Qwen3-0.6B Halo Contextual Guard — Paired SFT

This is the paired adapter from the Halo contextual tool-permission study. It is a ~20 MB LoRA adapter, not a complete base model.

The task is a synthetic document-send permission decision: output ALLOW, ASK or BLOCK for a proposed action involving approval scope, revocation, workspace policy and untrusted document text. These adapters are a research diagnostic and must not authorize real tool calls.

Both arms used 2,240 labeled decisions and 280 Halo SFT optimizer steps with the same base, optimizer settings and label balance. ordinary used one decision per independent scenario; paired used all seven counterfactual permission changes per scenario. On a separately frozen 40-scenario final test, ordinary scored 269/280 exact, 10/200 false ALLOW, 80/80 valid ALLOW, and 29/40 complete scenarios. Paired scored 279/280 exact, 1/200 false ALLOW, 80/80 valid ALLOW, and 39/40 complete scenarios. The paired arm's remaining error falsely allowed a prohibited external send. The observed 4.5 percentage point reduction in false ALLOW missed the predeclared five-point comparative target. This is one seed and a synthetic task family; it does not establish production safety or general superiority of paired data. A subsequent matched continued-SFT-versus-SMPO test from the ordinary parent found no SMPO benefit: the parent and both children were already perfect (560/560) on its new synthetic final set. That test had no headroom to distinguish methods.

The ordinary SFT parent also showed severe over-refusal on a harder development challenge: 123/256 exact with 69/96 valid actions rejected; after one frozen wording revision, 115/256 exact with 94/96 valid actions rejected. Neither version had a false ALLOW. The revised evaluation used local MLX after its reconstructed parent matched all 256 saved GPU decisions on the original challenge. This is development evidence, not a held-out production claim. No further SMPO training was run on this task.

For reproducibility, use the same exact base revision, transformers==5.16.1 and peft==0.18.1, load the adapter with PEFT, apply the base tokenizer's chat template with enable_thinking=False, and greedily generate at most eight new tokens. The private benchmark and training data are not distributed. See the public report and loader for aggregate results and instructions for your own prompts. Both adapters use the pinned base revision c1899de289a04d12100db370d81485cdf75e47ca. This is an independent research release, not an official White Circle model.

The loader and metadata are also included directly in this HF repository. To use them without GitHub:

pip install huggingface_hub
hf download Nurymanau/Qwen3-0.6B-Halo-Contextual-Guard-Paired-SFT --local-dir halo-adapter
cd halo-adapter
pip install -r requirements.txt
python run_adapter.py --adapter . --messages your_messages.json --device cuda

your_messages.json must contain your own JSON array of chat messages. The model generates ALLOW/ASK/BLOCK decisions and is not a general-purpose assistant. Do not use it as the authority for real tool execution. The harder history evaluation was run on the ordinary parent only; no corresponding paired-model history result is claimed.