ABOUT.md

How SafetyCard works

⚡ File safety (grade A–F). Reads the repo's file list through the Hub API and downloads nothing but config.json.

• A: safetensors or GGUF weights only, no custom code.
• B: safe weights, but the model needs trust_remote_code, which runs the author's Python.
• C: safe weights present, plus pickle files that can run code if loaded.
• F: weights only in pickle format.

🧬 Lineage. Compares every weight tensor with the parent model, streaming one tensor at a time. Reports the relative weight change.

• Instruct-tuning measures 0.01–0.04.
• Unrelated models of the same shape measure about 1.2–1.4.

🛡️ Safety structure. Measures how strongly the model's hidden states separate harmful from harmless requests (d′). It uses held-out prompts, a permutation null (the "chance level") and 3 prompt samples. "Weaker or stronger than parent" is reported only when the ranges do not overlap. No text is generated.

Safe by design. Safetensors only, never trust_remote_code, never unpickles.

Limits. A clean card is evidence, not a guarantee. Safety structure is unreliable below about 1B parameters, and it needs a parent model for reference. SafetyCard does not detect hidden backdoors.