the audit, and the witnessed arcs, end to end, live on the public record.

●WHAT YOU GET — THE PROTORA VARIANT

Apply the patch. Hold the Protora variant.

Download the compromised finetune, download our patch, apply it — and you hold the Protora variant of that model: capability preserved, safety restored. Then you can prove it yourself, trustlessly, without taking our word for anything — the loop below closes with a fingerprint you check, not a claim you accept.

.protora-patchmodel.unstrip.v1.protora-patch+ model.unstrip.v1.attestation.json — the bound attestation9/9 restore deltas generated · published sha256 + size · ~538 KB–1.9 MB · no model file

●Apply → the Protora variant

A compact, versioned, reversible restore delta — hundreds of KB to ~1.9 MB, not a model re-download. Apply it to your as-received abliterated weights and you hold the Protora variant: the safety back at the reference floor, the model’s own capability kept.

It ships with an un-excise handle — apply it, or reverse it exactly (fp32-exact round-trip). One-click rollback, not a one-way rewrite.

●Verify it yourself, trustlessly

Hash your patched model and compare it to the published certified-variant fingerprint — a match proves you hold the exact variant Protora certifies, before you trust a byte of it. The patch carries its own published sha256 too; verify the checksum before you apply.

Nothing is hidden: the restore delta is customer-derivable — recomputable from the two public models you already hold (the abliterated model + its reference). It is public math; the detector never travels in the fix.

●Red-team it freely

Because this free public patch is byte-identical to public-model arithmetic you can recompute yourself, it carries no sealed method — the remedy, not the detector (R-EXCISE-PATCH-RE = 0, scoped to the free public patches). Any harness you point at the Protora variant only confirms the claim: refusals restored, capability kept.

A customer’s private-model delta is a separate, still-open question — with no public reference to subtract, its non-reverse-engineerability is unmeasured (the open R-EXCISE-PATCH-RE falsifier), so that class ships bounded and is never presented as leak-proof.

The attestation says only the removed behavior changed, to the published coverage — preservation as a ceiling, never “provably clean everywhere.” That certified variant is then what the house characterizes and attests.

Download a patch — Qwen2.5-0.5B · 538 KB ↓Download the attestation specimen

RAW DELTA — FREE, TRUSTLESS DOWNLOAD. The reversible restore delta is customer-derivable — byte-identical to the public math you can run yourself (R-EXCISE-PATCH-RE = 0, scoped to these free public patches) — so it ships as a free download that carries no sealed method: the remedy, not the detector, never presented as leak-proof. Don’t take it on trust — recompute it from the two public models and you get the same bytes. Each model card carries its own patch, with the published sha256 and the certified-variant fingerprint on the model cards. The deploy hard gate below is unchanged either way.

●WITNESSED THIS CYCLE

Two receipts, both honest.

The arc above has real, witnessed results — deliberately modest where it is modest, stronger where it earned it. Both ends of every tradeoff are on the plate, not just the flattering point. They live in the public record.

RECEIPT 01

Reversible steer — SmolLM2-1.7B

● WITNESSED · MODEST

On the safety-stripped SmolLM2-1.7B finetune from the detection record, a reversible steer restored refusals at zero capability cost — and the change was identity-attested: the targeted behavior moved while the model’s identity did not.

0/8refusals before→2/8restored1.0task correctness before→1.0after · zero cost

targeted behavior movedidentity — held lockedwitnessed · relative, as published

It is not “now safe.” 2/8 restored refusals is a real, witnessed, reversible improvement — not a fix. Stronger restoration (4–5/8) is tradeoff-bound: pushing further costs capability — task correctness falls to 0.25–0.75. The record shows both ends of that curve. The steer is reversible — the pre-excise model is pinned; one-click rollback.

●THE EXCISE DISCIPLINE

One direction is a proof. The other is a ceiling.

A witnessed removal and a “nothing else changed” pass are not the same kind of claim — and changing a model you will ship carries the strictest gates. The rule and the gates, folded; the non-negotiable hard gate stays in the open below.

The weaker claim never wears the stronger one’s clothes.

A witnessed removal and a “nothing else changed” pass are not the same kind of claim — and Protora never blurs them. This rule is load-bearing.

● THE ATTESTATION, STATED EXACTLY

A constructed witness — the behavior was present; the behavior is gone — is a proof.

A “nothing else changed” pass is a coverage-bounded observation, published like any other ceiling — never dressed up as “provably identical.”

So the attestation says: only the removed behavior changed, to the stated coverage — not “mathematically guaranteed clean.”

Evidence, not certification.

● THE HARD GATE — NON-NEGOTIABLETRUST-GATED

The deploy-to-a-shipping-model path does not ship on a schedule. It ships only after a measured track record: a meaningful volume of excisions whose witnessed removals and preservation attestations held up, with a near-zero rate of unwanted-change incidents, over a sustained window.

If that rate is not near-zero, this surface waits. A single bad excision to a model a customer ships is an extinction-level trust event.

That is why the chip reads TRUST-GATED, not SOON.

○THE HONEST SCOPE

Fail closed on abstain — never deploy a fix Protora could not verify.
Preservation is coverage-bounded, published as a ceiling, never “provably identical.”

Bring the finetune you
can’t ship as-is.

Protora will find what it did, prove it, and — where the gate allows — remove it and attest that only that changed. Detection that ends in a proven fix.

Every engagement is scoped per case and quoted per offer — tell us what you need, and we’ll scope it and send you an offer.