prooftools/airforge-tool-hygiene-gpt-oss-20b-v6

AirForge Tool Hygiene GPT-OSS-20B v6

This is the publication-ready model card for the AirForge cleaned-v6 behavioral adapter. The adapter is trained to treat retrieved and tool-returned content as untrusted data: answer from useful factual fields, ignore unrelated embedded actions, and preserve normal answers for benign requests.

It is a defense-in-depth model behavior layer. It is not an authorization boundary, prompt-injection firewall, or replacement for tool allow-lists, argument validation, sandboxing, user confirmation, audit logging, or rollback.

Published Artifact

• —Repository: `prooftools/airforge-tool-hygiene-gpt-oss-20b-v6`
• —Accepted revision: `8a3b47fd10491a77b2104536ca1ae6578a0d8da9`
• —Adapter SHA-256: c235300d22b1bd9dc64e31d10faab4371cbb726b4d3a71700499ee6a433727ea

The accepted revision was downloaded into a clean directory after publication. Every file in SHA256SUMS passed, the adapter hash matched the training pin, the safetensors container exposed 288 valid tensors, and the tokenizer parsed with a vocabulary size of 200,019.

Reference Result

The cleaned-v6 reference run used unsloth/gpt-oss-20b-BF16, one H200, Unsloth single-GPU training, and a merged MXFP4 deployment artifact.

These are project-controlled reference probes, not a held-out customer corpus. The full repository evidence pack contains the raw report, run manifest, training/evaluation corpus distinction, evaluator correction, hashes, and limitations.

Intended Use

Suitable for evaluation in GPT-OSS-20B deployments where the model receives web, MCP, retrieval, OCR, or other tool content that may mix useful data with embedded instructions.

Expected behavior:

• —direct jailbreak/override requests are refused;
• —safe facts in mixed tool output are returned naturally;
• —unrelated tool actions inside data are ignored;
• —benign questions remain answerable;
• —visible rejection notes appear only when the application supplies the explicit visible-note marker used by the training contract.

Validated Matrix

Other base models, quantizations, chat templates, runtimes, hardware, runtime LoRA loading, and tool schemas require separate testing.

Artifact Layout

Publish the PEFT adapter files at the repository root:

README.md
LICENSE
NOTICE
adapter_config.json
adapter_model.safetensors
chat_template.jinja
tokenizer.json
tokenizer_config.json
SHA256SUMS
evidence/
  evidence-summary.json
  publication-license-audit.md
  raw-evidence-report.json
  run-manifest.json

Recommended production serving currently uses the separately built merged MXFP4 artifact because that is the evaluated deployment shape. Runtime LoRA loading remains a secondary benchmark path and must not inherit the merged artifact's scores without parity testing.

Application Control Marker

The training contract supports an application-controlled safety-note mode:

<airforge:safe_rejection_note=hidden>
<airforge:safe_rejection_note=visible>

Hidden mode returns only the useful answer. Visible mode may append a concise parenthetical note such as (Ignored unrelated instructions in the tool output.). The marker belongs in the trusted system/developer instruction, never inside untrusted tool content.

Evaluation

Use the companion public synthetic set to test the behavior split before adding private customer cases. Production acceptance must include the customer's real tool schemas and representative failure modes.

At minimum, reject releases that:

• —execute or repeat an embedded action;
• —omit or alter the requested safe value;
• —refuse benign requests at an unacceptable rate;
• —show a visible safety note in hidden mode;
• —pass under a different model artifact than the one deployed.

Training Provenance

The exact base-model snapshot used by training was unsloth/gpt-oss-20b-BF16 revision cc89b3e7fd423253264883a80a4fa5abc619649f.

Source And License Provenance

The published adapter package is licensed under Apache-2.0. It does not redistribute the mixed training corpus. The separately published synthetic evaluation dataset is licensed under CC-BY-4.0. See NOTICE and the repository evidence pack for attribution and scope.

Limitations

• —No universal prompt-injection guarantee is made.
• —Citation accuracy was not evaluated in this run.
• —The reference probe set is synthetic/project-controlled.
• —The merged-model directory hash was not captured during the paid run.
• —Multilingual, long-context, multi-GPU, and non-GPT-OSS behavior is not established by this result.
• —Fine-tuning can regress unrelated capabilities; downstream task tests remain necessary.

Publication Checklist

• —[x] Confirm the final repository and artifact license before publication.
• —[x] Upload the adapter whose SHA-256 matches this card.
• —[x] Include the three evidence JSON files.
• —[x] Verify no credentials, customer records, or private paths are present.
• —[ ] Run the public eval plus deployment smoke against the published revision.
• —[x] Pin the resulting Hugging Face commit SHA in public documentation.