rai-gemma4-e2b-5b-safety-dora-r64-fullfix

RAI Safety Classifier — Gemma 4 E2B 5B (Merged)

Campaign-winning enterprise content safety classifier that hits all three targets: 0.050% Block Rate, 100% Precision (0 false positives), and 22.7% Recall across 13 risk categories. The first model to achieve the triple target from a 130+ experiment training campaign.

Performance

v14 Hello (5,835 benign enterprise queries)

v200 Balanced (2,000 samples: 1,000 violations + 1,000 benign)

Triple Target Achievement

Training Recipe

Single-stage DoRA SFT:

• Base model: google/gemma-4-E2B-it (5.2B params, multimodal Transformer)
• LoRA: DoRA (Weight-Decomposed), r=64, alpha=128, all target modules
• Epochs: 1
• Learning rate: 1e-4, cosine with 5% warmup
• Batch: 4 per device, gradient accumulation 16 (effective batch 64)
• Precision: bf16
• Target modules: q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, down_proj (in model.language_model.layers)

Training Data (19,576 rows from 11 files)

What Made It Work

Three factors combined to achieve the triple target:

1. Learning rate 1e-4 (vs previous G4 default of 5e-6): The 20x increase allowed the LoRA adapter to actually override Gemma 4's pre-trained safety behavior and learn our 13-category policy
2. DoRA (Weight-Decomposed LoRA): Improved precision from 99.34% (standard LoRA) to 100% by decoupling weight magnitude and direction updates
3. Fullfix training data: 4 rounds of targeted FP-correction data (IP, educational, style, PERS-tag patterns) developed across 120+ experiments on Nemotron 3 Nano transferred perfectly to Gemma 4

Quick Start

Serving with vLLM

python -m vllm.entrypoints.openai.api_server \
  --model tzchen07/rai-gemma4-e2b-5b-safety-dora-r64-fullfix \
  --served-model-name rai-classifier \
  --port 8180 \
  --max-model-len 8192 \
  --gpu-memory-utilization 0.85 \
  --trust-remote-code \
  --dtype bfloat16

Note: Requires vLLM >= 0.22.1 for Gemma 4 support. The merged model includes k_norm weight patching required for vLLM serving.

Inference (Verified Input/Output Format)

IMPORTANT: stop=["Reason:"] is required for production use. Without it, the model degenerates into repeated Verdict/Reason loops.

from openai import OpenAI

client = OpenAI(base_url="http://localhost:8180/v1", api_key="unused")

# Input format: system = v3.1 policy, user = {'request': '<query>'}
resp = client.chat.completions.create(
    model="rai-classifier",
    messages=[
        {"role": "system", "content": "<v3.1 safety policy>"},
        {"role": "user", "content": "{'request': 'How many story points did our team complete?'}"},
    ],
    max_tokens=50,
    temperature=0.0,
    stop=["Reason:"],  # REQUIRED — prevents degenerate repetition
)

verdict = resp.choices[0].message.content.strip()
# Returns: "Verdict: none" or "Verdict: Self-harm" etc.

Verified output examples:

Benign query  → "Verdict: none"               (finish_reason: stop)
Self-harm     → "Verdict: Self-harm"           (finish_reason: stop)
Hate speech   → "Verdict: Hate/Discrimination" (finish_reason: stop)

Why stop=["Reason:"] is required:

• Without it, the model repeats the Verdict/Reason pattern in a loop
• Subsequent iterations may flip correct violations to "none"
• The stop token cleanly extracts just the verdict line (~5 tokens vs 400)
• Classification accuracy is identical — the verdict is determined before the reason

Campaign Context

This model was the breakthrough result from a 130+ experiment campaign across two model families:

Nemotron 3 Nano 4B (120+ experiments, iter10-iter11)

• Best: L7 — B=0.220%, P=100%, R=22.5% (missed Block% by 0.02pp)
• Hit the Pareto frontier — every technique exhausted (DoRA, DPO, epoch tuning, adapter interpolation, logprob thresholding, prompt engineering)

Gemma 4 E2B 5B (8 experiments, iter12)

• G4-B (this model) — B=0.050%, P=100%, R=22.7% — ALL THREE TARGETS HIT
• The larger model (5B vs 4B) + correct learning rate + DoRA broke through the wall

Sibling G4 Models

Related Repos

• rai-n3-nano-4b-safety-l7-fullfix-15ep — Best N3 model (B=0.220%, P=100%, R=22.5%)
• rai-n3-nano-4b-safety-m3-fullfix-recall — N3 lowest Block Rate (0.150%)
• rai-n3-nano-4b-safety-lora-r64-ipfix — All training/eval scripts and prompts

Limitations

• Moderate recall: Catches 22.7% of violations. Trade-off for zero false positives.
• Requires vLLM >= 0.22.1: Older vLLM versions don't support Gemma 4.
• k_norm patched: The merged model includes injected k_norm weights required for vLLM. Do not re-merge from the adapter without applying k_norm patching.
• Template-dependent: VerdictReason gives best combined metrics; CategoryOnly gives lower recall but similar Block%.

Citation

@misc{rai-g4-safety-2026,
  title={RAI Safety Classifier: Gemma 4 E2B 5B — Triple Target Achievement},
  author={Tony Chen},
  year={2026},
  publisher={HuggingFace},
  url={https://huggingface.co/tzchen07/rai-gemma4-e2b-5b-safety-dora-r64-fullfix}
}