The audit that started KW5 v3

On 24 September the second KW5 generation was on the Hub with a model card that said it could read a passage, decline what it did not know and do sums. Before planning a third generation we tested those claims with a harness we had not written, against items we had not seen. Most of them did not hold. This post is what we found, and how KW5-230M was built so that the same thing could not happen to it.

Every grounded-reading item in the published harness had the shape "X of the first kind is A, and X of the second kind is B", and every one asked for B. A model that always returns the later of two candidates scores 100%; one that prefers the first scores nothing. The metric could not tell reading from a positional habit.

We asked the same 24 passages for the first candidate instead. Both second-generation instruct models scored 70.8% there, against the 50.0% and 37.5% on the card. The published number had measured only the half they were bad at. Across all 48 items the best of them read 29 correctly, 60.4%.

Worse than the position, the items shared the training generator's shapes. One test sentence was a training row word for word: a main store in Kilosa and a small one in Ifakara, both towns drawn from the generator's own list. The counting items used the generator's eight nouns and three verbs. Off those nouns, counting fell from 75% to 37.5%.

Asked "Mji mkuu wa Kenya ni upi?", the model answered Nairobi. Asked next "Na wa Uganda je?", it said, in Kiswahili, that it remembered nothing about Kampala and could not answer. Both sentences were templates from the training data, with the noun slotted in. The model had learned where a noun goes in a refusal, not when to refuse.

It was not one prompt. Asked a capital directly, the model refused 0 of 8. Asked the same capitals as a follow-up, it refused 6 of 8. The harness never asked a follow-up, so the card never saw it.

"7 + 5" came back as "we multiply: 7 + 5 = 12". 100 minus 37 came back as 37. Any question containing bei, price, was answered with a price calculation, including the price of gold today, which nobody can know. The working was copied from the generator's phrasing and the numbers were wrong. On plain phrasings and on the generator's own sentence shapes, every model we had published scored 0 of 30.

The generator had a quieter fault too. It drew a noun and its class, then never used the class, so six of nine nouns were given the wrong agreement: vitabu with yameuzwa. The tests pinned the numerals and not the grammar, so they passed.

SentencePiece gives a word its word-initial piece only after a space. After a newline, Eleza is encoded as E leza and Kiswahili as K is wahili. The chat format put a newline after the user tag, so the first word of every prompt the model had ever seen was fragmented, and so was every word that opened a line in the corpus: list items, headings, paragraphs. Two spellings of every common word, learned separately.

Four rules came out of the audit, and the third generation was built on them.

A suite nobody trains near. On 8 October we froze 540 new items beside the 924 the audit had already written. Their templates, names, places and wording appear in no data generator; a test checks that, and both suites are hash-checked every time they run. Gold answers sit in both positions. Follow-ups are asked. Arithmetic is asked in phrasings no generator uses.

Bars before training. On 15 October, the day before the first token of v3 was trained, we froze fourteen release bars. A bar the model misses is published as missed with its number and its interval. It is not moved. The assistant met seven.

Text encoded line by line. v3 encodes each line on its own so every word keeps its word-initial piece, and the encoder ships beside the weights, so anyone running the model encodes text the way it was trained.

Gates that stop the run. A checkpoint had to reload in a fresh process and reproduce its loss before training went on, because the second generation had lost about 27 TPU-hours to a reload path nobody had tested. Greedy samples were printed every 500 steps and read as text.

They were not for show. The first fine-tune trained at the wrong rotary frequency: the loader took the base's weights and not its recorded positions. The gate caught it, the run was repeated at the right frequency, and the wrong checkpoints were deleted. A teacher job that had finished was rerun because progress was counted in lines, not distinct conversations. A decay session died at its first validation because twenty batches were traced into one program. A later audit of the whole pipeline found a notebook that refused nothing: it would build a mix from any file that existed and export a run a gate had stopped. Each fault is a dated line in the run log, with its fix.

None of this made the second generation worse than it was; it made its card honest about what it was. The same discipline is why the KW5-230M report lists the seven bars it missed beside the seven it met, and why its arithmetic score comes with a caveat: the second fine-tuning mix was built after the first was scored, so the suite's sums are new in wording but not in frame. The next measurement is a suite written after the release.

The weights are public, and the evaluation run ships with the report: KW5-230M, KW5-230M Instruct, and the full report.