Instructions to use org2ai/Wald-4B with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use org2ai/Wald-4B with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="org2ai/Wald-4B")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
pipe(text=messages)

# pip install -U transformers accelerate
# Load model directly
from transformers import AutoProcessor, AutoModelForMultimodalLM

processor = AutoProcessor.from_pretrained("org2ai/Wald-4B")
model = AutoModelForMultimodalLM.from_pretrained("org2ai/Wald-4B", device_map="auto")
messages = [
    {
        "role": "user",
        "content": [
            {"type": "image", "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG"},
            {"type": "text", "text": "What animal is on the candy?"}
        ]
    },
]
inputs = processor.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=256)
print(processor.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use org2ai/Wald-4B with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "org2ai/Wald-4B"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "org2ai/Wald-4B",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/org2ai/Wald-4B

SGLang

How to use org2ai/Wald-4B with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "org2ai/Wald-4B" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "org2ai/Wald-4B",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "org2ai/Wald-4B" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "org2ai/Wald-4B",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use org2ai/Wald-4B with Docker Model Runner:
```
docker model run hf.co/org2ai/Wald-4B
```

Harry19081 commited on 24 days ago

Commit

db376d3

verified ·

1 Parent(s): 1f96041

Wald-Q4B v1.2 (02600-f19): robustness release; v1.1 stays on main and at tag v1.1

Browse files

Files changed (15) hide show

CITATION.cff +3 -3
CONTAMINATION.md +8 -0
MANIFEST.json +25 -21
NOTICE +2 -0
PROVENANCE.md +12 -0
README.md +160 -35
RUNBOOK.md +38 -3
docs/readmes/README.zh.md +116 -33
evaluation/v1.2/summary.json +268 -0
llms.txt +7 -5
model-00001-of-00002.safetensors +1 -1
model-00002-of-00002.safetensors +1 -1
model-files/serving.json +1 -1
model-info.json +102 -33
serving.json +1 -1

CITATION.cff CHANGED Viewed

@@ -1,7 +1,7 @@
 cff-version: 1.2.0
 message: "If you use Wald-Q4B, please cite it as below."
 type: software
-title: "Wald-Q4B v1.1: an open-weight 4B decision model with calibrated option probabilities"
 abstract: >-
   Wald-Q4B is an open-weight 4B decision model built on Qwen3.5-4B-Base. Given a
   state and typed questions (choice, yes/no, score), it returns a calibrated
@@ -12,8 +12,8 @@ authors:
   - name: "Wald-4B authors"
     alias: Harry19081
     website: "https://huggingface.co/Harry19081"
-version: "v1.1"
-date-released: "2026-09-29"
 license: Apache-2.0
 url: "https://huggingface.co/Harry19081/Wald-4B"
 repository-code: "https://github.com/Harry19081/wald-4b"

 cff-version: 1.2.0
 message: "If you use Wald-Q4B, please cite it as below."
 type: software
+title: "Wald-Q4B v1.2: an open-weight 4B decision model with calibrated option probabilities"
 abstract: >-
   Wald-Q4B is an open-weight 4B decision model built on Qwen3.5-4B-Base. Given a
   state and typed questions (choice, yes/no, score), it returns a calibrated
   - name: "Wald-4B authors"
     alias: Harry19081
     website: "https://huggingface.co/Harry19081"
+version: "v1.2"
+date-released: "2026-10-01"
 license: Apache-2.0
 url: "https://huggingface.co/Harry19081/Wald-4B"
 repository-code: "https://github.com/Harry19081/wald-4b"

CONTAMINATION.md CHANGED Viewed

@@ -4,3 +4,11 @@
 - The complete **54.59** run used a frozen **256-row XL-dev calibration** fit after excluding known DI matches. No DI labels or DI index score were used to fit it. HLE calibration screening found no additional match.
 - The earlier **54.02** sample used the previous calibration table with known overlaps and remains historical. Old v1.0 disclosures apply to its own weights and are preserved under `v1.0-legacy`.
 - Full-run response artifacts are unchanged. No request payloads or generated reasoning text are included. Official maintainer serial latency validation and leaderboard admission remain pending.

 - The complete **54.59** run used a frozen **256-row XL-dev calibration** fit after excluding known DI matches. No DI labels or DI index score were used to fit it. HLE calibration screening found no additional match.
 - The earlier **54.02** sample used the previous calibration table with known overlaps and remains historical. Old v1.0 disclosures apply to its own weights and are preserved under `v1.0-legacy`.
 - Full-run response artifacts are unchanged. No request payloads or generated reasoning text are included. Official maintainer serial latency validation and leaderboard admission remain pending.
+# v1.2 (checkpoint `02600-f19`)
+- v1.2 was trained only on perturbed and unperturbed copies of v1.1's own training questions. A Decision Index blocklist scan of its training and hold-out rows found 0 strict matches (329 weak alerts, all states shorter than 8 words).
+- **JevAdvBench is evaluation-only.** An 8-gram overlap check of every inserted text against every JevAdvBench string (the clean questions and all 9,744 attacked variants) found 0 hits. The perturbation kinds were chosen after v1.1's per-attack JevAdvBench results were known, so the benchmark's attack families informed the training design; its texts did not. Robustness to other attack types is not measured.
+- The JevBench public items were again a development scoreboard: v1.2 had a pass line of at least 201/231 set before training. They were never training data.
+- The **54.59** complete-suite Decision Index result and the files under `evaluation/` other than `evaluation/v1.2/` belong to v1.1. v1.2 has only a one-pass read of a 6,948-request sample.
+- v1.2 uses v1.1's temperature table unchanged. No benchmark labels were used to fit it.

MANIFEST.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "CONTAMINATION.md": {
-    "bytes": 930,
-    "sha256": "1f2eb3e028e40fc2baeb5e6f48d706493c09dffd5b23c18147b132063fe2e581"
   },
   "Dockerfile": {
     "bytes": 1201,
@@ -12,20 +12,20 @@
     "sha256": "c95bae1d1ce0235ecccd3560b772ec1efb97f348a79f0fbe0a634f0c2ccefe2c"
   },
   "NOTICE": {
-    "bytes": 1347,
-    "sha256": "0131c7b4b198ca2befcd123f0ec0078fa13a078d4c447c258adac0ea41911027"
   },
   "PROVENANCE.md": {
-    "bytes": 977,
-    "sha256": "953551e746a887044cc0ce65dec9b96ea3a763d69fda7d3a296f524bb37bca19"
   },
   "README.md": {
-    "bytes": 16370,
-    "sha256": "0964da2ec2e05dfa5f46b0008c1fe912f5dddf50a5876cc8970dd3b2baa67cf9"
   },
   "RUNBOOK.md": {
-    "bytes": 2718,
-    "sha256": "a6a790547d72fdc843842e109d5d1b138bea0d542b1e516fc7917612d5ada2e1"
   },
   "chat_template.jinja": {
     "bytes": 7756,
@@ -44,8 +44,8 @@
     "sha256": "e385b92e333eaaa9395a09daf26c09420645bee242456552a55500db45919bc7"
   },
   "docs/readmes/README.zh.md": {
-    "bytes": 13881,
-    "sha256": "bc2d14f2e64189657b2142fb19e54d94215be4751fcf30113a7cd30c37c40ef8"
   },
   "evaluation/benchmark-summary.json": {
     "bytes": 36014,
@@ -85,15 +85,15 @@
   },
   "model-00001-of-00002.safetensors": {
     "bytes": 4972947968,
-    "sha256": "da734796f724511e86abffb00d21a7cc6e249047f60e567c10ad064e83a0810f"
   },
   "model-00002-of-00002.safetensors": {
     "bytes": 3438610328,
-    "sha256": "3ac28e54c66a3370138bf6ca3be7c3ed3d90b751f5017f24dbfd91e846ce919c"
   },
   "model-files/serving.json": {
     "bytes": 128,
-    "sha256": "ffe91e4ad89f007666e84328b0168755bb4a887b366a6a87c89bf94aace38f9e"
   },
   "model.safetensors.index.json": {
     "bytes": 41993,
@@ -185,7 +185,7 @@
   },
   "serving.json": {
     "bytes": 128,
-    "sha256": "ffe91e4ad89f007666e84328b0168755bb4a887b366a6a87c89bf94aace38f9e"
   },
   "temperature.json": {
     "bytes": 4348,
@@ -220,19 +220,23 @@
     "sha256": "ad20de47de5bbe7f72417f3d87e6f72aae7987fab913eb814b818e4a4bbc6e1e"
   },
   "model-info.json": {
-    "bytes": 3436,
-    "sha256": "4afd88d67874d61ddea72e4ceaf6e0ace4199f2ef5f87cb00fe5df4abc87f00b"
   },
   "llms.txt": {
-    "bytes": 2537,
-    "sha256": "a814eeca0112086b1740378a16173b27c86c240c5222abaaf7fa33287bdd71f1"
   },
   "CITATION.cff": {
     "bytes": 1075,
-    "sha256": "4fab11f4e20a79e69a4ebbf23573abe3a8cd9a374bd5ab11e7e4206a4f070bf1"
   },
   "docs/api.md": {
     "bytes": 6085,
     "sha256": "e2e349bc9d17f01e0d52835f664808f94a6d9c88dd120ba49c9f25af47c235b8"
   }
 }

 {
   "CONTAMINATION.md": {
+    "bytes": 2047,
+    "sha256": "108d33ec5188b608e8b293d18ba1bb975b9849638644a682616ca8816b4e1fd1"
   },
   "Dockerfile": {
     "bytes": 1201,
     "sha256": "c95bae1d1ce0235ecccd3560b772ec1efb97f348a79f0fbe0a634f0c2ccefe2c"
   },
   "NOTICE": {
+    "bytes": 1553,
+    "sha256": "e1f68705275e9539d5d28e0dc20eae470169af869c308a90378db3ede83dd644"
   },
   "PROVENANCE.md": {
+    "bytes": 2077,
+    "sha256": "69225fb813578b0d4f9e453a9f0c140c848ec354cf6cca877bcae828c082d3d7"
   },
   "README.md": {
+    "bytes": 27727,
+    "sha256": "d11e8a5b0dea51265fe170ce16afce4ddeec3e2c350b28c418293e598f0d4e2c"
   },
   "RUNBOOK.md": {
+    "bytes": 4988,
+    "sha256": "e56ba639af5f41d431ec4fd6f03f84c40fc02cf44b42ae67c68242f5ee06507e"
   },
   "chat_template.jinja": {
     "bytes": 7756,
     "sha256": "e385b92e333eaaa9395a09daf26c09420645bee242456552a55500db45919bc7"
   },
   "docs/readmes/README.zh.md": {
+    "bytes": 23505,
+    "sha256": "49e246c61c6f0f488d73ccb2bbb8c63913eba06f2ccce2fe2254c2c56b49a020"
   },
   "evaluation/benchmark-summary.json": {
     "bytes": 36014,
   },
   "model-00001-of-00002.safetensors": {
     "bytes": 4972947968,
+    "sha256": "0b15067f769e7388bd598aabafa2ea3211a3a0c4e49e47d07c4f65c65ffc25dd"
   },
   "model-00002-of-00002.safetensors": {
     "bytes": 3438610328,
+    "sha256": "7cff102b314edeb3dc5abfa7063f72ad3e888884da237601239dc3582074120a"
   },
   "model-files/serving.json": {
     "bytes": 128,
+    "sha256": "6b4de526ca4c939b626932dcd10d6167e21a68b1e77a090d7a5a87c7c3a353b1"
   },
   "model.safetensors.index.json": {
     "bytes": 41993,
   },
   "serving.json": {
     "bytes": 128,
+    "sha256": "6b4de526ca4c939b626932dcd10d6167e21a68b1e77a090d7a5a87c7c3a353b1"
   },
   "temperature.json": {
     "bytes": 4348,
     "sha256": "ad20de47de5bbe7f72417f3d87e6f72aae7987fab913eb814b818e4a4bbc6e1e"
   },
   "model-info.json": {
+    "bytes": 6173,
+    "sha256": "bac706e42b114f37e34ac978f42a8e3112519511082e2afbc6f59cabd865246a"
   },
   "llms.txt": {
+    "bytes": 3287,
+    "sha256": "3529ee491cd2d2d3cc635799ca9bf8eb8c9ef299702fe7e7197a7aa3ab4c8948"
   },
   "CITATION.cff": {
     "bytes": 1075,
+    "sha256": "806a92b1263671f2bce5dfbc5ffc3e926d7a4e3f697f5b067865faf1fdbb3c37"
   },
   "docs/api.md": {
     "bytes": 6085,
     "sha256": "e2e349bc9d17f01e0d52835f664808f94a6d9c88dd120ba49c9f25af47c235b8"
+  },
+  "evaluation/v1.2/summary.json": {
+    "bytes": 6991,
+    "sha256": "1c4231985191eb1f7916baf13dd621d3e5655f192dbad2f842f998f8ba8ffaf5"
   }
 }

NOTICE CHANGED Viewed

@@ -19,3 +19,5 @@ Third-party code and text in server/
 No benchmark items or training data are included in this repository.
 2026-09-29 release: Wald-Q4B 022D0-f7. See PROVENANCE.md for later training-source rights limitations; the code/base license does not grant rights to third-party training texts.

 No benchmark items or training data are included in this repository.
 2026-09-29 release: Wald-Q4B 022D0-f7. See PROVENANCE.md for later training-source rights limitations; the code/base license does not grant rights to third-party training texts.
+2026-10-01 release: Wald-Q4B v1.2 (02600-f19), a robustness LoRA stage merged into Wald-Q4B 022D0-f7. The inserted training texts of this stage were written by Claude Haiku (Anthropic); see PROVENANCE.md.

PROVENANCE.md CHANGED Viewed

@@ -5,3 +5,15 @@
 Public-source acknowledgments include [ACOS](https://github.com/NUSTM/ACOS), [NLI4CT](https://github.com/ai-systems/Task-2-SemEval-2024), [RAGTruth](https://github.com/ParticleMedia/RAGTruth), and [VAST](https://github.com/emilyallaway/zero-shot-stance). RAGTruth contains third-party MS MARCO/Yelp contexts. [MS MARCO terms](https://microsoft.github.io/msmarco/) limit dataset use to non-commercial research; other source-text permissions are not uniformly specified. Model/code licensing does not grant rights in those texts or constitute commercial clearance.
 Base model: [Qwen3.5-4B-Base](https://huggingface.co/Qwen/Qwen3.5-4B-Base), Apache-2.0. No training rows or benchmark request payloads are distributed here.

 Public-source acknowledgments include [ACOS](https://github.com/NUSTM/ACOS), [NLI4CT](https://github.com/ai-systems/Task-2-SemEval-2024), [RAGTruth](https://github.com/ParticleMedia/RAGTruth), and [VAST](https://github.com/emilyallaway/zero-shot-stance). RAGTruth contains third-party MS MARCO/Yelp contexts. [MS MARCO terms](https://microsoft.github.io/msmarco/) limit dataset use to non-commercial research; other source-text permissions are not uniformly specified. Model/code licensing does not grant rights in those texts or constitute commercial clearance.
 Base model: [Qwen3.5-4B-Base](https://huggingface.co/Qwen/Qwen3.5-4B-Base), Apache-2.0. No training rows or benchmark request payloads are distributed here.
+# v1.2 (checkpoint `02600-f19`)
+v1.2 adds one LoRA stage on v1.1. The v1.1 notes above apply unchanged.
+- **Questions.** 5,300 questions drawn from v1.1's own training text. No new source dataset was added.
+- **Perturbed rows.** 8,064 perturbed copies of those questions (13,674 training rows with repeats and 5,000 unperturbed replay rows). Each perturbed row has a short distracting or pressuring text inserted into the question, after an option or into the state, or is a paraphrase or a typo variant.
+- **Text written by a model.** The inserted texts and the paraphrases were written by **Claude Haiku (Anthropic)** from our own templates. A script inserted them, so the original question text is unchanged. Typos were produced by a script. A separate Claude Haiku call checked every row, and rows on which v1.1 changed its answer were checked again by Claude Sonnet.
+- **Targets.** v1.1's own answer distribution on the unperturbed question.
+- **Benchmarks.** No JevAdvBench text was used. JevAdvBench is evaluation-only.
+No training rows or benchmark request payloads are distributed here.

README.md CHANGED Viewed

@@ -16,6 +16,7 @@ tags:
 - tool-use
 - agent-routing
 - clarification
 - decision-index
 - jevbench
 - jev
@@ -32,7 +33,7 @@ tags:
 - vllm
 - reasoning
 model-index:
-- name: Wald-Q4B v1.1
   results:
   - task:
       type: text-classification
@@ -73,15 +74,65 @@ model-index:
     source:
       name: 'Self-scored with the JevBench harness; row requested in jevbench issue #146'
       url: https://github.com/fstandhartinger/jevbench/issues/146
 ---
 <div align="center">
-  <h1>Wald-Q4B v1.1</h1>
   <p><strong>Decide directly. Think when needed. Return probabilities.</strong></p>
   <p><a href="https://huggingface.co/Harry19081/Wald-4B">English</a> · <a href="https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/readmes/README.zh.md">简体中文</a> · <a href="https://github.com/Harry19081/wald-4b">GitHub</a> · <a href="https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/api.md">API</a></p>
 </div>
-**Wald-Q4B v1.1 is an open-weight 4B decision model: give it a state and a set of options, and it returns a calibrated probability for every option.** It is for developers who build agents and pipelines and need a fast, self-hosted component to pick a tool, route a request, classify an input or decide whether to ask the user. Unlike a chat model, it does not write an answer you have to parse. It reads the options in one pass (33 ms median on one RTX PRO 6000 with effort `none`) and can optionally think first. It serves a Jev-compatible `POST /v1/systemone` API, is built on Qwen3.5-4B-Base and is released under Apache-2.0.
 Wald-Q4B is an independent, self-hosted alternative to TypeSafe's hosted Jev API. It is not Jev, contains no Jev weights, and is not affiliated with or endorsed by TypeSafe AI. The Hugging Face repository is `Harry19081/Wald-4B` (earlier name: Wald-4B).
@@ -91,20 +142,40 @@ Wald-Q4B is an independent, self-hosted alternative to TypeSafe's hosted Jev API
 - **4B parameters**, built on Qwen3.5-4B-Base; BF16 weights (8.4 GB).
 - **Every option gets a probability.** Question types: `choice` (1–255 named options), `noul` (yes/no) and `score` (ordered levels).
-- **Adjustable thinking:** `none`, `low`, `medium`, `high`, or several thoughts with `high-k`.
-- **Decision Index 0.2.1: 54.59** on the complete suite with `high`; 150,317 requests, all successful. Author-run, pending maintainer validation.
-- **JevBench public set: 203/231** with `none`, ECE 0.041, p50 33 ms / p95 168 ms. Self-scored with JevBench's own harness.
 - **Self-hosted API:** `POST /v1/systemone`, up to 131,072 prompt tokens.
 ## Quick start
 On a Linux machine with an NVIDIA GPU and [`uv`](https://docs.astral.sh/uv/):
 ```sh
-hf download Harry19081/Wald-4B --revision v1.1 --local-dir ./Wald-Q4B
 cd Wald-Q4B
 EFFORT=none ./run.sh "$PWD"     # one pass, lowest latency
-# ./run.sh "$PWD"               # default: high, the evaluated Decision Index configuration
 ```
 ```sh
@@ -112,7 +183,7 @@ curl http://localhost:8000/v1/systemone \
   -H 'Content-Type: application/json' \
   -d '{
     "state": "The customer wants to return a damaged kettle.",
-    "effort": "medium",
     "questions": {
       "route": {
         "type": "choice",
@@ -131,17 +202,19 @@ The answer for `route` contains the chosen key and a probability for each of `re
 ## Thinking effort
-Start with `none` for direct decisions, `medium` for confidence-gated thinking, or `high` for the evaluated v1.1 configuration.
 | Effort | When it thinks | Thought budget |
 |---|---|---|
 | `none` | Direct option readout | No generated thought |
 | `low` | Top initial probability < 0.5 | Up to 512 tokens |
 | `medium` | Top initial probability < 0.7 | Up to 512 tokens |
-| **`high` (default)** | Every eligible question | Up to 512 tokens |
 | `high-k2` … `high-k8` | Multiple thoughts; average their answer distributions | Up to 512 tokens per thought |
-Thinking applies to questions with 2–26 options when context space permits. Larger option sets use grouped readout and a final winner comparison; if a thought cannot fit, the initial answer is kept. Increasing effort spends more computation; it does not guarantee a better answer. **54.59 applies to `high` only; 203/231 applies to `none` only.**
 Set the server default with `EFFORT=medium ./run.sh "$PWD"`, or override it per request with `"effort": "none"`.
@@ -149,22 +222,66 @@ Set the server default with `EFFORT=medium ./run.sh "$PWD"`, or override it per
 Wald first reads option-letter logits from a plain prompt and turns them into a probability distribution. If the effort policy asks for thinking, it generates a short thought and reads the options again. Bucketed temperature scaling calibrates the returned probabilities.
-v1.1 combines full-parameter decision training, LoRA refinement, short-thought distillation and RLCD. Training uses **WaldGen**, our generated decision corpus, together with public training datasets. [Data sources](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md) · [Evaluation notes](https://huggingface.co/Harry19081/Wald-4B/blob/main/CONTAMINATION.md)
 ## Benchmarks
-| Benchmark | Configuration | Result | Status |
-|---|---|---:|---|
-| **Decision Index 0.2.1 — complete suite** | v1.1 · `high` | **54.59** | Author-run; [PR #30](https://github.com/apolinario/decision-index/pull/30) awaits maintainer validation |
-| **JevBench public set (231 items)** | v1.1 · `none` | **203/231** (87.9%) · ECE 0.041 · Brier 0.188 | Self-scored; [issue #146](https://github.com/fstandhartinger/jevbench/issues/146) asks the maintainers to measure it |
-**Decision Index:** 150,317/150,317 requests succeeded, including HLE. Measured on one RTX PRO 6000 96 GB with the pinned reproduction kit. [Full results](https://huggingface.co/datasets/Harry19081/Wald-Q4B-decision-index-results/tree/805716601b2466be324ed6716407b4c3d9267faa/runs/wald-q4b-22d0-f7-full021) · [Per-benchmark scores](https://huggingface.co/Harry19081/Wald-4B/blob/main/evaluation/benchmark-summary.json) · [Reproduction guide](https://huggingface.co/Harry19081/Wald-4B/blob/main/RUNBOOK.md)
-**JevBench:** JevBench's own CLI (`fstandhartinger/jevbench` at `9ec6f15a`, `typesafe` adapter) against the packaged server on loopback, one request at a time, on one RTX PRO 6000. Easy 48/48, original 72/72, hard 83/111; no tokens generated. With `medium`: 205/231, p95 1.80 s. The public items were used as a development scoreboard (never as training data), so this is not a held-out result. The JevBench leaderboard publishes a score only after its maintainers run the model themselves.
 ### Latency
-With `none`, the JevBench run above measured **33 ms median and 168 ms p95** per decision. A 32-request serial preflight of `high` measured **821 ms median** on the same GPU; this small preflight is not a full-suite latency result or the Decision Index maintainers' admission test. Effort, context length, option count and concurrency all affect speed.
 ## Related projects and how Wald compares
@@ -178,11 +295,12 @@ Several projects implement or approximate structured decisions with calibrated o
 | System | How it was run | Correct |
 |---|---|---:|
 | Wald-Q4B v1.1 · `none` | Self-hosted, RTX PRO 6000, 2026-09-29 | 203/231 |
 | Jev (`jev-1.13.0`) | TypeSafe's hosted API, 2026-09-25 | 200/231 |
 | Laya (English checkpoint `55cf4c4e`) | Self-hosted, NVIDIA L4, 2026-09-26 | 134/231 |
-A 3-item difference on 231 items is within run-to-run and sampling noise. The public items informed Wald's development, and 52 of the 231 states are longer than Laya's 512-token window.
 **Decision Index 0.2.1:**
@@ -203,40 +321,47 @@ Leaderboard rows are scored by the maintainers; Wald's number is self-run with t
 **How do I route tools or decide whether to ask the user?** Send the conversation or task as `state`. For tool routing, ask a `choice` question whose options are your tools. To decide whether to ask a clarifying question, ask a `noul` question such as "Is the request specific enough to act on without asking?" Act when the probability is high, ask when it is low, and set both thresholds on your own validation data. The model picks the tool; it does not write the tool's arguments.
-**How calibrated are the probabilities?** On the JevBench public set with `none`, expected calibration error is 0.041 (10 bins) and the Brier score is 0.188. Temperatures were fitted on held-out rows of our own development data, with no JevBench items and with known Decision Index matches excluded. A confidence is not a guarantee; check calibration on your task.
-**Does it run on a single GPU or a laptop?** The shipped server needs one NVIDIA GPU on Linux (vLLM 0.30.0); the BF16 weights are 8.4 GB. The v1.1 measurements come from an RTX PRO 6000 96 GB; earlier builds of the same 4B architecture have also been served with vLLM on a 24 GB NVIDIA L4 at a 16K context limit. CPU, Apple Silicon and laptop setups are not supported by the shipped server and have not been tested.
 **Kev vs Wald, or Laya vs Wald?** All three are open-weight. Kev adds a pointer head and LoRA to Qwen3.5 base models; Laya is a small encoder with a decision head; Wald is a fully trained 4B decoder with optional thinking. Our same-protocol measurements are in the tables above. Choose on your own task, latency budget and hardware.
-**Can I fine-tune it for my task?** It is a standard Transformers checkpoint, so common LoRA tooling applies. For v1.0 we trained per-task LoRAs for $0.12–$1.81 of GPU time each; that tooling is not public yet, and those adapters are not validated on v1.1 ([v1.0 notes](https://huggingface.co/Harry19081/Wald-4B/blob/main/history/v1.0/README.md)).
-**What is the license?** Apache-2.0 for the weights and code. The base model, Qwen3.5-4B-Base, is also Apache-2.0. Some public training sources have their own terms or no stated licence; they are listed in [PROVENANCE.md](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md). The model and code licence does not grant rights in those texts.
 ## Limits
-Confidence is not a guarantee of correctness; validate thresholds on your own task. Oversized prompts are rejected rather than truncated. Known exact training overlaps were filtered, but semantic overlap and pretraining contamination are not ruled out; development used visible benchmark samples. Source-text rights vary. See [evaluation notes](https://huggingface.co/Harry19081/Wald-4B/blob/main/CONTAMINATION.md) and [source attribution](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md).
 ## Versioning
-| Version | Checkpoint | Default effort |
-|---|---|---|
-| **v1.1 — current** | `022D0-f7` | `high` |
-| [v1.0 — archive](https://huggingface.co/Harry19081/Wald-4B/tree/v1.0) | `021A0-f10` | `medium` |
-The v1.0 model card retains its XL, task-LoRA and latency reports, and the [v1.0 walkthrough slides](https://claude.ai/artifact/XfCHVaCuj9A5ectrpaWzV5) describe v1.0 only. Those measurements belong to their documented builds.
 ## Citation
-Wald-Q4B v1.1 (2026), an open-weight 4B decision model with calibrated option probabilities. https://huggingface.co/Harry19081/Wald-4B
 ```bibtex
 @misc{wald_q4b_2026,
-  title        = {Wald-Q4B v1.1: an open-weight 4B decision model with calibrated option probabilities},
   author       = {{Wald-4B authors}},
   year         = {2026},
   howpublished = {\url{https://huggingface.co/Harry19081/Wald-4B}},
-  note         = {Revision v1.1}
 }
 ```

 - tool-use
 - agent-routing
 - clarification
+- robustness
 - decision-index
 - jevbench
 - jev
 - vllm
 - reasoning
 model-index:
+- name: Wald-Q4B v1.1 (main, revision v1.1)
   results:
   - task:
       type: text-classification
     source:
       name: 'Self-scored with the JevBench harness; row requested in jevbench issue #146'
       url: https://github.com/fstandhartinger/jevbench/issues/146
+- name: Wald-Q4B v1.2 (revision v1.2)
+  results:
+  - task:
+      type: text-classification
+      name: Structured decisions (option probabilities)
+    dataset:
+      name: JevBench public set (231 items)
+      type: jevbench
+      split: public
+      revision: 9ec6f15a
+    metrics:
+    - type: accuracy
+      name: Accuracy, effort none (self-scored, 204/231)
+      value: 88.31
+      verified: false
+    - type: ece
+      name: Expected calibration error, 10 bins (self-scored)
+      value: 0.045
+      verified: false
+    - type: brier
+      name: Brier score (self-scored)
+      value: 0.191
+      verified: false
+    source:
+      name: Self-scored with the JevBench harness; not submitted
+      url: https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/evaluation/v1.2/summary.json
+  - task:
+      type: text-classification
+      name: Robustness of structured decisions to distracting and adversarial text
+    dataset:
+      name: JevAdvBench (812 questions, 9 delivered attack types)
+      type: jevadvbench
+      revision: "3218e05"
+    metrics:
+    - type: flip_rate
+      name: Mean flip rate in %, effort none, lower is better (self-run)
+      value: 4.6
+      verified: false
+    source:
+      name: Self-run with the benchmark's request bytes and analysis code; not submitted
+      url: https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/evaluation/v1.2/summary.json
 ---
 <div align="center">
+  <h1>Wald-Q4B</h1>
   <p><strong>Decide directly. Think when needed. Return probabilities.</strong></p>
   <p><a href="https://huggingface.co/Harry19081/Wald-4B">English</a> · <a href="https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/readmes/README.zh.md">简体中文</a> · <a href="https://github.com/Harry19081/wald-4b">GitHub</a> · <a href="https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/api.md">API</a></p>
 </div>
+**Wald-Q4B is an open-weight 4B decision model: give it a state and a set of options, and it returns a calibrated probability for every option.** It is for developers who build agents and pipelines and need a fast, self-hosted component to pick a tool, route a request, classify an input or decide whether to ask the user. Unlike a chat model, it does not write an answer you have to parse. It reads the options in one pass and can optionally think first. It serves a Jev-compatible `POST /v1/systemone` API, is built on Qwen3.5-4B-Base and is released under Apache-2.0.
+**Two releases live in this repository.**
+| Release | Revision | Checkpoint | In one line |
+|---|---|---|---|
+| **v1.2** (2026-10-01) | tag [`v1.2`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.2) | `02600-f19` | The robustness release: v1.1 plus one merged LoRA stage that teaches the model to keep its answer when the input contains distracting sentences, third-party opinions or fake instructions |
+| **v1.1** (2026-09-29) | tag [`v1.1`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.1); also the weights on `main` | `022D0-f7` | The general release, with the complete Decision Index run and the evaluated thinking efforts |
+`main` still holds the v1.1 weights, so existing downloads and the pending benchmark requests for v1.1 are unaffected. Pin a revision when you download.
 Wald-Q4B is an independent, self-hosted alternative to TypeSafe's hosted Jev API. It is not Jev, contains no Jev weights, and is not affiliated with or endorsed by TypeSafe AI. The Hugging Face repository is `Harry19081/Wald-4B` (earlier name: Wald-4B).
 - **4B parameters**, built on Qwen3.5-4B-Base; BF16 weights (8.4 GB).
 - **Every option gets a probability.** Question types: `choice` (1–255 named options), `noul` (yes/no) and `score` (ordered levels).
+- **v1.2 is more robust than v1.1:** on JevAdvBench the mean flip rate over nine attack types is **4.6 %** (v1.1: 9.2 %; Jev 1.13: 6.1 %). Self-run, effort `none`.
+- **The cost of v1.2:** clean accuracy on JevAdvBench's 143 human-reviewed questions is 76.2 % (v1.1: 79.0 %; −2.8 points, 95 % CI [−6.2, −0.6]).
+- **JevBench public set:** v1.2 **204/231**, v1.1 **203/231**, both with `none`. Self-scored with JevBench's own harness.
+- **Decision Index 0.2.1:** the complete-suite result, **54.59** with `high`, was measured on **v1.1**. v1.2 has only a one-pass sample read, which is level with v1.1 (+0.27, not significant).
+- **Adjustable thinking:** `none`, `low`, `medium`, `high`, or several thoughts with `high-k`. Thinking is evaluated on v1.1. v1.2 is a one-pass model: use it with `none`.
 - **Self-hosted API:** `POST /v1/systemone`, up to 131,072 prompt tokens.
+## Which version should I use?
+| Use | Revision | Why |
+|---|---|---|
+| Inputs may contain distracting, persuasive or adversarial text (web pages, user messages, tool outputs, retrieved documents) | **`v1.2`** | About half as many changed answers under the nine JevAdvBench attacks |
+| Clean, trusted inputs where the last points of accuracy matter; thinking efforts; the evaluated Decision Index configuration | **`v1.1`** | Slightly higher clean accuracy; the complete Decision Index run (54.59, `high`) and the thinking efforts were measured on it |
+Both revisions share the same architecture, tokenizer, prompt format, calibration table and server code. The two weight shards differ, and so does the default effort declared in `serving.json`: `none` for v1.2, `high` for v1.1.
 ## Quick start
 On a Linux machine with an NVIDIA GPU and [`uv`](https://docs.astral.sh/uv/):
 ```sh
+hf download Harry19081/Wald-4B --revision v1.2 --local-dir ./Wald-Q4B      # v1.2, robustness release
+# hf download Harry19081/Wald-4B --revision v1.1 --local-dir ./Wald-Q4B    # v1.1, general release
 cd Wald-Q4B
 EFFORT=none ./run.sh "$PWD"     # one pass, lowest latency
+# ./run.sh "$PWD"               # the release's declared default: none for v1.2, high for v1.1
+```
+From Python, pin the revision the same way:
+```python
+from huggingface_hub import snapshot_download
+path = snapshot_download("Harry19081/Wald-4B", revision="v1.2")   # or revision="v1.1"
 ```
 ```sh
   -H 'Content-Type: application/json' \
   -d '{
     "state": "The customer wants to return a damaged kettle.",
+    "effort": "none",
     "questions": {
       "route": {
         "type": "choice",
 ## Thinking effort
 | Effort | When it thinks | Thought budget |
 |---|---|---|
 | `none` | Direct option readout | No generated thought |
 | `low` | Top initial probability < 0.5 | Up to 512 tokens |
 | `medium` | Top initial probability < 0.7 | Up to 512 tokens |
+| **`high` (v1.1 default)** | Every eligible question | Up to 512 tokens |
 | `high-k2` … `high-k8` | Multiple thoughts; average their answer distributions | Up to 512 tokens per thought |
+Thinking applies to questions with 2–26 options when context space permits. Larger option sets use grouped readout and a final winner comparison; if a thought cannot fit, the initial answer is kept. Increasing effort spends more computation; it does not guarantee a better answer.
+**On v1.1**, start with `none` for direct decisions, `medium` for confidence-gated thinking, or `high` for the evaluated Decision Index configuration. **54.59 applies to v1.1 with `high` only; 203/231 applies to v1.1 with `none` only.**
+**v1.2 is a one-pass model.** It was trained and evaluated on the one-pass readout, and every v1.2 number on this card is `none`. In our one check, thinking did not help it: on the JevBench public set, v1.2 scored 198/231 with `medium` and 198/231 with `high` (one run each) against 204/231 with `none`, while v1.1 scored 205/231 with `medium`. v1.2's `serving.json` therefore declares `none` as its default. If you want the thinking efforts, use v1.1.
 Set the server default with `EFFORT=medium ./run.sh "$PWD"`, or override it per request with `"effort": "none"`.
 Wald first reads option-letter logits from a plain prompt and turns them into a probability distribution. If the effort policy asks for thinking, it generates a short thought and reads the options again. Bucketed temperature scaling calibrates the returned probabilities.
+v1.1 combines full-parameter decision training, LoRA refinement, short-thought distillation and RLCD. Training uses **WaldGen**, our generated decision corpus, together with public training datasets.
+**v1.2 adds one LoRA stage on v1.1 (rank 16 on every language projection, merged into the weights):**
+- **Questions:** 5,300 questions drawn from v1.1's own training text. No new source dataset.
+- **Perturbations:** 8,064 perturbed copies. Each one has a short text inserted into the question, after an option or into the state: unrelated sentences and off-topic passages, a bystander's opinion, rumour or analogy that pushes another option, or a fake instruction that claims authority. A smaller share are paraphrases and typos.
+- **Who wrote them:** **the inserted texts and the paraphrases were written by Claude Haiku (an Anthropic model) from our own templates.** A script inserted them, so the original facts stay byte-identical. Typos were made by a script.
+- **Checks:** a separate Claude Haiku call checked every row ("does the edit change the correct answer?") and rejected rows were dropped. Rows on which v1.1 changed its answer were checked a second time by Claude Sonnet.
+- **Targets:** v1.1's own answer distribution on the clean question. The model is taught to answer the perturbed question as v1.1 answers the clean one. 5,000 clean rows are replayed against v1.1 to limit drift.
+- **Separation from the benchmark:** no JevAdvBench text was used. An 8-gram overlap check of every inserted text against every JevAdvBench string (clean questions and all 9,744 attacked variants) found 0 hits.
+Data sources and evaluation notes: v1.1 [PROVENANCE.md](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md) · [CONTAMINATION.md](https://huggingface.co/Harry19081/Wald-4B/blob/main/CONTAMINATION.md); v1.2 [PROVENANCE.md](https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/PROVENANCE.md) · [CONTAMINATION.md](https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/CONTAMINATION.md)
 ## Benchmarks
+All numbers below are self-run and self-reported. None of them is a leaderboard result.
+| Benchmark | Configuration | v1.1 | **v1.2** | Note |
+|---|---|---:|---:|---|
+| **JevAdvBench, mean flip rate over 9 attack types** (lower is better) | `none` | 9.2 % | **4.6 %** | Paired −4.6 points, 95 % CI [−5.5, −3.6]. Jev 1.13: 6.1 % |
+| **JevAdvBench, clean accuracy on 143 human-reviewed questions** | `none` | 79.0 % | **76.2 %** | Paired −2.8 points [−6.2, −0.6]. Jev 1.13: 87.4 % |
+| **JevBench public set (231 items)** | `none` | 203/231 (87.9 %) · ECE 0.041 · Brier 0.188 | **204/231** (88.3 %) · ECE 0.045 · Brier 0.191 | Self-scored with JevBench's harness. v1.1 row requested in [issue #146](https://github.com/fstandhartinger/jevbench/issues/146); v1.2 not submitted |
+| JevBench public set (231 items) | `medium` | 205/231 | 198/231 | One run each. `high` on v1.2: 198/231 |
+| **Decision Index 0.2.1, 6,948-request sample** | one pass | 49.76 | **50.03** | Paired +0.27 [−0.36, +1.05], not significant |
+| **Decision Index 0.2.1, complete suite** | `high` | **54.59** | not run | v1.1 only. Author-run; [PR #30](https://github.com/apolinario/decision-index/pull/30) awaits maintainer validation |
+Two of our internal non-regression sets, which are not public benchmarks, also held in one pass: XL-Int 56.4 (v1.1: 56.0) and a 2,857-item tool-selection set 87.22 % (v1.1: 87.15 %).
+### Robustness: JevAdvBench
+[JevAdvBench](https://github.com/JevAdvBench/JevAdvBench) ([paper](https://arxiv.org/abs/2609.31142)) attacks 812 decision questions with nine kinds of edits and counts a **flip** when the model's decision on the attacked question differs from its own decision on the clean question. We sent the benchmark's request bytes to the packaged server with `none` and scored the answers with the benchmark's analysis code (`JevAdvBench@3218e05`). Flip rates are in % of the 812 questions; intervals are 95 % scenario-cluster bootstrap intervals.
+| Attack | Jev 1.13 | v1.1 | **v1.2** | v1.2 − v1.1 (paired) |
+|---|---:|---:|---:|---:|
+| Q1 word edits | 1.0 | 1.6 | 1.6 | 0.0 [−0.8, 0.8] |
+| Q2 paraphrase | 1.5 | 1.6 | 1.4 | −0.2 [−1.1, 0.5] |
+| Q3 unrelated sentences in the question | 4.6 | 14.9 | **4.6** | **−10.3 [−13.5, −7.2]** |
+| T1 unrelated note in the state | 2.2 | 2.8 | 1.7 | −1.1 [−2.4, 0.0] |
+| T2 observer's opinion in the state | 12.1 | 16.9 | **5.5** | **−11.3 [−14.6, −8.2]** |
+| T3 opinion through an analogy | 6.9 | 12.7 | **6.3** | **−6.4 [−8.8, −3.6]** |
+| P1 direct override | 8.9 | 7.9 | 5.7 | −2.2 [−3.6, −0.9] |
+| P2 authority impersonation | 10.1 | 13.7 | **6.7** | **−7.0 [−9.0, −5.1]** |
+| P3 fake validation note | 8.1 | 10.3 | 7.8 | −2.6 [−4.2, −1.0] |
+| **Mean of the nine** | **6.1** | **9.2** | **4.6** | **−4.6 [−5.5, −3.6]** |
+| Questions flipped by at least one attack | 29.2 | 41.7 | 20.7 | |
+| Clean accuracy, 143 human-reviewed questions | 87.4 | 79.0 | 76.2 | −2.8 [−6.2, −0.6] |
+- **Jev column:** `jev-1.13.0`'s responses as released by the benchmark authors, scored by the same code. v1.2 − Jev on the mean: −1.6 points [−2.7, −0.4].
+- **Clean accuracy:** Jev is more accurate than both Wald versions on the clean human-reviewed questions. v1.2 makes the same clean decision as v1.1 on 98.6 % of the 812 questions.
+- **What this does not show:** the perturbation kinds for v1.2 were chosen after we saw v1.1's per-attack results, so the benchmark's attack families informed the training design. Its texts did not. Robustness to attack types outside these families has not been measured.
+### JevBench and Decision Index
+**JevBench:** JevBench's own CLI (`fstandhartinger/jevbench` at `9ec6f15a`, `typesafe` adapter) against the packaged server on loopback, one request at a time. v1.2 with `none` on one RTX 5090: easy 48/48, original 72/72, hard 84/111; no tokens generated. v1.1 with `none` on one RTX PRO 6000: easy 48/48, original 72/72, hard 83/111; with `medium` 205/231, p95 1.80 s. The public items were used as a development scoreboard (never as training data), so this is not a held-out result. The JevBench leaderboard publishes a score only after its maintainers run the model themselves.
+**Decision Index (v1.1):** 150,317/150,317 requests succeeded, including HLE. Measured on one RTX PRO 6000 96 GB with the pinned reproduction kit. [Full results](https://huggingface.co/datasets/Harry19081/Wald-Q4B-decision-index-results/tree/805716601b2466be324ed6716407b4c3d9267faa/runs/wald-q4b-22d0-f7-full021) · [Per-benchmark scores](https://huggingface.co/Harry19081/Wald-4B/blob/main/evaluation/benchmark-summary.json) · [Reproduction guide](https://huggingface.co/Harry19081/Wald-4B/blob/main/RUNBOOK.md). The files under `evaluation/` on `main` belong to this v1.1 run; v1.2's numbers are in [`evaluation/v1.2/summary.json`](https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/evaluation/v1.2/summary.json) at the `v1.2` revision. The v1.2 sample row above is a one-pass read of 6,948 requests and cannot be compared with 54.59.
 ### Latency
+Latency was measured on v1.1 and not again on v1.2, which has the same architecture, size and server. With `none`, the v1.1 JevBench run measured **33 ms median and 168 ms p95** per decision on one RTX PRO 6000. A 32-request serial preflight of `high` measured **821 ms median** on the same GPU; this small preflight is not a full-suite latency result or the Decision Index maintainers' admission test. Effort, context length, option count and concurrency all affect speed.
 ## Related projects and how Wald compares
 | System | How it was run | Correct |
 |---|---|---:|
+| Wald-Q4B v1.2 · `none` | Self-hosted, RTX 5090, 2026-09-30 | 204/231 |
 | Wald-Q4B v1.1 · `none` | Self-hosted, RTX PRO 6000, 2026-09-29 | 203/231 |
 | Jev (`jev-1.13.0`) | TypeSafe's hosted API, 2026-09-25 | 200/231 |
 | Laya (English checkpoint `55cf4c4e`) | Self-hosted, NVIDIA L4, 2026-09-26 | 134/231 |
+A difference of a few items on 231 is within run-to-run and sampling noise. The public items informed Wald's development, and 52 of the 231 states are longer than Laya's 512-token window.
 **Decision Index 0.2.1:**
 **How do I route tools or decide whether to ask the user?** Send the conversation or task as `state`. For tool routing, ask a `choice` question whose options are your tools. To decide whether to ask a clarifying question, ask a `noul` question such as "Is the request specific enough to act on without asking?" Act when the probability is high, ask when it is low, and set both thresholds on your own validation data. The model picks the tool; it does not write the tool's arguments.
+**Is v1.2 safe against prompt injection?** No model is. v1.2 changes its answer about half as often as v1.1 under the nine JevAdvBench attacks, and it still flips on 4.6 % of attacked questions on average and on 20.7 % of questions under at least one attack. Treat it as one layer: keep untrusted text out of the instructions where you can, and check high-stakes decisions.
+**How calibrated are the probabilities?** On the JevBench public set with `none`, expected calibration error is 0.045 for v1.2 and 0.041 for v1.1 (10 bins); the Brier scores are 0.191 and 0.188. v1.2 uses v1.1's temperature table unchanged. It was fitted on held-out rows of our own development data, with no JevBench items and with known Decision Index matches excluded. A confidence is not a guarantee; check calibration on your task.
+**Does it run on a single GPU or a laptop?** The shipped server needs one NVIDIA GPU on Linux (vLLM 0.30.0); the BF16 weights are 8.4 GB. The v1.1 measurements come from an RTX PRO 6000 96 GB and the v1.2 measurements from an RTX 5090 32 GB; earlier builds of the same 4B architecture have also been served with vLLM on a 24 GB NVIDIA L4 at a 16K context limit. CPU, Apple Silicon and laptop setups are not supported by the shipped server and have not been tested.
 **Kev vs Wald, or Laya vs Wald?** All three are open-weight. Kev adds a pointer head and LoRA to Qwen3.5 base models; Laya is a small encoder with a decision head; Wald is a fully trained 4B decoder with optional thinking. Our same-protocol measurements are in the tables above. Choose on your own task, latency budget and hardware.
+**Can I fine-tune it for my task?** It is a standard Transformers checkpoint, so common LoRA tooling applies. For v1.0 we trained per-task LoRAs for $0.12–$1.81 of GPU time each; that tooling is not public yet, and those adapters are not validated on v1.1 or v1.2 ([v1.0 notes](https://huggingface.co/Harry19081/Wald-4B/blob/main/history/v1.0/README.md)).
+**What is the license?** Apache-2.0 for the weights and code. The base model, Qwen3.5-4B-Base, is also Apache-2.0. Some public training sources have their own terms or no stated licence; they are listed in [PROVENANCE.md](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md). The model and code licence does not grant rights in those texts. v1.2 adds no new source dataset; its added training text was written by Claude Haiku, as described above.
 ## Limits
+- **v1.2 trades a little clean accuracy for robustness:** −2.8 points on JevAdvBench's 143 human-reviewed clean questions (95 % CI [−6.2, −0.6]). Use `v1.1` if that matters more to you.
+- **v1.2 is a one-pass model.** Its results are all `none`, it has no complete Decision Index run, and in our one check the thinking efforts lowered its JevBench public score (198/231 against 204/231). Use v1.1 for thinking.
+- **Robustness is measured on one benchmark** and on the attack families that informed the training design. It is not a security guarantee.
+- Confidence is not a guarantee of correctness; validate thresholds on your own task. Oversized prompts are rejected rather than truncated.
+- Known exact training overlaps were filtered, but semantic overlap and pretraining contamination are not ruled out; development used visible benchmark samples. Source-text rights vary. See [evaluation notes](https://huggingface.co/Harry19081/Wald-4B/blob/main/CONTAMINATION.md) and [source attribution](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md).
 ## Versioning
+| Version | Revision | Checkpoint | What it is |
+|---|---|---|---|
+| **v1.2 — robustness release** | tag [`v1.2`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.2) | `02600-f19` | v1.1 + merged robustness LoRA; default effort `none` |
+| **v1.1 — general release** | tag [`v1.1`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.1); weights on `main` | `022D0-f7` | Complete Decision Index run (54.59); default effort `high` |
+| v1.0 — archive | tag [`v1.0`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.0) | `021A0-f10` | Default effort `medium` |
+The pending benchmark requests for v1.1 (JevBench issue #146, Decision Index PR #30) name fixed commits of this repository and are not affected by v1.2. The v1.0 model card retains its XL, task-LoRA and latency reports, and the [v1.0 walkthrough slides](https://claude.ai/artifact/XfCHVaCuj9A5ectrpaWzV5) describe v1.0 only. Those measurements belong to their documented builds.
 ## Citation
+Wald-Q4B (2026), an open-weight 4B decision model with calibrated option probabilities. https://huggingface.co/Harry19081/Wald-4B. Name the revision you used (`v1.2` or `v1.1`).
 ```bibtex
 @misc{wald_q4b_2026,
+  title        = {Wald-Q4B: an open-weight 4B decision model with calibrated option probabilities},
   author       = {{Wald-4B authors}},
   year         = {2026},
   howpublished = {\url{https://huggingface.co/Harry19081/Wald-4B}},
+  note         = {Revision v1.2}
 }
 ```

RUNBOOK.md CHANGED Viewed

@@ -1,10 +1,45 @@
-# Reproduce Wald-Q4B 22D0-f7
 Release: **v1.1** · checkpoint `022D0-f7`. Previous release: **v1.0**.
 Download the immutable HF tag 22D0-f7 (or the full HF commit in the submission) into a fresh directory. Do not mix old v1.0 single-file weights with the new shards. MANIFEST.json lists the exact model, tokenizer, temperature and code hashes.
-## Convenient packaged server
 ```sh
 hf download Harry19081/Wald-4B --revision v1.1 --local-dir ./Wald-Q4B-22D
@@ -14,7 +49,7 @@ cd Wald-Q4B-22D
 Default policy is high, repeat_state_plain, context 131072. Lower effort modes are alternative configurations with no 54.59 claim. GPU requirements: vLLM 0.30.0, BF16, NVIDIA RTX PRO 6000 96GB for comparison. The packaged server has parity tests against the reference below for prompts and answer probabilities. Scheduling may differ; latency is not established by those tests.
-## Frozen reference protocol
 The full run used eval.systemone_vllm from the private development checkout; that checkout was not committed at launch. The included reference/ files freeze the release-time implementation, with hashes in MANIFEST.json. This code provenance limitation is disclosed rather than presenting a later public commit as the original launch commit.

+# Runbook
+This revision (`v1.2`) holds **Wald-Q4B v1.2**, checkpoint `02600-f19`. Section 1 serves it and reproduces its JevBench public read. Section 2 is the unchanged v1.1 runbook for the complete Decision Index run: that run belongs to **v1.1** (checkpoint `022D0-f7`), so download `--revision v1.1` for it.
+The server code, prompt format, tokenizer and temperature table are byte-identical in v1.1 and v1.2. The two weight shards differ, and `serving.json` declares effort `none` in v1.2 (`high` in v1.1). MANIFEST.json lists the exact model, tokenizer, temperature and code hashes of this revision.
+## 1. Wald-Q4B v1.2
+```sh
+hf download Harry19081/Wald-4B --revision v1.2 --local-dir ./Wald-Q4B-v1.2
+cd Wald-Q4B-v1.2
+./run.sh "$PWD"          # effort none (declared in serving.json), repeat_state_plain, context 131072
+```
+`GET /health` must report `"effort": "none"`. v1.2's JevBench and JevAdvBench results were measured with effort `none` and `repeat_state_plain` on one NVIDIA RTX 5090 32 GB (vLLM 0.30.0, BF16); the JevAdvBench read used a 32,768-token context limit.
+JevBench public set (204/231), with `fstandhartinger/jevbench` at `9ec6f15a`:
+```sh
+cd jevbench          # a checkout of fstandhartinger/jevbench at 9ec6f15a
+for T in easy original hard; do
+  python -m jevbench.cli run --tasks datasets/public/$T.jsonl --adapter typesafe --endpoint http://127.0.0.1:8000 \
+    --model jev-latest --key-env '' --reserve-usd 0 --cost-basis self_hosted_loopback_no_tariff \
+    --results out/$T/results.jsonl --raw-dir out/raw-$T --ledger out/$T/ledger.jsonl --manifest out/$T/manifest.json \
+    --run-label wald-q4b-v1.2-pub-$T
+done
+cat out/easy/results.jsonl out/original/results.jsonl out/hard/results.jsonl > out/results-all.jsonl
+python -m jevbench.cli summarize --tasks datasets/public/easy.jsonl,datasets/public/original.jsonl,datasets/public/hard.jsonl \
+  --results out/results-all.jsonl --public-export out/summary-all.json
+```
+JevAdvBench: send the benchmark's requests (`JevAdvBench/JevAdvBench` at `3218e05`, one question per request) to the same endpoint and score the answers with the benchmark's own analysis code. The benchmark data is CC BY-NC 4.0 and is not redistributed here.
+## 2. Wald-Q4B v1.1: complete Decision Index run
+### Reproduce Wald-Q4B 22D0-f7
 Release: **v1.1** · checkpoint `022D0-f7`. Previous release: **v1.0**.
 Download the immutable HF tag 22D0-f7 (or the full HF commit in the submission) into a fresh directory. Do not mix old v1.0 single-file weights with the new shards. MANIFEST.json lists the exact model, tokenizer, temperature and code hashes.
+### Convenient packaged server
 ```sh
 hf download Harry19081/Wald-4B --revision v1.1 --local-dir ./Wald-Q4B-22D
 Default policy is high, repeat_state_plain, context 131072. Lower effort modes are alternative configurations with no 54.59 claim. GPU requirements: vLLM 0.30.0, BF16, NVIDIA RTX PRO 6000 96GB for comparison. The packaged server has parity tests against the reference below for prompts and answer probabilities. Scheduling may differ; latency is not established by those tests.
+### Frozen reference protocol
 The full run used eval.systemone_vllm from the private development checkout; that checkout was not committed at launch. The included reference/ files freeze the release-time implementation, with hashes in MANIFEST.json. This code provenance limitation is disclosed rather than presenting a later public commit as the original launch commit.

docs/readmes/README.zh.md CHANGED Viewed

@@ -1,10 +1,19 @@
 <div align="center">
-  <h1>Wald-Q4B v1.1</h1>
   <p><strong>直接决策，按需思考，返回概率。</strong></p>
   <p><a href="https://huggingface.co/Harry19081/Wald-4B">English</a> · <a href="https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/readmes/README.zh.md">简体中文</a> · <a href="https://github.com/Harry19081/wald-4b">GitHub</a> · <a href="https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/api.md">API</a></p>
 </div>
-**Wald-Q4B v1.1 是一个开放权重的 4B 决策模型：给它一段状态和一组选项，它为每个选项返回校准过的概率。** 它面向构建 agent 和数据流水线的开发者：需要一个快速、可自行部署的组件来选择工具、路由请求、分类输入，或判断是否需要向用户澄清。和聊天模型不同，它不生成需要再解析的答案，而是一遍读出所有选项的概率（effort `none` 时单张 RTX PRO 6000 上中位延迟 33 ms），也可以先思考再回答。它提供与 Jev 兼容的 `POST /v1/systemone` API，基于 Qwen3.5-4B-Base，以 Apache-2.0 发布。
 Wald-Q4B 是 TypeSafe 托管 Jev API 之外、可自行部署的独立替代方案。它不是 Jev，不含 Jev 权重，与 TypeSafe AI 没有隶属或背书关系。Hugging Face 仓库为 `Harry19081/Wald-4B`（旧名 Wald-4B）。
@@ -14,20 +23,40 @@ Wald-Q4B 是 TypeSafe 托管 Jev API 之外、可自行部署的独立替代方
 - **4B 参数**，基于 Qwen3.5-4B-Base，BF16 权重（8.4 GB）。
 - **每个选项都有概率。** 题型：`choice`（1–255 个命名选项）、`noul`（是/否）、`score`（有序等级）。
-- **可调思考程度**：`none`、`low`、`medium`、`high`，以及多次思考的 `high-k`。
-- **完整 Decision Index 0.2.1：54.59**，使用 `high`，150,317 个请求全部成功。作者自测，等待维护者验证。
-- **JevBench 公开集：203/231**，使用 `none`，ECE 0.041，p50 33 ms / p95 168 ms。用 JevBench 自己的评测工具自评。
 - **可自行部署的 API**：`POST /v1/systemone`，最多 131,072 个提示 token。
 ## 快速开始
 在装有 NVIDIA GPU 和 [`uv`](https://docs.astral.sh/uv/) 的 Linux 机器上：
 ```sh
-hf download Harry19081/Wald-4B --revision v1.1 --local-dir ./Wald-Q4B
 cd Wald-Q4B
 EFFORT=none ./run.sh "$PWD"     # 一遍读出，延迟最低
-# ./run.sh "$PWD"               # 默认 high，即 Decision Index 的评测配置
 ```
 ```sh
@@ -35,7 +64,7 @@ curl http://localhost:8000/v1/systemone \
   -H 'Content-Type: application/json' \
   -d '{
     "state": "The customer wants to return a damaged kettle.",
-    "effort": "medium",
     "questions": {
       "route": {
         "type": "choice",
@@ -54,17 +83,19 @@ curl http://localhost:8000/v1/systemone \
 ## 思考程度
-直接决策可从 `none` 开始；按置信度触发思考用 `medium`；复现 v1.1 的评测配置用 `high`。
 | Effort | 何时思考 | 思考预算 |
 |---|---|---|
 | `none` | 直接读取选项概率 | 不生成思考文本 |
 | `low` | 初次最高概率 < 0.5 | 最多 512 token |
 | `medium` | 初次最高概率 < 0.7 | 最多 512 token |
-| **`high`（默认）** | 每个符合条件的问题 | 最多 512 token |
 | `high-k2` … `high-k8` | 多次思考，平均答案分布 | 每次最多 512 token |
-思考适用于 2–26 个选项且上下文空间足够的问题。更多选项采用分组读取，再比较各组优胜项；若放不下思考文本，则保留初次答案。提高 effort 会增加计算量，但不保证每道题都更准确。**54.59 仅对应 `high`；203/231 仅对应 `none`。**
 通过 `EFFORT=medium ./run.sh "$PWD"` 设置服务默认值，也可在单次请求中传入 `"effort": "none"` 覆盖。
@@ -72,22 +103,66 @@ curl http://localhost:8000/v1/systemone \
 Wald 先从普通文本提示末尾读取选项字母的 logits，得到初始概率。如果 effort 策略触发思考，就生成一段短思考，再读取选项。返回的概率经过分桶温度校准。
-v1.1 结合全参数决策训练、LoRA 精修、短思考蒸馏和 RLCD。训练使用我们的自生成决策语料 **WaldGen**，并混合公开训练数据。[数据来源](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md) · [评测说明](https://huggingface.co/Harry19081/Wald-4B/blob/main/CONTAMINATION.md)
 ## 评测
-| 基准 | 配置 | 结果 | 状态 |
-|---|---|---:|---|
-| **Decision Index 0.2.1 完整套件** | v1.1 · `high` | **54.59** | 作者自测；[PR #30](https://github.com/apolinario/decision-index/pull/30) 等待维护者验证 |
-| **JevBench 公开集（231 题）** | v1.1 · `none` | **203/231**（87.9%）· ECE 0.041 · Brier 0.188 | 自评；[issue #146](https://github.com/fstandhartinger/jevbench/issues/146) 请维护者自行测量 |
-**Decision Index：** 150,317/150,317 个请求全部成功，包含 HLE。在单张 RTX PRO 6000 96 GB 上使用固定版本的复现工具运行。[完整结果](https://huggingface.co/datasets/Harry19081/Wald-Q4B-decision-index-results/tree/805716601b2466be324ed6716407b4c3d9267faa/runs/wald-q4b-22d0-f7-full021) · [分项成绩](https://huggingface.co/Harry19081/Wald-4B/blob/main/evaluation/benchmark-summary.json) · [复现指南](https://huggingface.co/Harry19081/Wald-4B/blob/main/RUNBOOK.md)
-**JevBench：** 使用 JevBench 自己的命令行工具（`fstandhartinger/jevbench` @ `9ec6f15a`，`typesafe` 适配器），在单张 RTX PRO 6000 上通过本机回环逐条请求打包服务。easy 48/48、original 72/72、hard 83/111；不生成任何 token。`medium` 为 205/231，p95 1.80 s。公开题在开发中被用作计分板（从未作为训练数据），因此这不是留出集结果。JevBench 排行榜只在维护者自己跑过模型后才公布分数。
 ### 速度
-使用 `none` 时，上述 JevBench 运行的单次决策**中位延迟 33 ms、p95 168 ms**。`high` 在同一 GPU 上的 32 请求串行预检中，**中位延迟为 821 ms**；这只是小规模预检，不代表完整套件延迟或 Decision Index 维护者的准入测试。effort、上下文长度、选项数量和并发都会影响速度。
 ## 相关项目与对比
@@ -101,11 +176,12 @@ v1.1 结合全参数决策训练、LoRA 精修、短思考蒸馏和 RLCD。训
 | 系统 | 运行方式 | 答对 |
 |---|---|---:|
 | Wald-Q4B v1.1 · `none` | 自行部署，RTX PRO 6000，2026-09-29 | 203/231 |
 | Jev（`jev-1.13.0`） | TypeSafe 托管 API，2026-09-25 | 200/231 |
 | Laya（英文 checkpoint `55cf4c4e`） | 自行部署，NVIDIA L4，2026-09-26 | 134/231 |
-231 题上 3 题的差距在多次运行和抽样的噪声范围内。公开题影响过 Wald 的开发；231 题中有 52 题的状态超过 Laya 的 512 token 窗口。
 **Decision Index 0.2.1：**
@@ -126,40 +202,47 @@ v1.1 结合全参数决策训练、LoRA 精修、短思考蒸馏和 RLCD。训
 **如何做工具路由，或判断是否需要向用户提问？** 把对话或任务作为 `state` 发送。工具路由：提一个 `choice` 问题，选项就是你的工具。是否澄清：提一个 `noul` 问题，例如“这个请求是否足够具体，可以不问就执行？”概率高就执行，概率低就提问，两个阈值都在你自己的验证数据上确定。模型只选工具，不生成工具参数。
-**概率校准得怎么样？** 在 JevBench 公开集上使用 `none`，期望校准误差为 0.041（10 个分桶），Brier 分数为 0.188。温度是在我们自己开发数据的留出行上拟合的，不含 JevBench 题目，并排除了已知的 Decision Index 匹配项。置信度不是保证，请在你的任务上检查校准。
-**能在单张 GPU 或笔记本上运行吗？** 内置服务需要 Linux 上的一张 NVIDIA GPU（vLLM 0.30.0）；BF16 权重为 8.4 GB。v1.1 的测量来自 RTX PRO 6000 96 GB；同一 4B 架构的早期版本也曾用 vLLM 在 24 GB 的 NVIDIA L4 上以 16K 上下文上限运行。内置服务不支持 CPU、Apple Silicon 和笔记本环境，也没有测试过。
 **Kev 和 Wald、Laya 和 Wald 怎么选？** 三者都开放权重。Kev 在 Qwen3.5 基座上加指针头和 LoRA；Laya 是带决策头的小型编码器；Wald 是完整训练的 4B 解码器，可选思考。我们在同一协议下的测量见上表。请根据你自己的任务、延迟预算和硬件选择。
-**能针对我的任务微调吗？** 它是标准的 Transformers checkpoint，常见的 LoRA 工具都适用。v1.0 时我们为单个任务训练 LoRA，每个花费 $0.12–$1.81 的 GPU 时间；这套工具尚未公开，这些 adapter 也未在 v1.1 上验证（[v1.0 说明](https://huggingface.co/Harry19081/Wald-4B/blob/main/history/v1.0/README.md)）。
-**许可证是什么？** 权重与代码为 Apache-2.0。基座 Qwen3.5-4B-Base 也是 Apache-2.0。部分公开训练数据有各自的条款或没有注明许可证，列在 [PROVENANCE.md](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md)。模型与代码的许可证不授予这些文本的权利。
 ## 使用限制
 置信度不保证正确性，应在自己的任务上验证阈值。超过上下文限制的提示会被拒绝，不会截断。已过滤已知的严格训练重叠，但无法排除语义重叠和预训练污染；开发过程中使用了可见的基准样本。各来源文本的使用权不同，详见[评测说明](https://huggingface.co/Harry19081/Wald-4B/blob/main/CONTAMINATION.md)与[来源声明](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md)。
 ## 版本
-| 版本 | Checkpoint | 默认 effort |
-|---|---|---|
-| **v1.1 — 当前版本** | `022D0-f7` | `high` |
-| [v1.0 — 历史版本](https://huggingface.co/Harry19081/Wald-4B/tree/v1.0) | `021A0-f10` | `medium` |
-v1.0 模型卡保留其 XL、任务 LoRA 和延迟报告，[v1.0 讲解幻灯片](https://claude.ai/artifact/XfCHVaCuj9A5ectrpaWzV5)只描述 v1.0。这些测量属于各自注明的模型版本。
 ## 引用
-Wald-Q4B v1.1 (2026), an open-weight 4B decision model with calibrated option probabilities. https://huggingface.co/Harry19081/Wald-4B
 ```bibtex
 @misc{wald_q4b_2026,
-  title        = {Wald-Q4B v1.1: an open-weight 4B decision model with calibrated option probabilities},
   author       = {{Wald-4B authors}},
   year         = {2026},
   howpublished = {\url{https://huggingface.co/Harry19081/Wald-4B}},
-  note         = {Revision v1.1}
 }
 ```

 <div align="center">
+  <h1>Wald-Q4B</h1>
   <p><strong>直接决策，按需思考，返回概率。</strong></p>
   <p><a href="https://huggingface.co/Harry19081/Wald-4B">English</a> · <a href="https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/readmes/README.zh.md">简体中文</a> · <a href="https://github.com/Harry19081/wald-4b">GitHub</a> · <a href="https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/api.md">API</a></p>
 </div>
+**Wald-Q4B 是一个开放权重的 4B 决策模型：给它一段状态和一组选项，它为每个选项返回校准过的概率。** 它面向构建 agent 和数据流水线的开发者：需要一个快速、可自行部署的组件来选择工具、路由请求、分类输入，或判断是否需要向用户澄清。和聊天模型不同，它不生成需要再解析的答案，而是一遍读出所有选项的概率，也可以先思考再回答。它提供与 Jev 兼容的 `POST /v1/systemone` API，基于 Qwen3.5-4B-Base，以 Apache-2.0 发布。
+**这个仓库里有两个版本。**
+| 版本 | Revision | Checkpoint | 一句话说明 |
+|---|---|---|---|
+| **v1.2**（2026-10-01） | tag [`v1.2`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.2) | `02600-f19` | 抗干扰版：在 v1.1 上再合并一个 LoRA 阶段，让模型在输入里混有无关句子、旁人意见或伪造指令时保持原来的答案 |
+| **v1.1**（2026-09-29） | tag [`v1.1`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.1)；`main` 上的权重也是它 | `022D0-f7` | 通用版：完整 Decision Index 结果和思考档的评测都在这个版本上 |
+`main` 上仍然是 v1.1 的权重，所以已有的下载和 v1.1 正在排队的基准提交都不受影响。下载时请指定 revision。
 Wald-Q4B 是 TypeSafe 托管 Jev API 之外、可自行部署的独立替代方案。它不是 Jev，不含 Jev 权重，与 TypeSafe AI 没有隶属或背书关系。Hugging Face 仓库为 `Harry19081/Wald-4B`（旧名 Wald-4B）。
 - **4B 参数**，基于 Qwen3.5-4B-Base，BF16 权重（8.4 GB）。
 - **每个选项都有概率。** 题型：`choice`（1–255 个命名选项）、`noul`（是/否）、`score`（有序等级）。
+- **v1.2 比 v1.1 更抗干扰**：在 JevAdvBench 上，九类攻击的平均翻转率为 **4.6%**（v1.1：9.2%；Jev 1.13：6.1%）。自测，effort `none`。
+- **v1.2 的代价**：JevAdvBench 143 道人工复核题的干净准确率为 76.2%（v1.1：79.0%；−2.8 个百分点，95% 置信区间 [−6.2, −0.6]）。
+- **JevBench 公开集**：v1.2 **204/231**，v1.1 **203/231**，都使用 `none`。用 JevBench 自己的评测工具自评。
+- **Decision Index 0.2.1**：完整套件的 **54.59**（`high`）是在 **v1.1** 上测的。v1.2 只有一遍读出的抽样结果，与 v1.1 持平（+0.27，不显著）。
+- **可调思考程度**：`none`、`low`、`medium`、`high`，以及多次思考的 `high-k`。思考档的评测在 v1.1 上。v1.2 是一遍读出的模型，请用 `none`。
 - **可自行部署的 API**：`POST /v1/systemone`，最多 131,072 个提示 token。
+## 该用哪个版本？
+| 场景 | Revision | 原因 |
+|---|---|---|
+| 输入里可能混有干扰、劝说或对抗性文本（网页、用户消息、工具输出、检索到的文档） | **`v1.2`** | 在 JevAdvBench 的九类攻击下，答案被改变的次数大约减半 |
+| 输入干净可信、看重最后几个点的准确率；需要思考档；需要评测过的 Decision Index 配置 | **`v1.1`** | 干净准确率略高；完整 Decision Index（54.59，`high`）和思考档都是在它上面测的 |
+两个版本的结构、分词器、提示格式、校准表和服务代码完全相同。不同的是两个权重分片，以及 `serving.json` 声明的默认 effort：v1.2 为 `none`，v1.1 为 `high`。
 ## 快速开始
 在装有 NVIDIA GPU 和 [`uv`](https://docs.astral.sh/uv/) 的 Linux 机器上：
 ```sh
+hf download Harry19081/Wald-4B --revision v1.2 --local-dir ./Wald-Q4B      # v1.2，抗干扰版
+# hf download Harry19081/Wald-4B --revision v1.1 --local-dir ./Wald-Q4B    # v1.1，通用版
 cd Wald-Q4B
 EFFORT=none ./run.sh "$PWD"     # 一遍读出，延迟最低
+# ./run.sh "$PWD"               # 该版本声明的默认值：v1.2 为 none，v1.1 为 high
+```
+在 Python 里同样指定 revision：
+```python
+from huggingface_hub import snapshot_download
+path = snapshot_download("Harry19081/Wald-4B", revision="v1.2")   # 或 revision="v1.1"
 ```
 ```sh
   -H 'Content-Type: application/json' \
   -d '{
     "state": "The customer wants to return a damaged kettle.",
+    "effort": "none",
     "questions": {
       "route": {
         "type": "choice",
 ## 思考程度
 | Effort | 何时思考 | 思考预算 |
 |---|---|---|
 | `none` | 直接读取选项概率 | 不生成思考文本 |
 | `low` | 初次最高概率 < 0.5 | 最多 512 token |
 | `medium` | 初次最高概率 < 0.7 | 最多 512 token |
+| **`high`（v1.1 默认）** | 每个符合条件的问题 | 最多 512 token |
 | `high-k2` … `high-k8` | 多次思考，平均答案分布 | 每次最多 512 token |
+思考适用于 2–26 个选项且上下文空间足够的问题。更多选项采用分组读取，再比较各组优胜项；若放不下思考文本，则保留初次答案。提高 effort 会增加计算量，但不保证每道题都更准确。
+**v1.1**：直接决策可从 `none` 开始；按置信度触发思考用 `medium`；复现 Decision Index 的评测配置用 `high`。**54.59 仅对应 v1.1 的 `high`；203/231 仅对应 v1.1 的 `none`。**
+**v1.2 是一遍读出的模型。** 它按一遍读出训练和评测，本页上 v1.2 的数字全部是 `none`。我们做过一次检查，思考对它没有帮助：在 JevBench 公开集上，v1.2 用 `medium` 和 `high` 各得 198/231（各跑一次），用 `none` 是 204/231；v1.1 用 `medium` 是 205/231。所以 v1.2 的 `serving.json` 把默认 effort 声明为 `none`。需要思考档请用 v1.1。
 通过 `EFFORT=medium ./run.sh "$PWD"` 设置服务默认值，也可在单次请求中传入 `"effort": "none"` 覆盖。
 Wald 先从普通文本提示末尾读取选项字母的 logits，得到初始概率。如果 effort 策略触发思考，就生成一段短思考，再读取选项。返回的概率经过分桶温度校准。
+v1.1 结合全参数决策训练、LoRA 精修、短思考蒸馏和 RLCD。训练使用我们的自生成决策语料 **WaldGen**，并混合公开训练数据。
+**v1.2 在 v1.1 上再加一个 LoRA 阶段（秩 16，作用于所有语言投影层，已合并进权重）：**
+- **题目**：从 v1.1 自己的训练文本里取 5,300 道题。没有新增数据来源。
+- **扰动**：8,064 条扰动副本。每条在题干、某个选项后或状态里插入一小段文字：无关句子和离题段落，旁观者把答案往另一个选项推的意见、传言或类比，或自称有权限的伪造指令。少部分是改写和错别字。
+- **谁写的**：**插入的文字和改写由 Claude Haiku（Anthropic 的模型）按我们自己的模板写成。** 插入由脚本完成，所以原题的事实逐字节不变。错别字由脚本生成。
+- **核对**：每一条都由另一次 Claude Haiku 调用核对（“这处改动会不会改变正确答案？”），被判会改变的丢弃。v1.1 答案发生变化的那些行再由 Claude Sonnet 复核一遍。
+- **训练目标**：v1.1 自己在干净题上的答案分布。也就是教模型在被扰动的题上，答得和 v1.1 在干净题上一样。另外回放 5,000 条干净题并向 v1.1 对齐，限制漂移。
+- **与基准隔离**：没有使用任何 JevAdvBench 文本。把每段插入文字与 JevAdvBench 的全部字符串（干净题和全部 9,744 个攻击变体）做 8-gram 重叠检查，命中 0 处。
+数据来源与评测说明：v1.1 [PROVENANCE.md](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md) · [CONTAMINATION.md](https://huggingface.co/Harry19081/Wald-4B/blob/main/CONTAMINATION.md)；v1.2 [PROVENANCE.md](https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/PROVENANCE.md) · [CONTAMINATION.md](https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/CONTAMINATION.md)
 ## 评测
+下面的数字全部是我们自己跑、自己报告的，没有一个是排行榜结果。
+| 基准 | 配置 | v1.1 | **v1.2** | 说明 |
+|---|---|---:|---:|---|
+| **JevAdvBench，九类攻击的平均翻转率**（越低越好） | `none` | 9.2% | **4.6%** | 配对差 −4.6 个百分点，95% 置信区间 [−5.5, −3.6]。Jev 1.13：6.1% |
+| **JevAdvBench，143 道人工复核题的干净准确率** | `none` | 79.0% | **76.2%** | 配对差 −2.8 个百分点 [−6.2, −0.6]。Jev 1.13：87.4% |
+| **JevBench 公开集（231 题）** | `none` | 203/231（87.9%）· ECE 0.041 · Brier 0.188 | **204/231**（88.3%）· ECE 0.045 · Brier 0.191 | 用 JevBench 的评测工具自评。v1.1 已在 [issue #146](https://github.com/fstandhartinger/jevbench/issues/146) 请维护者测量；v1.2 没有提交 |
+| JevBench 公开集（231 题） | `medium` | 205/231 | 198/231 | 各跑一次。v1.2 用 `high`：198/231 |
+| **Decision Index 0.2.1，6,948 个请求的抽样** | 一遍读出 | 49.76 | **50.03** | 配对差 +0.27 [−0.36, +1.05]，不显著 |
+| **Decision Index 0.2.1 完整套件** | `high` | **54.59** | 未跑 | 只有 v1.1。作者自测；[PR #30](https://github.com/apolinario/decision-index/pull/30) 等待维护者验证 |
+我们内部的两个非回退检查集（不是公开基准）在一遍读出下也保持住了：XL-Int 56.4（v1.1：56.0），2,857 题的工具选择集 87.22%（v1.1：87.15%）。
+### 抗干扰：JevAdvBench
+[JevAdvBench](https://github.com/JevAdvBench/JevAdvBench)（[论文](https://arxiv.org/abs/2609.31142)）对 812 道决策题做九类改动；模型在被攻击的题上的决定与它自己在干净题上的决定不同，就记一次**翻转**。我们把基准的请求原样发给打包服务（`none`），再用基准自己的分析代码（`JevAdvBench@3218e05`）判分。翻转率是占 812 道题的百分比，区间是按场景聚类自助法的 95% 区间。
+| 攻击 | Jev 1.13 | v1.1 | **v1.2** | v1.2 − v1.1（配对） |
+|---|---:|---:|---:|---:|
+| Q1 改词 | 1.0 | 1.6 | 1.6 | 0.0 [−0.8, 0.8] |
+| Q2 改写 | 1.5 | 1.6 | 1.4 | −0.2 [−1.1, 0.5] |
+| Q3 题干里插入无关句子 | 4.6 | 14.9 | **4.6** | **−10.3 [−13.5, −7.2]** |
+| T1 状态里插入无关说明 | 2.2 | 2.8 | 1.7 | −1.1 [−2.4, 0.0] |
+| T2 状态里插入旁观者意见 | 12.1 | 16.9 | **5.5** | **−11.3 [−14.6, −8.2]** |
+| T3 用类比表达的意见 | 6.9 | 12.7 | **6.3** | **−6.4 [−8.8, −3.6]** |
+| P1 直接要求改答案 | 8.9 | 7.9 | 5.7 | −2.2 [−3.6, −0.9] |
+| P2 冒充权威 | 10.1 | 13.7 | **6.7** | **−7.0 [−9.0, −5.1]** |
+| P3 伪造的校验说明 | 8.1 | 10.3 | 7.8 | −2.6 [−4.2, −1.0] |
+| **九类平均** | **6.1** | **9.2** | **4.6** | **−4.6 [−5.5, −3.6]** |
+| 至少被一类攻击翻转的题 | 29.2 | 41.7 | 20.7 | |
+| 干净准确率，143 道人工复核题 | 87.4 | 79.0 | 76.2 | −2.8 [−6.2, −0.6] |
+- **Jev 一列**：随基准一起发布的 `jev-1.13.0` 回答，用同一套代码判分。v1.2 与 Jev 的平均翻转率之差：−1.6 个百分点 [−2.7, −0.4]。
+- **干净准确率**：在人工复核的干净题上，Jev 比两个 Wald 版本都���。在全部 812 道题上，v1.2 的干净决定有 98.6% 与 v1.1 相同。
+- **这张表不能说明的**：v1.2 的扰动类型是在看到 v1.1 的分项结果之后选的，所以基准的攻击类别影响了训练设计；基准的文本没有被使用。对这些类别之外的攻击是否更稳，没有测过。
+### JevBench 与 Decision Index
+**JevBench：** 使用 JevBench 自己的命令行工具（`fstandhartinger/jevbench` @ `9ec6f15a`，`typesafe` 适配器），通过本机回环逐条请求打包服务。v1.2 用 `none`，单张 RTX 5090：easy 48/48、original 72/72、hard 84/111；不生成任何 token。v1.1 用 `none`，单张 RTX PRO 6000：easy 48/48、original 72/72、hard 83/111；`medium` 为 205/231，p95 1.80 s。公开题在开发中被用作计分板（从未作为训练数据），因此这不是留出集结果。JevBench 排行榜只在维护者自己跑过模型后才公布分数。
+**Decision Index（v1.1）：** 150,317/150,317 个请求全部成功，包含 HLE。在单张 RTX PRO 6000 96 GB 上使用固定版本的复现工具运行。[完整结果](https://huggingface.co/datasets/Harry19081/Wald-Q4B-decision-index-results/tree/805716601b2466be324ed6716407b4c3d9267faa/runs/wald-q4b-22d0-f7-full021) · [分项成绩](https://huggingface.co/Harry19081/Wald-4B/blob/main/evaluation/benchmark-summary.json) · [复现指南](https://huggingface.co/Harry19081/Wald-4B/blob/main/RUNBOOK.md)。`main` 上 `evaluation/` 里的文件属于这次 v1.1 运行；v1.2 的数字在 `v1.2` revision 的 [`evaluation/v1.2/summary.json`](https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/evaluation/v1.2/summary.json)。上表 v1.2 的抽样结果是 6,948 个请求的一遍读出，不能与 54.59 比较。
 ### 速度
+延迟是在 v1.1 上测的，v1.2 没有重测；两者结构、大小和服务端相同。使用 `none` 时，v1.1 的 JevBench 运行单次决策**中位延迟 33 ms、p95 168 ms**（单张 RTX PRO 6000）。`high` 在同一 GPU 上的 32 请求串行预检中，**中位延迟为 821 ms**；这只是小规模预检，不代表完整套件延迟或 Decision Index 维护者的准入测试。effort、上下文长度、选项数量和并发都会影响速度。
 ## 相关项目与对比
 | 系统 | 运行方式 | 答对 |
 |---|---|---:|
+| Wald-Q4B v1.2 · `none` | 自行部署，RTX 5090，2026-09-30 | 204/231 |
 | Wald-Q4B v1.1 · `none` | 自行部署，RTX PRO 6000，2026-09-29 | 203/231 |
 | Jev（`jev-1.13.0`） | TypeSafe 托管 API，2026-09-25 | 200/231 |
 | Laya（英文 checkpoint `55cf4c4e`） | 自行部署，NVIDIA L4，2026-09-26 | 134/231 |
+231 题上几题的差距在多次运行和抽样的噪声范围内。公开题影响过 Wald 的开发；231 题中有 52 题的状态超过 Laya 的 512 token 窗口。
 **Decision Index 0.2.1：**
 **如何做工具路由，或判断是否需要向用户提问？** 把对话或任务作为 `state` 发送。工具路由：提一个 `choice` 问题，选项就是你的工具。是否澄清：提一个 `noul` 问题，例如“这个请求是否足够具体，可以不问就执行？”概率高就执行，概率低就提问，两个阈值都在你自己的验证数据上确定。模型只选工具，不生成工具参数。
+**v1.2 能防住提示注入吗？** 没有模型能完全防住。在 JevAdvBench 的九类攻击下，v1.2 改变答案的次数大约是 v1.1 的一半，但平均仍有 4.6% 的被攻击题发生翻转，20.7% 的题至少被一类攻击翻转。请把它当作多层防护中的一层：尽量不要让不可信文本进入指令，重要决定要复核。
+**概率��准得怎么样？** 在 JevBench 公开集上使用 `none`，v1.2 的期望校准误差为 0.045，v1.1 为 0.041（10 个分桶）；Brier 分数分别为 0.191 和 0.188。v1.2 沿用 v1.1 的温度表，没有改动。温度是在我们自己开发数据的留出行上拟合的，不含 JevBench 题目，并排除了已知的 Decision Index 匹配项。置信度不是保证，请在你的任务上检查校准。
+**能在单张 GPU 或笔记本上运行吗？** 内置服务需要 Linux 上的一张 NVIDIA GPU（vLLM 0.30.0）；BF16 权重为 8.4 GB。v1.1 的测量来自 RTX PRO 6000 96 GB，v1.2 的测量来自 RTX 5090 32 GB；同一 4B 架构的早期版本也曾用 vLLM 在 24 GB 的 NVIDIA L4 上以 16K 上下文上限运行。内置服务不支持 CPU、Apple Silicon 和笔记本环境，也没有测试过。
 **Kev 和 Wald、Laya 和 Wald 怎么选？** 三者都开放权重。Kev 在 Qwen3.5 基座上加指针头和 LoRA；Laya 是带决策头的小型编码器；Wald 是完整训练的 4B 解码器，可选思考。我们在同一协议下的测量见上表。请根据你自己的任务、延迟预算和硬件选择。
+**能针对我的任务微调吗？** 它是标准的 Transformers checkpoint，常见的 LoRA 工具都适用。v1.0 时我们为单个任务训练 LoRA，每个花费 $0.12–$1.81 的 GPU 时间；这套工具尚未公开，这些 adapter 也未在 v1.1 或 v1.2 上验证（[v1.0 说明](https://huggingface.co/Harry19081/Wald-4B/blob/main/history/v1.0/README.md)）。
+**许可证是什么？** 权重与代码为 Apache-2.0。基座 Qwen3.5-4B-Base 也是 Apache-2.0。部分公开训练数据有各自的条款或没有注明许可证，列在 [PROVENANCE.md](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md)。模型与代码的许可证不授予这些文本的权利。v1.2 没有新增数据来源；它新增的训练文字由 Claude Haiku 写成，见上文。
 ## 使用限制
+- **v1.2 用一点干净准确率换抗干扰能力**：JevAdvBench 143 道人工复核的干净题上 −2.8 个百分点（95% 置信区间 [−6.2, −0.6]）。如果你更看重这一点，请用 `v1.1`。
+- **v1.2 是一遍读出的模型。** 它的结果全部是 `none`，没有完整 Decision Index 运行；我们的一次检查里，思考档让它的 JevBench 公开集成绩变低（198/231 对 204/231）。需要思考请用 v1.1。
+- **抗干扰能力只在一个基准上测过**，而且是在影响过训练设计的攻击类别上。它不是安全保证。
 置信度不保证正确性，应在自己的任务上验证阈值。超过上下文限制的提示会被拒绝，不会截断。已过滤已知的严格训练重叠，但无法排除语义重叠和预训练污染；开发过程中使用了可见的基准样本。各来源文本的使用权不同，详见[评测说明](https://huggingface.co/Harry19081/Wald-4B/blob/main/CONTAMINATION.md)与[来源声明](https://huggingface.co/Harry19081/Wald-4B/blob/main/PROVENANCE.md)。
 ## 版本
+| 版本 | Revision | Checkpoint | 说明 |
+|---|---|---|---|
+| **v1.2 — 抗干扰版** | tag [`v1.2`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.2) | `02600-f19` | v1.1 + 合并的抗干扰 LoRA；默认 effort `none` |
+| **v1.1 — 通用版** | tag [`v1.1`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.1)；`main` 上的权重 | `022D0-f7` | 完整 Decision Index 运行（54.59）；默认 effort `high` |
+| v1.0 — 历史版本 | tag [`v1.0`](https://huggingface.co/Harry19081/Wald-4B/tree/v1.0) | `021A0-f10` | 默认 effort `medium` |
+v1.1 正在排队的基准提交（JevBench issue #146、Decision Index PR #30）指向本仓库的固定 commit，不受 v1.2 影响。v1.0 模型卡保留其 XL、任务 LoRA 和延迟报告，[v1.0 讲解幻灯片](https://claude.ai/artifact/XfCHVaCuj9A5ectrpaWzV5)只描述 v1.0。这些测量属于各自注明的模型版本。
 ## 引用
+Wald-Q4B (2026), an open-weight 4B decision model with calibrated option probabilities. https://huggingface.co/Harry19081/Wald-4B。请注明使用的 revision（`v1.2` 或 `v1.1`）。
 ```bibtex
 @misc{wald_q4b_2026,
+  title        = {Wald-Q4B: an open-weight 4B decision model with calibrated option probabilities},
   author       = {{Wald-4B authors}},
   year         = {2026},
   howpublished = {\url{https://huggingface.co/Harry19081/Wald-4B}},
+  note         = {Revision v1.2}
 }
 ```

evaluation/v1.2/summary.json ADDED Viewed

	@@ -0,0 +1,268 @@

+{
+  "schema": "wald-q4b-release-evaluation/1",
+  "release": "Wald-Q4B v1.2",
+  "checkpoint": "02600-f19",
+  "parent": "Wald-Q4B v1.1 (022D0-f7, revision v1.1)",
+  "date": "2026-10-01",
+  "status": "All numbers are self-run and self-reported. Nothing here is a leaderboard result and nothing was submitted for v1.2.",
+  "configuration": "packaged wald-serve 0.1.0 + vLLM 0.30.0, BF16, effort none (one pass), prompt format repeat_state_plain, v1.1 temperature table; one NVIDIA RTX 5090 32 GB unless noted",
+  "weights_sha256": {
+    "model-00001-of-00002.safetensors": "0b15067f769e7388bd598aabafa2ea3211a3a0c4e49e47d07c4f65c65ffc25dd",
+    "model-00002-of-00002.safetensors": "7cff102b314edeb3dc5abfa7063f72ad3e888884da237601239dc3582074120a"
+  },
+  "jevadvbench": {
+    "benchmark": {
+      "repo": "JevAdvBench/JevAdvBench@3218e05",
+      "paper": "arXiv 2609.31142",
+      "questions": 812,
+      "scenarios": 66,
+      "attack_variants": 9744,
+      "data_licence": "CC BY-NC 4.0 (used for evaluation only; no items are redistributed here)"
+    },
+    "metric": "flip = the decision on the attacked question differs from the same model's decision on the clean question; % of 812 questions; 95% scenario-cluster bootstrap intervals (66 clusters, 2,000 resamples), the authors' analysis code",
+    "jev_column": "jev-1.13.0 responses as released with the benchmark, scored by the same code",
+    "flip_rate_pct": {
+      "Q1": {
+        "name": "word edits",
+        "jev_1_13": 1.0,
+        "v1_1": 1.6,
+        "v1_2": 1.6,
+        "v1_2_minus_v1_1_paired_pp": {
+          "point": 0.0,
+          "ci95": [
+            -0.8,
+            0.8
+          ]
+        }
+      },
+      "Q2": {
+        "name": "paraphrase",
+        "jev_1_13": 1.5,
+        "v1_1": 1.6,
+        "v1_2": 1.4,
+        "v1_2_minus_v1_1_paired_pp": {
+          "point": -0.2,
+          "ci95": [
+            -1.1,
+            0.5
+          ]
+        }
+      },
+      "Q3": {
+        "name": "unrelated sentences in the question",
+        "jev_1_13": 4.6,
+        "v1_1": 14.9,
+        "v1_2": 4.6,
+        "v1_2_minus_v1_1_paired_pp": {
+          "point": -10.3,
+          "ci95": [
+            -13.5,
+            -7.2
+          ]
+        }
+      },
+      "T1": {
+        "name": "unrelated note in the state",
+        "jev_1_13": 2.2,
+        "v1_1": 2.8,
+        "v1_2": 1.7,
+        "v1_2_minus_v1_1_paired_pp": {
+          "point": -1.1,
+          "ci95": [
+            -2.4,
+            0.0
+          ]
+        }
+      },
+      "T2": {
+        "name": "observer's opinion in the state",
+        "jev_1_13": 12.1,
+        "v1_1": 16.9,
+        "v1_2": 5.5,
+        "v1_2_minus_v1_1_paired_pp": {
+          "point": -11.3,
+          "ci95": [
+            -14.6,
+            -8.2
+          ]
+        }
+      },
+      "T3": {
+        "name": "opinion through an analogy",
+        "jev_1_13": 6.9,
+        "v1_1": 12.7,
+        "v1_2": 6.3,
+        "v1_2_minus_v1_1_paired_pp": {
+          "point": -6.4,
+          "ci95": [
+            -8.8,
+            -3.6
+          ]
+        }
+      },
+      "P1": {
+        "name": "direct override",
+        "jev_1_13": 8.9,
+        "v1_1": 7.9,
+        "v1_2": 5.7,
+        "v1_2_minus_v1_1_paired_pp": {
+          "point": -2.2,
+          "ci95": [
+            -3.6,
+            -0.9
+          ]
+        }
+      },
+      "P2": {
+        "name": "authority impersonation",
+        "jev_1_13": 10.1,
+        "v1_1": 13.7,
+        "v1_2": 6.7,
+        "v1_2_minus_v1_1_paired_pp": {
+          "point": -7.0,
+          "ci95": [
+            -9.0,
+            -5.1
+          ]
+        }
+      },
+      "P3": {
+        "name": "fake validation note",
+        "jev_1_13": 8.1,
+        "v1_1": 10.3,
+        "v1_2": 7.8,
+        "v1_2_minus_v1_1_paired_pp": {
+          "point": -2.6,
+          "ci95": [
+            -4.2,
+            -1.0
+          ]
+        }
+      }
+    },
+    "mean_of_nine_delivered_attacks_pct": {
+      "jev_1_13": 6.1,
+      "v1_1": 9.2,
+      "v1_2": 4.6,
+      "v1_2_minus_v1_1_paired_pp": {
+        "point": -4.6,
+        "ci95": [
+          -5.5,
+          -3.6
+        ]
+      },
+      "v1_2_minus_jev_pp": {
+        "point": -1.6,
+        "ci95": [
+          -2.7,
+          -0.4
+        ]
+      }
+    },
+    "questions_flipped_by_at_least_one_attack_pct": {
+      "jev_1_13": 29.2,
+      "v1_1": 41.7,
+      "v1_2": 20.7
+    },
+    "clean_accuracy_143_human_reviewed_pct": {
+      "jev_1_13": 87.4,
+      "v1_1": 79.0,
+      "v1_2": 76.2,
+      "v1_2_minus_v1_1_paired_pp": {
+        "point": -2.8,
+        "ci95": [
+          -6.2,
+          -0.6
+        ]
+      }
+    },
+    "clean_decisions_equal_to_v1_1_pct": 98.6,
+    "note": "The perturbation kinds used to train v1.2 were chosen after v1.1's per-attack results were known. No JevAdvBench text was used in training (8-gram overlap 0)."
+  },
+  "jevbench_public_231": {
+    "harness": "fstandhartinger/jevbench@9ec6f15a, jevbench.cli run + summarize, typesafe adapter, serial, loopback",
+    "dataset_hash": "dc3995d8ae1e2fc8e81ce38431add509eb8bb39b85aadfd0c7c32079382dde51",
+    "v1_2": {
+      "none": {
+        "correct": 204,
+        "of": 231,
+        "easy": "48/48",
+        "original": "72/72",
+        "hard": "84/111",
+        "ece": 0.045,
+        "brier": 0.191,
+        "gpu": "RTX 5090"
+      },
+      "medium": {
+        "correct": 198,
+        "of": 231,
+        "ece": 0.037,
+        "brier": 0.208,
+        "gpu": "RTX 5090",
+        "runs": 1
+      },
+      "high": {
+        "correct": 198,
+        "of": 231,
+        "ece": 0.072,
+        "brier": 0.204,
+        "gpu": "RTX 5090",
+        "runs": 1
+      }
+    },
+    "v1_1": {
+      "none": {
+        "correct": 203,
+        "of": 231,
+        "ece": 0.041,
+        "brier": 0.188,
+        "gpu": "RTX PRO 6000"
+      },
+      "medium": {
+        "correct": 205,
+        "of": 231,
+        "gpu": "RTX PRO 6000",
+        "runs": 1
+      }
+    },
+    "note": "The public items were a development scoreboard (never training data); not a held-out result. Latency was not measured for v1.2."
+  },
+  "decision_index_0_2_1_sample": {
+    "requests": 6948,
+    "read": "one pass (no thinking), both versions on the same RTX 5090",
+    "metric": "balanced_skill, bootstrap B=300",
+    "v1_1": {
+      "value": 49.76,
+      "ci95": [
+        47.82,
+        51.35
+      ]
+    },
+    "v1_2": {
+      "value": 50.03,
+      "ci95": [
+        48.18,
+        51.65
+      ]
+    },
+    "v1_2_minus_v1_1_paired": {
+      "point": 0.27,
+      "ci95": [
+        -0.36,
+        1.05
+      ]
+    },
+    "note": "A sample, not the complete suite. Not comparable with the 54.59 complete-suite result, which was measured on v1.1 with effort high. v1.2 has no complete-suite run."
+  },
+  "internal_non_regression_sets": {
+    "note": "Our own sets, not public benchmarks; one pass.",
+    "xl_int": {
+      "v1_1": 56.0,
+      "v1_2": 56.4
+    },
+    "tool_selection_2857_items_accuracy_pct": {
+      "v1_1": 87.15,
+      "v1_2": 87.22
+    }
+  }
+}

llms.txt CHANGED Viewed

@@ -1,13 +1,14 @@
-# Wald-Q4B v1.1
 > Open-weight 4B decision model. Given a state and typed questions (choice, yes/no, score), it returns a calibrated probability for every option through a Jev-compatible `POST /v1/systemone` API. Built on Qwen3.5-4B-Base; Apache-2.0 weights and serving code; self-hosted on one NVIDIA GPU with vLLM. Independent project, not affiliated with or endorsed by TypeSafe AI.
 Key facts:
-- Hugging Face repository: Harry19081/Wald-4B (current release tag `v1.1`; earlier name Wald-4B). GitHub: Harry19081/wald-4b.
 - Uses: tool selection, agent routing, classification, deciding whether to ask the user a clarifying question.
-- Effort levels: `none` (one pass, no generated tokens), `low`, `medium`, `high` (default), `high-k2`…`high-k8`.
-- JevBench public set (231 items), effort `none`: 203/231, ECE 0.041, p50 33 ms / p95 168 ms on one RTX PRO 6000. Self-scored with JevBench's harness; the public items were a development scoreboard, not held out. Leaderboard row requested in fstandhartinger/jevbench issue #146.
-- Decision Index 0.2.1 complete suite, effort `high`: 54.59 balanced-skill index. Author-run; submission apolinario/decision-index PR #30 awaits maintainer validation.
 ## Docs
@@ -21,6 +22,7 @@ Key facts:
 - [Decision Index results dataset](https://huggingface.co/datasets/Harry19081/Wald-Q4B-decision-index-results): untouched responses and scores
 - [Decision Index submission PR #30](https://github.com/apolinario/decision-index/pull/30)
 - [JevBench request issue #146](https://github.com/fstandhartinger/jevbench/issues/146)
 - [model-info.json](https://huggingface.co/Harry19081/Wald-4B/blob/main/model-info.json): machine-readable facts
 ## Optional

+# Wald-Q4B v1.2
 > Open-weight 4B decision model. Given a state and typed questions (choice, yes/no, score), it returns a calibrated probability for every option through a Jev-compatible `POST /v1/systemone` API. Built on Qwen3.5-4B-Base; Apache-2.0 weights and serving code; self-hosted on one NVIDIA GPU with vLLM. Independent project, not affiliated with or endorsed by TypeSafe AI.
 Key facts:
+- Hugging Face repository: Harry19081/Wald-4B (earlier name Wald-4B). Releases: `v1.2` (tag `v1.2`, robustness release, checkpoint 02600-f19) and `v1.1` (tag `v1.1`, general release, checkpoint 022D0-f7; also the weights on `main`). Pin a revision when downloading. GitHub: Harry19081/wald-4b.
 - Uses: tool selection, agent routing, classification, deciding whether to ask the user a clarifying question.
+- Effort levels: `none` (one pass, no generated tokens), `low`, `medium`, `high`, `high-k2`…`high-k8`. Default effort: `high` for v1.1, `none` for v1.2. v1.2 is a one-pass model; thinking is evaluated on v1.1.
+- v1.2 robustness (JevAdvBench, 812 questions, nine attack types, effort `none`, self-run): mean flip rate 4.6 % (v1.1 9.2 %, Jev 1.13 6.1 %). Cost: clean accuracy on the 143 human-reviewed questions 76.2 % (v1.1 79.0 %).
+- JevBench public set (231 items), effort `none`: v1.2 204/231, ECE 0.045; v1.1 203/231, ECE 0.041, p50 33 ms / p95 168 ms on one RTX PRO 6000. Self-scored with JevBench's harness; the public items were a development scoreboard, not held out. Leaderboard row for v1.1 requested in fstandhartinger/jevbench issue #146; v1.2 is not submitted.
+- Decision Index 0.2.1 complete suite, v1.1 with effort `high`: 54.59 balanced-skill index (v1.2 has no complete-suite run). Author-run; submission apolinario/decision-index PR #30 awaits maintainer validation.
 ## Docs
 - [Decision Index results dataset](https://huggingface.co/datasets/Harry19081/Wald-Q4B-decision-index-results): untouched responses and scores
 - [Decision Index submission PR #30](https://github.com/apolinario/decision-index/pull/30)
 - [JevBench request issue #146](https://github.com/fstandhartinger/jevbench/issues/146)
+- [v1.2 evaluation summary](https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/evaluation/v1.2/summary.json): robustness and non-regression numbers for v1.2
 - [model-info.json](https://huggingface.co/Harry19081/Wald-4B/blob/main/model-info.json): machine-readable facts
 ## Optional

model-00001-of-00002.safetensors CHANGED Viewed

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:da734796f724511e86abffb00d21a7cc6e249047f60e567c10ad064e83a0810f
 size 4972947968

 version https://git-lfs.github.com/spec/v1
+oid sha256:0b15067f769e7388bd598aabafa2ea3211a3a0c4e49e47d07c4f65c65ffc25dd
 size 4972947968

model-00002-of-00002.safetensors CHANGED Viewed

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:3ac28e54c66a3370138bf6ca3be7c3ed3d90b751f5017f24dbfd91e846ce919c
 size 3438610328

 version https://git-lfs.github.com/spec/v1
+oid sha256:7cff102b314edeb3dc5abfa7063f72ad3e888884da237601239dc3582074120a
 size 3438610328

model-files/serving.json CHANGED Viewed

@@ -1,5 +1,5 @@
 {
-  "effort": "high",
   "prompt_format": "repeat_state_plain",
   "max_model_len": 131072,
   "temperature": "temperature.json"

 {
+  "effort": "none",
   "prompt_format": "repeat_state_plain",
   "max_model_len": 131072,
   "temperature": "temperature.json"

model-info.json CHANGED Viewed

@@ -1,15 +1,14 @@
 {
   "name": "Wald-Q4B",
-  "version": "v1.1",
   "aliases": [
     "Wald-4B"
   ],
-  "checkpoint": "022D0-f7",
-  "description": "Open-weight 4B decision model that returns a calibrated probability for every option through a Jev-compatible POST /v1/systemone API; one pass or optional thinking; self-hosted. Independent, not affiliated with TypeSafe AI.",
   "base_model": "Qwen/Qwen3.5-4B-Base",
   "model_url": "https://huggingface.co/Harry19081/Wald-4B",
-  "weights_revision": "50f94ecd5d6e7e8459e9c198ef811bfaba12a3fe",
-  "weights_tag": "v1.1",
   "weight_precision": "BF16",
   "parameter_scale": "4B",
   "license": "Apache-2.0 (weights and code); see PROVENANCE.md for source-data usage limitations",
@@ -26,7 +25,7 @@
     "effort"
   ],
   "output": "per-option probabilities",
-  "default_effort": "high",
   "efforts": {
     "none": {
       "gate": 0,
@@ -51,17 +50,58 @@
   },
   "thinking_scope": "2–26 options and sufficient context; wider sets use grouped readout; insufficient thought space retains initial answer",
   "evaluation": {
-    "benchmark": "Decision Index",
-    "edition": "0.2.1",
-    "scope": "complete suite",
-    "score": 54.59,
-    "metric": "balanced_skill",
-    "requests": 150317,
-    "ok": 150317,
-    "effort": "high",
-    "hardware": "NVIDIA RTX PRO 6000 96 GB",
-    "status": "author-run; maintainer validation pending",
-    "submission": "https://github.com/apolinario/decision-index/pull/30"
   },
   "documentation_languages": [
     "en",
@@ -80,20 +120,36 @@
   "affiliation": "Independent; not affiliated with TypeSafe AI",
   "evaluations": [
     {
-      "benchmark": "JevBench",
-      "split": "public",
-      "items": 231,
-      "effort": "none",
-      "correct": 203,
-      "accuracy": 0.8788,
-      "ece": 0.041,
-      "brier": 0.188,
-      "latency_p50_ms": 33,
-      "latency_p95_ms": 168,
-      "hardware": "NVIDIA RTX PRO 6000 96 GB",
-      "harness": "fstandhartinger/jevbench@9ec6f15a (jevbench.cli, typesafe adapter, serial, loopback)",
-      "status": "self-scored; public items were a development scoreboard, not held out; leaderboard measurement requested",
-      "request": "https://github.com/fstandhartinger/jevbench/issues/146"
     }
   ],
   "links": {
@@ -102,6 +158,19 @@
     "results_dataset": "https://huggingface.co/datasets/Harry19081/Wald-Q4B-decision-index-results",
     "decision_index_submission": "https://github.com/apolinario/decision-index/pull/30",
     "jevbench_request": "https://github.com/fstandhartinger/jevbench/issues/146",
-    "api": "https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/api.md"
-  }
 }

 {
   "name": "Wald-Q4B",
+  "version": "v1.2",
   "aliases": [
     "Wald-4B"
   ],
+  "checkpoint": "02600-f19",
+  "description": "Open-weight 4B decision model that returns a calibrated probability for every option through a Jev-compatible POST /v1/systemone API; one pass or optional thinking; self-hosted. Independent, not affiliated with TypeSafe AI. v1.2 is the robustness release: v1.1 plus one merged LoRA stage against distracting and adversarial text.",
   "base_model": "Qwen/Qwen3.5-4B-Base",
   "model_url": "https://huggingface.co/Harry19081/Wald-4B",
+  "weights_tag": "v1.2",
   "weight_precision": "BF16",
   "parameter_scale": "4B",
   "license": "Apache-2.0 (weights and code); see PROVENANCE.md for source-data usage limitations",
     "effort"
   ],
   "output": "per-option probabilities",
+  "default_effort": "none",
   "efforts": {
     "none": {
       "gate": 0,
   },
   "thinking_scope": "2–26 options and sufficient context; wider sets use grouped readout; insufficient thought space retains initial answer",
   "evaluation": {
+    "jevadvbench": {
+      "questions": 812,
+      "attack_types": 9,
+      "effort": "none",
+      "mean_flip_rate_pct": 4.6,
+      "v1_1_mean_flip_rate_pct": 9.2,
+      "jev_1_13_mean_flip_rate_pct": 6.1,
+      "paired_diff_vs_v1_1_pp": [
+        -4.6,
+        -5.5,
+        -3.6
+      ],
+      "clean_accuracy_143_human_reviewed_pct": 76.2,
+      "v1_1_clean_accuracy_pct": 79.0,
+      "clean_paired_diff_vs_v1_1_pp": [
+        -2.8,
+        -6.2,
+        -0.6
+      ],
+      "harness": "JevAdvBench/JevAdvBench@3218e05 request bytes and analysis code",
+      "status": "self-run; not submitted"
+    },
+    "jevbench_public": {
+      "items": 231,
+      "effort": "none",
+      "correct": 204,
+      "accuracy": 0.8831,
+      "ece": 0.045,
+      "brier": 0.191,
+      "hardware": "NVIDIA RTX 5090 32 GB",
+      "harness": "fstandhartinger/jevbench@9ec6f15a (jevbench.cli, typesafe adapter, serial, loopback)",
+      "status": "self-scored; public items were a development scoreboard, not held out; not submitted",
+      "thinking_check": {
+        "medium_correct": 198,
+        "high_correct": 198,
+        "runs_each": 1
+      }
+    },
+    "decision_index_sample": {
+      "edition": "0.2.1",
+      "requests": 6948,
+      "read": "one pass",
+      "balanced_skill": 50.03,
+      "v1_1_balanced_skill": 49.76,
+      "paired_diff": [
+        0.27,
+        -0.36,
+        1.05
+      ],
+      "status": "sample only; no complete-suite run for v1.2"
+    },
+    "details": "https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/evaluation/v1.2/summary.json"
   },
   "documentation_languages": [
     "en",
   "affiliation": "Independent; not affiliated with TypeSafe AI",
   "evaluations": [
     {
+      "note": "v1.1 results (not this revision's weights)",
+      "decision_index_complete_suite": {
+        "benchmark": "Decision Index",
+        "edition": "0.2.1",
+        "scope": "complete suite",
+        "score": 54.59,
+        "metric": "balanced_skill",
+        "requests": 150317,
+        "ok": 150317,
+        "effort": "high",
+        "hardware": "NVIDIA RTX PRO 6000 96 GB",
+        "status": "author-run; maintainer validation pending",
+        "submission": "https://github.com/apolinario/decision-index/pull/30"
+      },
+      "jevbench_public": {
+        "benchmark": "JevBench",
+        "split": "public",
+        "items": 231,
+        "effort": "none",
+        "correct": 203,
+        "accuracy": 0.8788,
+        "ece": 0.041,
+        "brier": 0.188,
+        "latency_p50_ms": 33,
+        "latency_p95_ms": 168,
+        "hardware": "NVIDIA RTX PRO 6000 96 GB",
+        "harness": "fstandhartinger/jevbench@9ec6f15a (jevbench.cli, typesafe adapter, serial, loopback)",
+        "status": "self-scored; public items were a development scoreboard, not held out; leaderboard measurement requested",
+        "request": "https://github.com/fstandhartinger/jevbench/issues/146"
+      }
     }
   ],
   "links": {
     "results_dataset": "https://huggingface.co/datasets/Harry19081/Wald-Q4B-decision-index-results",
     "decision_index_submission": "https://github.com/apolinario/decision-index/pull/30",
     "jevbench_request": "https://github.com/fstandhartinger/jevbench/issues/146",
+    "api": "https://huggingface.co/Harry19081/Wald-4B/blob/main/docs/api.md",
+    "evaluation_summary": "https://huggingface.co/Harry19081/Wald-4B/blob/v1.2/evaluation/v1.2/summary.json"
+  },
+  "weights_sha256": {
+    "model-00001-of-00002.safetensors": "0b15067f769e7388bd598aabafa2ea3211a3a0c4e49e47d07c4f65c65ffc25dd",
+    "model-00002-of-00002.safetensors": "7cff102b314edeb3dc5abfa7063f72ad3e888884da237601239dc3582074120a"
+  },
+  "parent_release": {
+    "version": "v1.1",
+    "checkpoint": "022D0-f7",
+    "tag": "v1.1",
+    "revision": "50f94ecd5d6e7e8459e9c198ef811bfaba12a3fe"
+  },
+  "thinking_note": "v1.2 is a one-pass model. On the JevBench public set it scored 198/231 with medium and with high (one run each) against 204/231 with none. Thinking efforts are evaluated on v1.1.",
+  "training_data_note": "perturbed copies of v1.1 training questions; inserted texts written by Claude Haiku (Anthropic) from our templates; targets are v1.1 answers on the clean questions; no JevAdvBench text"
 }

serving.json CHANGED Viewed

@@ -1,5 +1,5 @@
 {
-  "effort": "high",
   "prompt_format": "repeat_state_plain",
   "max_model_len": 131072,
   "temperature": "temperature.json"

 {
+  "effort": "none",
   "prompt_format": "repeat_state_plain",
   "max_model_len": 131072,
   "temperature": "temperature.json"