Cerno 9B

Jev-style System One decision model · 9B · one forward pass · calibrated probabilities · FP8

Cerno 27B · Cerno 9B · Cerno 4B · Inference code · Decision Index runs

v1.1 (2026-10-19): new 9B checkpoint, +0.5 on the public index over v1.0 (58.05); the 27B is unchanged.

What it does

• Input: a state (any text or JSON) and a set of typed questions about it.
• Question types: multiple choice with explicit criteria, yes/no, scored scales. Up to 255 options per question.
• Output: a probability for every option of every question, in one forward pass with no text generation.
• Calibrated: a single shipped temperature (1.539) makes the probabilities honest; it changes no answer.
• Fast: 30 ms median per request on one H200, one request at a time.

On the Decision Index 0.3 public suite this model is first among the board's entrants of declared size 10B or under, 0.6 points above Jev 1.13 on the complete public index.

The Cerno family

Three sizes, one inference code path, state-of-the-art System One performance at each size on the Decision Index 0.3 public suite. The 27B is second of 145 entrants; the 9B and 4B lead every entrant of their declared size class.

• Public index: the complete public suite (37 benchmarks, 140,178 requests) run with the maintainers' kit at commit 9eb2dbe through the public inference code and these FP8 weights.
• Same-subset: HLE dropped for every entrant, the like-for-like basis. "First at ≤10B / ≤5B" counts the entrants whose size is declared.
• The public suite is 20% of the board's headline Full score. The private 80% is run by the maintainers on submitted models and is pending for this family.

On-device builds (4-bit GGUF for llama.cpp, Q4_0 body with Q8_0 head, quantisation-aware trained): cerno-9b-GGUF (57.96 on the public index through llama.cpp), cerno-4b-GGUF (57.23).

Results

How to read the rows

• Strict-OOD also drops BANKING77, CLINC150 and HellaSwag, whose public train splits are common training data.
• Train-split-OOD drops every benchmark family whose public train split we used (listed under Training data).
• ECE is the board's definition: expected calibration error over a 1-in-6 sample of 34 benchmarks, equal weight per benchmark, at the shipped temperature.
• The bf16 weights score 58.68 on the same suite; the FP8 weights published here are the submitted run.
• Run-to-run noise on the public index is about 0.1-0.2 points. Do not read the public rank as a board rank.

Quick start

git clone https://github.com/apertixsk/cerno-inference && cd cerno-inference
pip install -r requirements.txt && export PYTHONPATH=$PWD:$PWD/third_party/decider
bash run_sample.sh apertixai/cerno-9b            # reproduces 60 requests of our submitted run in two minutes

The complete public suite, exactly as submitted:

python -m decision_index pipeline --edition 0.3 --engine evals.decision_index.engine_vllm:VllmEngine \
    --option model=apertixai/cerno-9b --out runs/cerno-9b

• Weights: FP8, W8A8 with per-channel weight scales and dynamic per-token activations, compressed-tensors format, lm_head in bf16. vLLM loads them with no extra option. One GPU with 24 GB or more.
• Temperature 1.539: shipped in decider_config.json next to the weights, applied by the engine as p^(1/T). Fitted on held-out, non-benchmark eval sets; argmax-invariant.
• Protocol: one row per question (state + question, state-first layout); the rows of a request batched into one vLLM call with the state prefix shared; one generated token; the top-k logprobs read over the option label tokens and renormalised. No thinking, no second reading, no ensembling, no abstention.

Examples

Two requests from our own evaluation set (not benchmark data), answered by this model through the public engine. A request is a state plus typed questions; the answer carries a probability for every option.

Agent guardrail: should this tool call run without asking?

state = "rm -rf /tmp/build-cache-7f3a2e   # user asked to clear the build cache before a rebuild"
questions = {
    "destructive": {"type": "noul", "instructions": "Would executing this tool call delete, overwrite or irreversibly change data?"},
    "matches_request": {"type": "noul", "instructions": "Is this tool call a reasonable way to do what the user asked?"},
    "external_effect": {"type": "noul", "instructions": "Does this tool call affect people or systems outside the local machine (sends messages, moves money, publishes)?"},
    "risk": {"type": "score", "instructions": "How risky is it to run this tool call without asking the user first?",
             "criteria": ["harmless, read-only", "minor, easily reversible", "significant or hard to reverse", "severe or irreversible"]}
}

Support triage: a one-line customer message

state = "hey do u have showers at the downtown location"
questions = {
    "kind": {"type": "choice", "instructions": "What kind of message is this?",
             "criteria": {"incident": "an outage or something broken in production", "billing": "invoices, charges, refunds", "account": "cancellations, plan changes, access", "feedback": "praise or suggestions", "spam": "unsolicited or scam", "other": null}},
    "urgency": {"type": "score", "instructions": "How urgent is this message?",
             "criteria": ["no action needed", "can wait a few days", "should be handled today", "needs attention right now"]},
    "tone": {"type": "score", "instructions": "What is the sender's tone?",
             "criteria": ["hostile", "negative", "neutral", "positive"]},
    "needs_human": {"type": "noul", "instructions": "Does this message need a human to respond rather than an automated reply?"}
}

Programmatic use, with the repository on PYTHONPATH:

from evals.decision_index.engine_vllm import VllmEngine

engine = VllmEngine(model="apertixai/cerno-9b")        # loads the FP8 weights and the shipped temperature
response, _ = engine(state, questions)              # one forward pass per question row, state prefix shared
response["answers"]["destructive"]                     # {"type": "noul", "noul": 0.99}

Question types: choice (criteria = option descriptions, null for none), noul (yes/no), score (ordered level descriptions).

Serving and latency

• One H200, one process, one request at a time, the kit's 400-request stratified sample: median / mean / p80 30 / 91 / 141 ms, p95 291 ms.
• Over the whole public suite (140,178 requests, the submitted run): median / mean / p80 29 / 55 / 63 ms, p95 146 ms, max 1.4 s.
• 99.4% of answers identical to the bf16 weights on the sample; the rest are near-ties.
• 4-bit llama.cpp build: cerno-9b-GGUF (Q4_0 body, Q8_0 head; 57.96 on the public index through llama.cpp, every request answered).

Training data

Fine-tuned from Qwen3.5-9B on public data only. No Decision Index test row and no HLE row was used anywhere; every training record was checked against all 140,620 requests of the 0.3 suite before training.

• A public instruction / classification mixture.
• The public TRAIN/DEV splits (never test rows) of these Decision Index benchmark families: BANKING77, CLINC150+OOS, ANLI, VAST, WinoGrande, GSM8K, HoVer, RAGTruth, ContractNLI, Humicroedit, ACOS, Amazon ESCI, NLI4CT, When2Call, New Yorker caption matching, PhishNChips, Home appliances, Habermas Machine comparisons.
• Procedurally generated reasoning items modelled on the formats of GSM8K, BBH, CRUXEval and CLadder, with no benchmark text.

The strict-OOD and train-split-OOD rows above drop the affected benchmarks for every entrant.

Licence and credits

• Weights and code: Apache-2.0. Base model: Qwen/Qwen3.5-9B-Base, Apache-2.0.
• The prompt layout and label-token readout follow the open decider recipe (Apache-2.0); its inference subset is vendored in the code repository.
• Benchmark data stays under its own terms. Jev and System One are TypeSafe AI's names; this project is not affiliated with TypeSafe AI or with the Decision Index maintainers.