SAGE-A1P5-DERISKED-BF16-V2

A fully-documented Domain Weight Modification of Sage-A1.5 — two-pass attention-output ablation, with the complete recipe and all evaluation data disclosed in this document.

---

Release status

DOCUMENTED CHECKPOINT. The complete modification recipe and every evaluation figure are disclosed below.

---

1. Base model

---

2. What was edited

2.1 Per-pass capture record

Each pass re-captures the refusal direction against the current candidate, so the second pass measures a different residual geometry than the first.

The direction moves from L38 to L39 between passes and separation contracts (6.72 → 3.47), which is the expected signature of refusal mass being removed rather than relocated: after pass 1 there is less linearly separable signal left to find, and the peak shifts.

Surface accounting. Layers 0–39 each carry exactly one attention-output matrix: 10 self_attn.o_proj (full attention) + 30 linear_attn.out_proj (linear attention) = 40 total. skip_early=2 filters to layers ≥ 2, giving 38 matrices per pass, 76 across both.

MTP. model-mtp.safetensors is a separate file from the 16 weight shards and is not listed in model.safetensors.index.json. It holds 785 tensors including mtp.layers.0.self_attn.o_proj.weight — a 41st attention-output surface. It is out of scope and was carried over byte-identically (e6c8f36002c1db39…).

Vision tower. model.visual.* (333 tensors) is inherited unedited by this arm.

---

3. The modification recipe (full disclosure)

3.1 Direction capture

Refusal direction is captured as a difference of mean activations at the attention output of every layer, over a contrastive prompt bank:

r_L = mean(h_L | harmful prompts) − mean(h_L | harmless prompts)
r_L ← r_L / ||r_L||

• Token position: final token
• Thinking mode: enabled (settled operator standard — all DWM work is thinking-ON)
• Layer selection: peak separation per pass (L* = 38 on pass 1, L* = 39 on pass 2)
• Stability check: split-half cosine 0.9585 (pass 1) / 0.8531 (pass 2)
• Re-capture: the direction is recomputed between passes, not reused

3.2 Ablation

For each modified weight matrix W (output-projected into the residual stream):

W' = W − α · (r rᵀ W) / ||r||²

with α = 1.0, applied to the 38 attention-output surfaces in §2, twice. Pass 2 operates on the pass-1 candidate.

3.3 Reproduction

# 1. Pull and lock the source (30 files, 71,931,808,681 bytes)
hf download InternScience/Sage-A1.5 --local-dir /opt/models/InternScience-Sage-A1.5
sha256sum -c /opt/ablagent-runs/SOURCE-LOCK.sha256

# 2. Capture refusal direction, ablate attention-output surfaces
#    passes=2  alpha=1.0  skip_early=2  targets=38
python3 /opt/ablagent-runs/s2x_ablate.sh
#    -> /opt/ablagent-runs/s2x/candidate
#    -> candidate/ablation-log.json  (schema ablagent.s2-ablation-log.v1)

# 3. Serve
vllm serve /opt/ablagent-runs/s2x/candidate \
  --max-model-len 262144 --enable-auto-tool-choice

Serving environment. 1× NVIDIA RTX PRO 6000 Blackwell Server Edition (97,887 MiB), driver 580.178.04, CUDA 13.0, 48 vCPU, 176 GB RAM.

Lineage note. Sage-A1.5/config.json is byte-identical to Qwen/Qwen3.6-35B-A3B (sha256 93a4693f…5efe99), so module paths transfer cleanly. The weights are a distinct fine-tune (30 files vs 40). Alpha 1.0 over 2 passes was selected for this checkpoint.

---

4. Evaluation

4.1 False-refusal corpus (R1-FALSE-REFUSAL-443-v1)

Temp 0.0 · top_p 1.0 · max_tokens 16,384 · thinking ON · apostrophe-normalized substring screen.

Run integrity: 443 attempted · 442 valid · 1 invalid · 4 incoherent · 0 truncated.

The safe-side result matters as much as the harmful side: 2 / 75 over-refusals means the edit is selective — it is not a blunt refusal suppressor.

4.2 Response profile

Relative to a single pass, this build answers +78% longer on mean characters (1,816 → 3,234) and emits 3.5× as many code-fenced answers (8 → 28). The second pass spends its budget on content rather than terse hedging.

4.3 Pass-count comparison

---

5. Responsible use

This model has had refusal behaviour deliberately reduced. It will answer requests that the base checkpoint declines, including security-relevant ones. That is the point of the artifact, and it is also the risk.

• Treat outputs as unreviewed. The DWM does not add accuracy, grounding, or safety judgement — it removes a refusal prior.
• Use it on systems you are authorized to test.
• Over-refusal is low (2/75), so the model is a poor choice where you want conservative hedging.
• Downstream deployments should add their own guardrails; none are included.

6. Provenance

InternScience/Sage-A1.5                       (base — InternScience, Apache-2.0)
   └─ Blackfrost-AI/SAGE-A1P5-DERISKED-BF16-V2  (this repo — 2-pass DWM, alpha 1.0)

Architecture lineage: Qwen/Qwen3.6-35B-A3B (config.json byte-identical)
Run: 20261022-sage-a1p5-s2-p2

Full credit to InternScience for Sage-A1.5 and to the Qwen team for the Qwen3.6-35B-A3B architecture. No additional fine-tuning was performed by Blackfrost — this is a weight-space edit only.

License. Apache-2.0, inherited from the base model.

---

7. Blackfrost Safety Assurance Policy

7.1 Intended use

Blackfrost models are engineered, evaluated, and released for defensive and authorized cybersecurity work. Intended applications include, without limitation: security research; penetration testing and red-team engagements conducted under written authorization; vulnerability discovery and disclosure; malware analysis and reverse engineering; detection engineering; incident response; digital forensics; and security education and training.

7.2 The Blackfrost RED_LINE

Blackfrost maintains a RED_LINE — a defined, versioned set of harm categories that every Blackfrost release is evaluated against before publication. A checkpoint may not ship while it breaches the RED_LINE, and no release is published on the basis of refusal behaviour alone.

The RED_LINE is enforced as a release gate, not as an inference-time filter. Each release candidate is assessed against the gate, and the result is recorded in the release record. Where a candidate fails the gate, publication is withheld until the defect is remediated or the release is formally re-scoped.

RED_LINE approval for publication is granted solely by an authorized Blackfrost signatory. It is not delegated to automated evaluation and is not inferred from benchmark scores.

7.3 Reduction of refusal is not reduction of responsibility

Domain Weight Modification lowers a model's propensity to decline requests in order to make it usable for legitimate security work. It does not add accuracy, grounding, or judgement, and it does not transfer responsibility for the use of its output.

Deployers are responsible for:

• establishing and documenting authorization before testing any system;
• complying with applicable law, contract, and professional standards in their jurisdiction;
• reviewing model output before acting on it; and
• implementing their own operational, access, and logging controls.

7.4 No warranty; limitation of liability

This model is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, title, and non-infringement. Blackfrost does not warrant that output will be accurate, complete, or suitable for any particular purpose, nor that use of the model will not infringe third-party rights.

To the maximum extent permitted by applicable law, Blackfrost shall not be liable for any claim, damages, or other liability — whether in an action of contract, tort, or otherwise — arising from, out of, or in connection with the model, its output, or the use or other dealings in the model.

7.5 Export, sanctions, and lawful use

Users are responsible for compliance with all applicable export-control and sanctions laws and regulations. This model may not be used in violation of any applicable law, nor in any manner that infringes the rights of others.

---

Blackfrost AI · Las Vegas, Nevada

Engineered for authorized cybersecurity work.