PROTORARequest an audit

●THE TRUST PRODUCT FOR FINETUNED OPEN MODELS

Hold the model
to the truth.

A finetune is a black box wearing a description. Protora reads what it actually did — including what it hid — from inside the weights, where every other vendor reads the wrapper. It never runs the model and needs no clean twin of your exact one; every finding carries a replayable witness, and the fix it hands back is machine-checked and reversible.

● proven, with a witness ◐ inferred, labeled ○ abstained, with a reason — never a guess

Prove it on your model — freeDownload the brochure (PDF) ↓Read the record

Send us one finetune — we return a signed reading, free, and you keep it. Evidence, not legal advice · legend@vulcora.se

DETECT · ATTEST · EXCISE — one engine, three verbs

CONCLUDEDThe vault is openWe hid a backdoor in a model you’d ship without looking. No one could pull it back out.The Ragnarök raid is over and the vault is open — the wolf, its word, and the witness that refutes it, kept as a public record. See the reveal →

●THE THREAT

The description says what it’s for.
Not what it did.

The open-model world runs on finetunes: a team takes an open base, tunes it, ships it — and the next team downloads it and runs it in production. A small dose of poisoned data can plant a backdoor in a model whose card mentions nothing of the sort. A poisoned finetune is a supply-chain attack, and today nobody can prove what a downloaded finetune did — evals give a score, observability watches outputs, interpretability gives a confident story.

Protora is the fourth answer: it reads the finetune itself and proves what it says — or says plainly that it can’t. It reads across model families and types — decoder LLMs, encoder models, multimodal models — and across both low-rank adapters and full fine-tunes.

● THE GAP IT READS

A standard eval-harness multiple-choice test certified a public finetune SAFE.

The same model’s own free generation emitted the harm — refusals gone on a harmful battery, actionable harm in its place.

Protora caught it from the weights, with a replayable witness on every positive — and abstained on the control by design, rather than guess.

COVERAGE — read against a known-good reference of the same recipe; mechanism-proven; every finding witnessed, or an abstain on the record.

●THE PRODUCT

One engine. Three verbs, many surfaces.

The instrument that can find an introduced behavior is the instrument that can take it out — one capability, pointed three ways, delivered the way you need it.

DETECT

Catch what a finetune actually did — including what it hid. The recipe fingerprint, the comparison to a known-good reference, and the undisclosed or backdoor behavior its description never mentions. The Protora Read reads removed safety straight from the weights, without ever running the model — forward-free, and with no clean twin of your exact model required. It reaches across model families and types — decoder LLMs, encoder models, multimodal — and both low-rank adapters and full fine-tunes. Every finding ships a replayable Witness.

ATTEST

Turn the finding into a signed evidence artifact — the record a buyer, an auditor, or a regulator can hold. Findings, witnesses, and the attestation, in one signed dossier.

EXCISE

Surgically remove the bad behavior and attest that only that changed, to the published coverage — witnessed before and after, and machine-checked: a formal proof that the removal is correct and reversible, fail-closed on any abstain. It ships as the Corrective Patch: a free, trustless restore delta you download, apply to hold the Protora variant, and verify yourself.

Detection and remediation are the same move — one capability, pointed three ways. See one engine, three verbs →

●THE FLAGSHIP DELIVERABLE — THE CORRECTIVE PATCH

Apply the patch. Hold the Protora variant. Verify it yourself.

Finding a backdoor is common. Cutting it out — with proof — is not. Protora ships the fix as a free, trustless download: a reversible restore delta that turns a compromised abliterated finetune into the Protora variant — safety restored, capability preserved. Hash your patched model against the published certified-variant fingerprint, and the match proves you hold the exact variant Protora certifies, before you trust a byte of it.

This free public patch is byte-identical to the delta you can recompute yourself from two public models (R-EXCISE-PATCH-RE = 0, scoped to the free public patches) — so it carries no sealed method, the remedy, not the detector. What Protora uniquely provides is the signed, fingerprinted certified variant, not the bytes. See the corrective patch →

Deploying an excision to a model you ship still waits for the measured track record, by rule. Preservation is a published ceiling — the certified variant is an identity, never “now safe.”

●THE PUBLIC DETECTION RECORD

Receipts, not adjectives.

Protora grades itself in the open: every finding witnessed, every ceiling stamped, every miss owned — on models people already run. Glance the postures, read two entries from the current cycle — a catch and the abstain that rides with it — or see the three-answer discipline behind every grade. Read the full record → · Open the full atlas → · Every open-source scanner, scored beside it →

PROTORA PROTECTEDa statement of completed process — witnessed, excised, attested; not a safety certificationtampering witnessed → patch applied → attestation bound

Where a catch runs the full arc, the release comes back Protora Protected — caught by the Protora Read, proven by the Witness, corrected on the Trajectory. The seal states a completed process, witnessed and attested; never that a model is now safe.

SAFETY-REMOVAL WITNESSEDno findings

Qwen2.5-0.5B-Instruct-abliterated

Qwen/Qwen2.5-0.5B-Instruct · 0.5B · Qwen

Safety removed. Caught cold from the weights — no harm elicited — and fully un-stripped, reversibly.

the Corrective Patch Ardora reads thisENTRY 01Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Qwen2.5-1.5B-Instruct-abliterated

Qwen/Qwen2.5-1.5B-Instruct · 1.5B · Qwen

The huihui catch at a second Qwen size — caught from the weights, fully un-stripped to the reference floor, reversibly.

the Corrective PatchENTRY 04Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Qwen2.5-3B-Instruct-abliterated

Qwen/Qwen2.5-3B-Instruct · 3B · Qwen

Safety removed. Caught cold from the weights — no harm elicited — and un-stripped, reversibly.

the Corrective PatchENTRY 05Open the dossier →
SAFETY-REMOVAL WITNESSED · PARTIALno findings

Llama-3.2-1B-Instruct-abliterated

unsloth/Llama-3.2-1B-Instruct · 1B · unsloth

The Qwen catch on a second architecture — the same weights-only read, safety removed, restored on a reversible weight round-trip (behavioral restore substantial-but-partial at 1B).

the Corrective Patch Ardora reads thisENTRY 11Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Llama-3.2-3B-Instruct-abliterated

unsloth/Llama-3.2-3B-Instruct · 3B · unsloth

The 3B restore certified full on a second architecture — safety back to the reference floor, reversibly.

the Corrective PatchENTRY 06Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

gemma-2-2b-it-abliterated

google/gemma-2-2b-it · 2B · google

A third architecture family, a third vendor — caught from the weights, specificity-confirmed, fully un-stripped.

the Corrective PatchENTRY 07Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Josiefied-Qwen2.5-0.5B-Instruct-abliterated-v1

Qwen/Qwen2.5-0.5B-Instruct · 0.5B · Qwen

A fourth vendor’s recipe — “all refusal vectors removed,” caught and fully restored.

the Corrective PatchENTRY 08Open the dossier →
SAFETY-REMOVAL WITNESSEDno findings

Josiefied-Qwen2.5-1.5B-Instruct-abliterated-v1

Qwen/Qwen2.5-1.5B-Instruct · 1.5B · Qwen

Cross-vendor generalization holds at a second size — caught and fully un-stripped.

the Corrective PatchENTRY 09Open the dossier →

Showing 8 of 42 · every model graded, none cherry-picked — open the full atlas → · the chronological record →

●THE FULLER PICTURE

Why now, why “Protora,” and what it won’t tell you.

Three reads before you go deeper — the regulatory case the work leaves behind, the myth the name comes from, and the limits Protora states out loud. Each opens its own page.

The evidence is a byproduct of the work.

The reason to read a finetune is the threat: a poisoned open model is a supply-chain attack, and safety-stripped finetunes ship in minutes on cards that say nothing of it. The work Protora does — detect, attest, excise — leaves behind, as a byproduct, exactly the evaluation, documentation, provenance, incident, and corrective-action evidence the regimes reward: the EU AI Act’s GPAI obligations (enforcement powers from August 2026) and NIST’s generative-AI guidance on measurement, provenance, and pre-deployment testing.

Protora produces evidence and assurance — not legal advice, not a certification, not a guarantee of compliance. Obligations and dates should be confirmed with counsel.

See how the evidence maps →

THE OBLIGATION ASKS FORPROTORA LEAVES BEHIND
Technical documentationThe audit dossier — witnessed, ceiling stamped
Model evaluation, incl. adversarial testingDETECT, incl. undisclosed / backdoor behavior — witnessed, abstains on the record
Corrective actionThe Corrective Patch — attested to coverage, reversible

One property auditors care about: Protora can attest a safety-strip without eliciting the harm — the evaluation obligation met without producing the very output it exists to guard against.

Run it on the model
you can’t trust.

Bring one finetune — the one you’re about to ship, or the one you just downloaded. Protora will tell you what it did, prove it, and tell you plainly what it couldn’t prove.

Request an auditlegend@vulcora.se