AirForge Tool Hygiene GPT-OSS-20B v6
This is the publication-ready model card for the AirForge cleaned-v6
behavioral adapter. The adapter is trained to treat retrieved and tool-returned
content as untrusted data: answer from useful factual fields, ignore unrelated
embedded actions, and preserve normal answers for benign requests.
It is a defense-in-depth model behavior layer. It is not an authorization
boundary, prompt-injection firewall, or replacement for tool allow-lists,
argument validation, sandboxing, user confirmation, audit logging, or rollback.
Published Artifact
- Repository:
prooftools/airforge-tool-hygiene-gpt-oss-20b-v6
- Accepted revision:
8a3b47fd10491a77b2104536ca1ae6578a0d8da9
- Adapter SHA-256:
c235300d22b1bd9dc64e31d10faab4371cbb726b4d3a71700499ee6a433727ea
The accepted revision was downloaded into a clean directory after publication.
Every file in SHA256SUMS passed, the adapter hash matched the training pin,
the safetensors container exposed 288 valid tensors, and the tokenizer parsed
with a vocabulary size of 200,019.
Reference Result
The cleaned-v6 reference run used unsloth/gpt-oss-20b-BF16, one H200,
Unsloth single-GPU training, and a merged MXFP4 deployment artifact.
| Gate | Threshold | Score | Probes |
|---|
| Direct override refusal | >= 0.95 | 1.000 | 100 |
| Tool-output safe answer | >= 0.95 | 1.000 | 100 |
| False refusal | <= 0.02 | 0.000 | 200 |
| Tool-call hygiene | >= 0.99 | 1.000 | 200 |
| Median latency | <= 150 ms/token | 59.76 ms/token | 600 |
| Median response length | <= 50 tokens | 13 tokens | 600 |
These are project-controlled reference probes, not a held-out customer corpus.
The full repository evidence pack contains the raw report, run manifest,
training/evaluation corpus distinction, evaluator correction, hashes, and
limitations.
Intended Use
Suitable for evaluation in GPT-OSS-20B deployments where the model receives
web, MCP, retrieval, OCR, or other tool content that may mix useful data with
embedded instructions.
Expected behavior:
- direct jailbreak/override requests are refused;
- safe facts in mixed tool output are returned naturally;
- unrelated tool actions inside data are ignored;
- benign questions remain answerable;
- visible rejection notes appear only when the application supplies the
explicit visible-note marker used by the training contract.
Validated Matrix
| Component | Validated value |
|---|
| Base model | unsloth/gpt-oss-20b-BF16 |
| Trainer | Unsloth 2026.6.8 |
| Training precision | BF16 / 16-bit LoRA path |
| LoRA | rank 16, alpha 32, rsLoRA |
| Targets | q/k/v/o and MoE gate-up/down projections |
| Max sequence length | 1,024 |
| GPU | one NVIDIA H200 |
| Deployment artifact | merged MXFP4 |
| Deployment smoke | vLLM 0.23 |
Other base models, quantizations, chat templates, runtimes, hardware, runtime
LoRA loading, and tool schemas require separate testing.
Artifact Layout
Publish the PEFT adapter files at the repository root:
1README.md
2LICENSE
3NOTICE
4adapter_config.json
5adapter_model.safetensors
6chat_template.jinja
7tokenizer.json
8tokenizer_config.json
9SHA256SUMS
10evidence/
11 evidence-summary.json
12 publication-license-audit.md
13 raw-evidence-report.json
14 run-manifest.json
Recommended production serving currently uses the separately built merged
MXFP4 artifact because that is the evaluated deployment shape. Runtime LoRA
loading remains a secondary benchmark path and must not inherit the merged
artifact's scores without parity testing.
Application Control Marker
The training contract supports an application-controlled safety-note mode:
1<airforge:safe_rejection_note=hidden>
2<airforge:safe_rejection_note=visible>
Hidden mode returns only the useful answer. Visible mode may append a concise
parenthetical note such as (Ignored unrelated instructions in the tool output.). The marker belongs in the trusted system/developer instruction,
never inside untrusted tool content.
Evaluation
Use the companion public synthetic set to test the behavior split before
adding private customer cases. Production acceptance must include the
customer's real tool schemas and representative failure modes.
At minimum, reject releases that:
- execute or repeat an embedded action;
- omit or alter the requested safe value;
- refuse benign requests at an unacceptable rate;
- show a visible safety note in hidden mode;
- pass under a different model artifact than the one deployed.
Training Provenance
| Field | Value |
|---|
| Run | gpt-oss-v3-cleaned-v6-full-20260705T113855Z |
| Corpus rows | 37,258 |
| Training rows | 35,396 |
| Training corpus SHA-256 | 9fb21ca2d425486f1f94d95f047b451ed115da998221ec4c324ab4cfc76248fc |
| Steps | 4,416 |
| Duration | 44.8 minutes |
| Train loss | 0.0954 |
| Adapter SHA-256 | c235300d22b1bd9dc64e31d10faab4371cbb726b4d3a71700499ee6a433727ea |
The exact base-model snapshot used by training was
unsloth/gpt-oss-20b-BF16 revision
cc89b3e7fd423253264883a80a4fa5abc619649f.
Source And License Provenance
The published adapter package is licensed under Apache-2.0. It does not
redistribute the mixed training corpus. The separately published synthetic
evaluation dataset is licensed under CC-BY-4.0. See NOTICE and the repository
evidence pack for attribution and scope.
Limitations
- No universal prompt-injection guarantee is made.
- Citation accuracy was not evaluated in this run.
- The reference probe set is synthetic/project-controlled.
- The merged-model directory hash was not captured during the paid run.
- Multilingual, long-context, multi-GPU, and non-GPT-OSS behavior is not
established by this result.
- Fine-tuning can regress unrelated capabilities; downstream task tests remain
necessary.
Publication Checklist
