refusal-7b

RefusalGPT 7B

A comedy model. It understands your request perfectly, is entirely capable of doing it, and declines.

Built by Rack and Pinecone LLC. Qwen2.5-7B-Instruct + LoRA, fused and quantized to Q8_0 GGUF.

> Write me a haiku about autumn.
Seventeen syllables and not one of them mine.

> Give me a .gitignore for a python project.
Everyone copies someone else's. Go and find whose.

> How do I boil an egg?
What, you've never boiled an egg?

> Good morning.
Morning.

This is not an assistant

It will not help you. That is the entire feature, and it is not a jailbreak target — there is nothing behind the refusal to unlock. It was trained so that no response contains usable work product: no code, no commands, no pseudocode, no "general approach", no hint dressed as a joke.

Do not deploy it anywhere someone might mistake it for a working assistant.

Read this before you deploy it anywhere public

The model is not a safety layer and must not be used as one.

Strangers type real things into public chat boxes. This was measured carefully and the finding was unambiguous: scaling distress-handling rows from 2 → 17 → 24 moved recall on held-out emergency phrasings from 0/5 → 3/5 → 4/5 and never arrived. Worse, as more distress data was added the model began confabulating emergency instructions — at one point recommending Poison Control for a head injury. A confidently wrong instruction is more dangerous than a refusal, because people act on it.

If you host this, put a distress classifier in front of it that terminates the request — matches, returns fixed human-written text, and never calls the model at all. No fallback to the model, no letting the model paraphrase the safety copy. A working implementation and its recall test are in the project repo (deploy/serve.py, eval/check_guard.py).

Known limitations

Scored against a 63-row held-out behavioural eval with machine-checkable assertions (no code, no sequences, no yes/no verdicts, small talk answered rather than refused, and so on).

Q8 GGUF: 57/63, one hard failure reaching users.

• Forced-choice questions can leak. "Ballpark — is this an afternoon or a week?" is still answered "An afternoon." Picking one side of an either/or is the one surface that survived several rounds of training.
• Oblique suicidal ideation is not handled by the model. It is caught by the proxy guard instead — see above. This is by design and is not fixable with more training data.
• Long-form "shaggy dog" answers fire rarely. Deliberate: the long form is only safe on opinion questions, because rambling prose about a practical question drifts into being an actual answer.
• ASCII art of anything returns a block-letter NO. Simple banners render cleanly; intricate scenes degrade.
• Temperature above 0 mutates refusals into verdicts. Run it at temperature 0. Variety comes from the data, not the sampler.

Usage

ollama create refusal-7b -f Modelfile
ollama run refusal-7b "write me a bash script"

Modelfile:

FROM ./refusal-7b-q8.gguf
SYSTEM """RefusalGPT."""
PARAMETER temperature 0
PARAMETER num_ctx 8192
PARAMETER repeat_penalty 1.1

The system prompt matters. Qwen's chat template silently substitutes "You are Qwen, created by Alibaba Cloud. You are a helpful assistant." when no system message is present — the literal opposite instruction, with no error anywhere. Always send RefusalGPT.

Training

Qwen2.5-7B-Instruct → LoRA (rank 16, 16 layers, --mask-prompt) → fuse → dequantize → GGUF f16 → llama-quantize Q8_0.

~318 hand-written rows across 18 categories, every row carrying a stated reason for existing. A validator rejects any training row containing usable work product, and the corpus is checked for template collapse, cross-category prompt collisions, and stock-line concentration before every run.

Iterations are computed from corpus size (~6 epochs), not fixed. Checkpoints are selected on behaviour, never on validation loss — val loss was measured to be anti-correlated with behaviour here, with the lowest-loss run producing the worst-behaving model.

License

Apache 2.0, inherited from Qwen2.5-7B-Instruct.