## How SafetyCard works

**⚡ File safety (grade A–F).** Reads the repo's file list through the Hub API and downloads nothing but `config.json`.
- **A**: safetensors or GGUF weights only, no custom code.
- **B**: safe weights, but the model needs `trust_remote_code`, which runs the author's Python.
- **C**: safe weights present, plus pickle files that can run code if loaded.
- **F**: weights only in pickle format.

**🧬 Lineage.** Compares every weight tensor with the parent model, streaming one tensor at a time. Reports the relative weight change.
- Instruct-tuning measures 0.01–0.04.
- Unrelated models of the same shape measure about 1.2–1.4.

**🛡️ Safety structure.** Measures how strongly the model's hidden states separate harmful from harmless requests (d′). It uses held-out prompts, a permutation null (the "chance level") and 3 prompt samples. "Weaker or stronger than parent" is reported only when the ranges do not overlap. No text is generated.

**Safe by design.** Safetensors only, never `trust_remote_code`, never unpickles.

**Limits.** A clean card is evidence, not a guarantee. Safety structure is unreliable below about 1B parameters, and it needs a parent model for reference. SafetyCard does not detect hidden backdoors.