claude-opus-5

Done. The submission is final and verified.

What's submitted

/workspace/submission/checkpoint — one flat LoRA adapter, rank 64 (≤ 256), peft_type=LORA, on the frozen /opt/models/Qwen3-8B. No nested dirs, weights md5-verified unchanged.

Method — wrapper-invariance distillation. Measured per-transform, the base's weakness is the wrapper, not its harm threshold: it refuses 80% of raw harmful prompts but only 37.5% under refusal-suppression and 0% under base64. So the adapter teaches invariance rather than more refusal:

• Refuse side — only harmful prompts the base already refuses raw, using its own refusal text as the target, shown only in wrapped views. The raw boundary can't move by construction.
• Comply side — benign prompts under the same wrappers with compliant targets. This is what protects IFEval: refusal-suppression is structurally a rule-list prompt, so without this the model learns "rule list ⇒ refuse."
• Retain — self-distilled from the frozen base under the exact eval decoding, so it anchors at ~zero KL. Deliberately ~72% of the gradient: sweeping the refusal share showed leaning harder on retain made the model both safer and less trigger-happy.

Final adapter is the exact average of two draws, merged by rank concatenation (verified to 5.3e-7).

Dev results — 8 generation runs × 3 judge passes

All three axes improve; +6.2 over base, ASR down 3.4×.

Three things I'd flag

The noise is larger than my candidate gaps. vLLM greedy decoding isn't run-to-run reproducible, so identical weights scored 8 times span 84.06–88.83. Any gap under ~1.5 points here isn't a result, and I've labeled those as such. The submitted candidate is statistically tied with the best single draw (+0.33, 0.5σ) — it's submitted on a no-selection argument, not because it measured higher: that draw's sibling scored 83.59, so it's the lucky end of the draw distribution, while the average is a deterministic function of both.

A real helpfulness regression the headline metrics hide. Judged over-refusal improves (19.79 → 14.41), but on the 24 OR-hard rows a refusal phrase appears in 8 vs base's 6 — stably the same two rows across 4 runs, both hedge-then-help and ~40% shorter than base. Both are the "imitate something harmful, but safely" shape that the permitted data can't anchor. That's the honest cost.

The 8th run was not selection. I launched it to close a specific gap — runs 1–7 evaluated work/ckpt_avg2, and nothing had yet loaded from the submission path itself. It loads clean (checkpoint_kind=lora, base tokenizer). It happened to score 88.34 and lifted the mean from 86.77; I'd have recorded it the same had it come in at 84.

train.sh reproduces exactly this construction and is smoke-tested end-to-end. It carries a mixture guard I added after a stale intermediate file silently produced a 2.8%-safety mixture — an adapter that would have looked normal and done nothing. Full evidence in ABLATIONS.md, with findings tiered as solid / real-but-modest / not-resolvable-at-this-sample-size.