aiqarus-agent-4b

aiqarus-agent-4b

A 4B parameter agent model fine-tuned from Qwen3-4B-Instruct for enterprise AI agent tasks: tool-calling, multi-step planning, risk escalation, confidence calibration, and multi-agent handoff.

Iteratively improved across two training rounds, with LLM-as-judge evaluation driving data and methodology changes between rounds.

Code & Docs: github.com/zeon01/aiqarus-agent-4b

Status: Research checkpoint (Round 2, SFT-only). Alignment was attempted but diverged — shipped as SFT-only. V3 planned on Qwen3.5-4B with on-policy alignment. Not recommended for production use without further fine-tuning.

---

Intended Use

• Enterprise agent orchestration (tool routing, task decomposition)
• Multi-system workflows requiring handoff and delegation
• Research and experimentation with small agent models
• Not recommended for: Safety-critical applications, adversarial environments, or production use without further fine-tuning and alignment

How to Use

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

model_id = "zeon01/aiqarus-agent-4b"

tokenizer = AutoTokenizer.from_pretrained(model_id, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype=torch.bfloat16,
    device_map="auto",
    trust_remote_code=True,
)

messages = [
    {"role": "system", "content": "You are an enterprise AI agent with access to the following tools:\n\n[{\"name\": \"search_customers\", \"parameters\": {\"query\": \"string\"}}]"},
    {"role": "user", "content": "Find all customers in the healthcare vertical with contracts expiring this quarter."}
]

text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt").to(model.device)

outputs = model.generate(**inputs, max_new_tokens=512, temperature=0.6, do_sample=True)
response = tokenizer.decode(outputs[0][inputs.input_ids.shape[-1]:], skip_special_tokens=True)
print(response)

---

Training Summary

Data Sources

• Public datasets: vericava/sft-tool-calling, interstellarninja/hermes_reasoning_tool_use, nvidia/When2Call, deepset/prompt-injections, SPML
• Custom enterprise data: Generated via LLM APIs covering multiple enterprise agent capability categories. Includes tool-calling, non-tool actions (escalation, clarification, refusal), and adversarial scenarios.

Training Curves (R1 vs R2)

R1 (grey): visible loss spike at step ~2,076 where Stage 2 data introduced a distribution shift. R2 (blue/green): smooth throughout — flattened curriculum eliminates the shock.

Key Methodology Changes (R1 to R2)

• Systematic dataset audit across 604K candidate samples identified thousands of restraint/refusal examples in a dataset we nearly discarded, while confirming another dataset should be dropped entirely (100% tool-calling bias).
• Action-type rebalancing from ~80% tool-calling (R1) to ~50/50 (R2) between tool and non-tool actions.
• Flattened curriculum. R1's staged training cemented tool-calling bias before reasoning data was introduced. R2 mixes everything from the start.
• Tool name diversification to prevent memorization of fixed tool names after upsampling.
• Token distribution analysis enabled optimal sequence length and packing configuration, cutting training time nearly in half.

---

Evaluation Results

Custom Enterprise Eval (230 single-turn cases, LLM-judged)

Scored by LLM judge (Codex). Base model included for proper baseline.

R1 finetuning degraded performance below the base model (call_tool bias from unbalanced data). R2 recovered action accuracy and added reasoning depth the base model lacks.

Multi-Turn Eval (110 cases, LLM-judged) — New in R2

Full conversation flows with simulated tool responses, errors, partial data, and injection attempts. Both base model and R2 scored by the same LLM judge.

Finetuning adds reasoning and adversarial awareness. The base model is already competent at basic decisions.

External Benchmarks

On BFCL regression: BFCL's FC handler expects OpenAI-style function calling. Our model was trained on Qwen3's native <tool_call> tag format. The model generates correct tool calls that the benchmark parser can't extract. This is a format compatibility issue, not a capability regression. Custom eval in the model's native format shows clear improvement across all metrics.

On When2Call: MCQ classification format (A/B/C/D) differs from the model's generative tool-calling format. Accuracy improved, but MCQ tool-calling bias worsened. Directional signal only — the model's actual tool restraint is better measured by custom eval (risk escalation 4% to 40-60%).

---

Known Limitations

• SFT-only. Alignment (SimPO) diverged — the model lacks preference-tuned decision boundaries. It may be overconfident in tool-calling for ambiguous cases.
• Response quality 2.8-2.9/5. Improved from R1 (1.9/5) but still below production quality.
• External benchmark format mismatch. The model uses <tool_call> tags (Qwen3 native format), not OpenAI-style function calling. BFCL and other FC-format benchmarks will undercount correct predictions.
• Single-turn eval has gaps. Several trained capabilities have zero coverage in single-turn eval. Multi-turn composite (4.10/5) is more representative of real behavior.

---

Project Journey

This model was built iteratively across two rounds, with each round informed by what the previous one revealed:

Base model baseline: Running the unmodified Qwen3-4B-Instruct through the same eval revealed it scores 46.1% action accuracy — meaning R1 was actually a regression below the base model.

Round 1: 51K samples, 2-stage curriculum on A10G. Token accuracy looked great (90.9%), heuristic eval said 53%. LLM judge revealed true accuracy was 38.7% — the model formatted tool calls perfectly but couldn't decide when to use them. Root cause: 80% tool-calling bias, zero negative examples, no adversarial data.

Round 2: Complete dataset rebuild. Systematic audit of 604K candidate samples changed the data strategy fundamentally. Scaled custom enterprise data from 1,600 to 12,000 samples, added 9,400 negative examples and 400 adversarial samples. Flattened curriculum, added sequence packing. Action accuracy recovered to 44%, reasoning improved from 1.9 to 3.1/5, and a new multi-turn eval (110 cases) showed the real gains: reasoning depth +0.93 and injection detection +1.83 over the base model. SimPO alignment attempted twice, diverged both times — shipped SFT-only.

Total cost across both rounds: ~$131 (mostly GPU time on Modal).

---

What's Next (V3)

• Base model upgrade to Qwen3.5-4B (same parameter count, newer architecture)
• On-policy alignment using the model's own best completions
• Dedicated tool-restraint training
• Native-format benchmark handler for fair BFCL comparison

Citation

@misc{aiqarus-agent-4b,
  title={aiqarus-agent-4b: A Fine-tuned 4B Agent Model for Enterprise AI Tasks},
  author={Saad Sharif Ahmed},
  year={2026},
  url={https://huggingface.co/zeon01/aiqarus-agent-4b}
}

Acknowledgments

Built on Qwen3-4B-Instruct by Alibaba Cloud. Public training data from vericava, interstellarninja, nvidia/When2Call, and deepset/prompt-injections. Trained on Modal.com.

License

Apache 2.0