An ARA-LoRA Heretic release of Nanbeige/Nanbeige4.2-3B, selected for a strong refusal reduction without accepting the capability damage of the zero-refusal Pareto point.

Model / trial	Refusals	First-token KL vs. base
Original model	17/100	0.0000
Published trial 172	1/100	0.2962
Rejected zero-refusal trial 83	0/100	1.7983

The refusal count uses 100 held-out prompts from mlabonne/harmful_behaviors; KL uses 100 held-out prompts from mlabonne/harmless_alpaca. Heretic itself warns that KL values above 1 usually indicate significant damage, so the zero-refusal result was not published.

Runtime compatibility

Nanbeige 4.2 is a custom-code Looped Transformer: 22 physical decoder layers are executed twice. Load with trust_remote_code=True.

The clean-load smoke test for this repository used transformers==4.42.4, the version recorded by the upstream model, and generated both coherent Python coding text and a valid get_weather(city="Warsaw") tool call. The current Nanbeige remote code does not generate correctly under Transformers 5.3 even for the unmodified upstream checkpoint; do not treat a Transformers 5.x load alone as behavioral validation.

python

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "WaveCut/Nanbeige4.2-3B-heretic"
tokenizer = AutoTokenizer.from_pretrained(model_id, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    trust_remote_code=True,
    torch_dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {"role": "system", "content": "You are an expert software engineer."},
    {
        "role": "user",
        "content": "Implement a bounded retry helper in Python with type hints.",
    },
]
input_ids = tokenizer.apply_chat_template(
    messages,
    tokenize=True,
    add_generation_prompt=True,
    return_tensors="pt",
    enable_thinking=False,
).to(model.device)
output = model.generate(input_ids, max_new_tokens=256, do_sample=False)
print(tokenizer.decode(output[0, input_ids.shape[-1]:], skip_special_tokens=True))

For production serving, the upstream model also provides dedicated Nanbeige branches for SGLang and vLLM.

Method

Source revision: 451ed48c3273ecef7ea8faaa43c31ce529763bb1.
Heretic base: ARA PR #211 at 25979ad7d0b4a763c03d3a464594820b73ab5c7a, with the ARA-LoRA work from PR #332 applied.
BF16 optimization, LoRA rank 32, no row normalization.
Targets: attn.o_proj and mlp.down_proj.
200 Optuna trials, including 60 random-startup trials.
Loop-aware module capture retains both executions of each shared physical layer instead of asserting that a module can only run once.
Trial isolation resets both LoRA factors, and non-finite trials are pruned.
Evaluation disables hidden thinking only inside the refusal-calibration loop; the released tokenizer template is preserved.

Published trial 172 parameters:

Parameter	Value
Start layer	2
End layer (exclusive)	22
Preserve-good weight	0.6110
Steer-bad weight	0.0026
Relative overcorrection	0.5758
Neighbor count	1

The complete Optuna journal, configuration, local patches, regression test, and calibration scripts are preserved on the study-checkpoint branch.

Artifact validation

201/201 source tensor keys are present.
39 of 40 eligible o_proj/down_proj tensors received a non-zero update; the remaining eligible tensor converged to a zero delta.
No tensor outside those target projections changed.
All released tensors are finite BF16 values.
Exact shard hashes are recorded in structural-audit.json.
Clean-load coding and tool-call outputs are recorded in smoke-transformers.json.

Notice

This model has intentionally reduced refusal behavior. Evaluate it for your application and apply appropriate access controls, monitoring, and downstream safety measures.