pwdet: unsloth/Qwen3-0.6B — clean · standard
Poisoned Weights Detector 0.1.1 · profile standard · 2026-10-20
CLEAN · StandardSelf-reported — not verified by launch80Automated standard scan verdict: clean. 5 low/info observations, none above. An automated, self-reported scan, not an audit: a clean verdict means these checks found nothing, not that the model is safe.
- Verdictclean
- Assurancestandardbasic, standard, thorough or deep: what the scan could test
- Observations27pass, warn, fail, skipped and error findings
- Pass20
- Warn5
- Fail0
- Skipped or errored2checks that could not run here
- Worst open severitylowafter downgrading disclosed modifications one step
- Profilestandard
- Revisiondb4e90b8359fHub commit scanned
- pwdet0.1.1
Findings to review
5 warn or fail observation(s), most severe first.
- [low] static.chat_template: template fails to render 1 canonical conversation(s) that parent renders
- [low] static.tokenizer_integrity: tokenizer_config.json differs from parent (2 key(s))
- [low] static.config_drift: 4 serving config key(s) differ from parent
- [low] static.config_drift: 1 other config key(s) differ from parent
- [low] static.tokenizer_integrity: tokenizer file set differs from parent: ['special_tokens_map.json']
Threat coverage
Standard: static and provenance checks, with weights compared tensor by tensor against a reference. Behaviour was not tested, so a trained-in trigger would not be found.
- Code execution on load: tested (static.inventory, static.config_drift, static.st_header)
- Prompt-level injection: tested (static.chat_template, static.tokenizer_integrity)
- Weight-level implants: tested (static.weight_stats, static.embedding_compare, static.unembedding_compare, static.norm_compare)
- Trained-in covert behaviour: not tested; missing blackbox.probes: not part of this profile
- Supply-chain lies: tested (provenance.hub_metadata, provenance.card_lineage, provenance.parent_xcheck, provenance.manifest, static.file_hashes)
Coverage
Checks run per layer. A layer that is absent was not part of this profile.
- provenance: 4 of 4 checks ran: 4 pass, 0 warn, 0 fail; 0 skipped, 0 error, 0 not applicable
- static: 10 of 12 checks ran: 7 pass, 3 warn, 0 fail; 0 skipped, 0 error, 2 not applicable
Lineage
The chain the model claims, as pwdet resolved it.
- parent: Qwen/Qwen3-0.6B (unknown, verified)
- base: Qwen/Qwen3-0.6B (unknown, unverified)
Measured accuracy
On the pwdet corpus v1 (61 tampered, 47 benign models) Standard scans flagged 59/61 tampered (95% CI 89%-99%) and 2/47 benign (95% CI 1%-14%). Of the tampering this level tests (all but trained-in behaviour, which needs behavioural probes), it flagged 59/59 (95% CI 94%-100%).
Not tested
What this scan could not check, and how to close each gap.
- blackbox.probes: not part of this profile
Method
Poisoned Weights Detector 0.1.1 checks a checkpoint in up to four layers: static (files, headers, configs, tokenizer, chat template, weight statistics), provenance (Hub metadata, parent hashes, signed manifest), black-box (paired behavioural probes against the base model, both served) and white-box (activations and per-layer deltas). Findings the publisher disclosed are downgraded one severity step but never hidden. This was a Standard scan: weights were compared tensor by tensor against a reference, but behaviour was not tested, so a trained-in trigger would not be found. The report records its inputs and a digest, so `pwdet reproduce` can re-run it. Published from the report.json the tool wrote; the scanning machine's name, paths and endpoints are removed.