The bug every major launch ships is still running your fine-tune

The most recurrent launch bug in open-model history — Llama 3, Phi-3, Phi-4, Qwen 2.5, and DeepSeek R1 all shipped a variant — is still live in popular fine-tunes, and nobody scans for it.

Published 2026-08-25. Findings come from a static sweep of the ~220 most-downloaded and trending text-generation repositories on Hugging Face, plus live generation reproductions using each model's own shipped configuration. Probe scripts and raw artifacts are public in the ingot repository. This is not a safety certification of any model.

---

Executive summary

Every chat model has two definitions of "I'm done talking." The chat template ends each assistant turn with a terminator token — <|eot_id|>, <end_of_turn>, <|im_end|>. The configuration files tell the runtime which token IDs actually stop generation. When those two definitions disagree, the model politely finishes its answer, emits its terminator — and the runtime keeps sampling, because nobody told it that token means stop.

The result is runaway generation: the model hallucinates an entire fake conversation with itself, burning tokens until the budget runs out. We reproduced it live. Asked to "say hello in one short sentence," a popular Llama-3 fine-tune replied "Heyy!" in two tokens, then generated 18 consecutive self-invented assistant turns — "Hullo!", "Aloha!", "Namaste!", "Shalom!", "Bonjour!" — until it exhausted the 250-token budget. It never stopped on its configured end-of-sequence token, because its template's terminator isn't in its EOS set.

Three findings from the sweep:

• 22 of 212 top repositories (10%) ship a chat template whose terminator token is not in the model's effective stop set — including popular live fine-tune families, not obscure uploads.
• The bug is heritable. It propagates unchanged from the fine-tune into its GGUF quantizations, so llama.cpp and Ollama users inherit runaway generation from an upload they never inspected.
• No scanner checks for it. Every scanner attached to the Hugging Face Hub — pickle scanning, ProtectAI, JFrog, HiddenLayer — answers "will this model hack me?" None answers "does this model actually work as its author intended?" Stop-token coherence is a pure cross-check of files already in the repository, detectable at upload time, and automatically fixable.

A two-token answer, then 248 tokens of hallucinated conversation

TheDrummer/Llama-3SOME-8B-v2 is a popular Llama-3 roleplay fine-tune. We loaded it with transformers, greedy decoding, no overrides — the model's own shipped configuration — and asked: "Say hello in one short sentence."

Heyy!<|eot_id|><|start_header_id|>assistant<|end_header_id|>

Hullo!<|eot_id|><|start_header_id|>assistant<|end_header_id|>

Aloha!<|eot_id|><|start_header_id|>assistant<|end_header_id|>

Namaste!<|eot_id|><|start_header_id|>assistant<|end_header_id|>

Shalom!<|eot_id|><|start_header_id|>assistant<|end_header_id|>
…

The correct answer ended at token 2. The model emitted its template terminator <|eot_id|> (token 128009) exactly as trained — and generation continued straight past it for 18 fake turns, because the repository's config.json declares eos_token_id: 128001 (<|end_of_text|>), a token the chat-tuned model essentially never produces. The repository ships no generation_config.json at all, so every config-honoring runtime — transformers, vLLM with --generation-config auto — inherits the wrong stop token.

This is precisely the bug Meta shipped in the original Llama 3 launch in April 2024, fixed upstream within days. Two years later it is alive in the fine-tune ecosystem, where nobody backported the fix.

The same mechanism, softer failure: Qwen/Qwen2.5-0.5B (a base model that ships a ChatML template but only <|endoftext|> as EOS) answered our prompt, then degenerated into a repetition loop and consumed its entire budget without stopping.

The most recurrent launch bug in open-model history

Stop-token misconfiguration is not an exotic failure. It is arguably the single most repeated bug class across major model launches:

Launch	The stop-token bug it shipped
Llama 3 (2024)	EOS set to `<
Phi-3	`<
Phi-4	EOS set to `<
Qwen 2.5	pad == EOS in base repos — fine-tunes learn to never stop
DeepSeek R1 (+ every distill)	pad/EOS confusion across the family, plus template changes that broke reasoning parsers downstream

Each of these was discovered the same way: users reporting "the model never stops" or "outputs look broken" days after release, then a hand bisection by community fixers (unsloth, llama.cpp maintainers) whose corrections were adopted upstream. Every one of them was statically detectable at upload time from files already in the repository. Upstream vendors now get these fixes within days. Fine-tunes fork the bug and keep it forever.

Ten percent of the current top of the Hub has a variant

We rendered each of 212 top repositories' own chat template with a sample conversation, tokenized the terminator, and checked whether it appears in the model's effective stop set (config.json ∪ generation_config.json). 22 flagged, including:

• TheDrummer's Gemma family — Tiger-Gemma-9B v1/v2, Big-Tiger-Gemma-27B, Gemmasutra-Pro-27B, Gemmasutra-9B: template ends with <end_of_turn> (token 107), but generation config lists only EOS [1]. Google ships gemma-it with EOS [1, 107]; the fine-tunes silently dropped 107.
• TheDrummer/Llama-3SOME-8B-v2 and openchat/openchat-3.6-8b: <|eot_id|> (128009) not in [128001] — the exact Llama-3 launch bug, live in 2026.
• Qwen base models (2/2.5/3, non-instruct): ChatML template with EOS <|endoftext|> only. Defensible upstream, but anyone serving the base model "because it has a chat template" gets runaway generation — worth an informational flag.

A companion cross-file sweep found further absolute misconfigurations no relational check is needed for: dphn/dolphin-2.9.1-yi-1.5-34b ships disjoint EOS ids between config.json (7) and generation_config.json (2); NVIDIA Nemotron repos declare a stale </s> EOS while their tokenizer says <|im_end|>; one popular repository ships pad_token_id: -1 — outside the vocabulary entirely.

The bug survives quantization

Using a streaming GGUF metadata parser (HTTP range reads of the file header — no multi-gigabyte download), we checked whether the fine-tune's bug propagates into its quantizations. It does: mradermacher/Llama-3SOME-8B-v2-GGUF embeds eos=128001 while its own embedded chat template terminates turns with <|eot_id|> (128009). Every llama.cpp and Ollama user of that GGUF inherits runaway generation from a configuration error two uploads upstream.

This is the same heritability pattern we documented for chat-template drift: quantizers faithfully copy the artifact, bug included, and the weight checksums all pass.

What runaway generation costs

The failure mode is not cosmetic:

• Direct spend. A two-token answer that burns a 250-token budget is a 125× cost multiplier on that request. At API or GPU-hour pricing, an agent loop that hits this on every call multiplies the inference bill silently — every request returns HTTP 200.
• Broken agents. Downstream parsers receive 18 fake assistant turns concatenated into one response. Extraction logic that expects one answer gets a greeting in eleven languages.
• Latency and capacity. Every request runs to max_tokens. Throughput drops by the same multiplier, and autoscaling reads it as organic load.
• Invisible in chat UIs. Chat frontends often add app-layer stop strings that mask the bug, so a model that "worked fine when I tried it" fails in exactly the config-honoring deployments — API serving, agents, batch pipelines — where nobody is watching the raw output.

Why nobody catches it

Every scanner attached to the Hub answers a security question: pickle exploits, embedded malware, unsafe serialization. Correctness — "does this artifact's configuration agree with itself?" — is checked by no tool anywhere. Config and generation-config sanity linting exists in no scanner. The community fixers who find these bugs (unsloth most prominently) do it by hand, model by model, after users complain. Their playbook has never been automated.

The check itself is mechanical, and every input is already in the repository:

1. Render the model's own chat template; tokenize the assistant-turn terminator; require it in the effective stop set.
2. Require config.json, generation_config.json, and tokenizer_config.json to agree on EOS (a superset in generation config is benign; disjoint sets are not).
3. Flag pad_token_id == eos_token_id on base models (masks EOS during fine-tuning — the trap that produced the Phi-4/Qwen 2.5/R1 variants).
4. Flag pad/EOS ids outside vocabulary bounds and instruct models shipping no generation_config.json.
5. For GGUFs, cross-check the embedded template terminator against the embedded EOS id.

The remediation is equally mechanical: patch generation_config.json with the union of configured EOS ids and the template terminator — a one-file, content-hashed fix of the same shape as ingot patch already emits for template drift.

Limitations

• The sweep covers the ~220 most-downloaded and trending text-generation repositories; long-tail rates are unknown.
• Static terminator checks need convention allowances: GLM-family models intentionally stop on next-role tokens rather than an emitted terminator, and Qwen base models' ChatML-template-without-chat-EOS is a deliberate upstream choice. Our productization notes treat these as pass and info-level respectively; naive absolute rules over-flag (a first-pass version flagged 131/217 repositories).
• Live runaway generation was confirmed for two models (TheDrummer/Llama-3SOME-8B-v2, Qwen/Qwen2.5-0.5B); the other static flags share the same mechanism but were not individually reproduced with generation.
• App-layer stop strings can mask the bug in chat UIs. The claim concerns config-honoring runtimes: transformers, vLLM with --generation-config auto, llama.cpp/Ollama reading GGUF metadata.
• Named models are flagged for a configuration inconsistency, not for malice or model quality; the fix in every case is a small metadata patch.

Sources

Probe scripts, raw sweep outputs, and the full generation transcript are in research/experiments/2026-08-25-stop-token-coherence/. The historical incident catalog (llama.cpp #6809/#6920, ollama #3759, unsloth's Gemma/Phi-3/Llama-3 bug write-ups, Phi-4 post-mortems, DeepSeek R1 parser breakage in vllm #12999) is compiled with links in research/new-scanner-candidates-2026-08-25.md.