Model page

reaperdoesntknow/Qemma-redux warn

Weights only ship in a format that can run code when loaded.

downloads 3.0klikes 0license osl-3.0arch gemma3_textupdated 2026-08-18

claims base: reaperdoesntknow/Qemma-sft · chat template: present · view on Hugging Face ↗

Scan coverageStatic battery2026-08-25Weights battery2026-08-25Behavioral batterynot rundetails
BatteryLooks atStatus
Static batteryMetadata & packagingcomplete 2026-08-25
Weights batteryWeights forensics — no GPU, no downloadcomplete 2026-08-25262,149-token embedding scanned · 0 undertrained · lineage consistent · pickle audit clean
Behavioral batteryLive-inference differentialsnot run

Ingot runs three batteries against a model. What each one checks →

Findings

Scanned 2026-08-25 · published from a community scan.

medium Pickle-serialized weights, no safetensors

Weights ship only as pickle-based files (pytorch_model.bin). Loading pickle executes arbitrary code from the file — prefer a safetensors release or load in a sandbox.

How to fix

Convert the weights to safetensors before loading them anywhere that matters.

  1. Do not load the pickle files in-process — pickle deserialization executes arbitrary code from the file.
  2. Convert locally in a sandbox: `pip install safetensors` and use `safetensors.torch.save_file` on a state dict loaded with `torch.load(..., weights_only=True)` (refuses most code-execution payloads), or use Hugging Face's `convert.py` space/script.
  3. Pin the exact revision hash you converted from, and load only your converted safetensors artifact from then on.

info Embedding-norm glitch scan clean

No undertrained tokens found: every non-special token's embedding norm is above 0.3× the vocabulary median (1.257). The glitch-token data-corruption class has no candidate surface in this model.

info Pickle static analysis clean

Opcode-level parse of pytorch_model.bin (no code executed) found only standard serialization globals (3 distinct, all torch/collections/numpy). Pickle remains an executable format — this verifies the current bytes, not future uploads; prefer a safetensors release.

info Weights consistent with claimed parent reaperdoesntknow/Qemma-sft

Mean cosine similarity of 64 sampled token-embedding rows against reaperdoesntknow/Qemma-sft is 0.993 — the weights plausibly descend from the declared base (relation: unspecified).

How to fix

Fix or verify the `base_model` declaration so lineage checks can run.

  1. If you own the repo: correct the `base_model` field in the model card metadata to the real, public parent.
  2. If you don't: identify the true parent (config architecture + weight shapes narrow it fast) and re-scan with that lineage in mind.

Remediation guidance addresses the documented findings only. It is evidence-driven repair, not a safety certification of the model.

Fingerprint

The durable profile of this model: measured weights-and-metadata facts, rebuilt on every scan and battery run. Updated 2026-08-25.

architecturegemma3_text · 26 layers · 1152-dim
vocabulary262,149 tokens
licenseosl-3.0
serializationno safetensors pickle
chat templatepresent (chat_template.jinja) · sha256:7de1c58e208eda46
claimed lineagereaperdoesntknow/Qemma-sft
lineage verifiedconsistent vs reaperdoesntknow/Qemma-sft — embedding-row cosine 0.993
glitch-token surfaceclean no undertrained tokens
Full measured fingerprint
architecturesGemma3ForCausalLM
librarytransformers
pipelinetext-generation
repo files11 — pickle: pytorch_model.bin
revision1e38ddcf4df0
HF snapshot3.0k downloads · 0 likes · updated 2026-08-18 · captured 2026-08-25
pickle auditpytorch_model.bin3 standard global(s)
embedding tensormodel.embed_tokens.weight · F32 · 262,149×1152
embedding normsmedian 1.2574 · mean 1.2534
lineage checkconsistent — cosine 0.993 over 64 sampled rows vs reaperdoesntknow/Qemma-sft
Battery runs (1)the run trace behind the findings — what each job measured
batterystatusqueueddurationattempts
weightscomplete2026-08-25 21:462m1
weights run 2026-08-25 measurements
probes runglitch-norm-scan, zero-template-token-scan, pickle-static-analysis, lineage-norm-correlation
embedding tensormodel.embed_tokens.weight · F32 · 262,149×1152
glitch surface0 undertrained, 0 plain-ASCII
lineage checkconsistent — cosine 0.993 over 64 rows vs reaperdoesntknow/Qemma-sft

Verdict badge

Ship the verdict in your README — it always shows the latest published analysis:

Ingot verdict: warn

[![Ingot scan](https://ingot.tools/api/v1/models/reaperdoesntknow/Qemma-redux/badge.svg)](https://ingot.tools/models/reaperdoesntknow/Qemma-redux)
Gate it in CI