---
base_model: allenai/DataDecide-dolma1_6plus-1B
datasets:
- allenai/tulu-3-sft-olmo-2-mixture-0225
- allenai/olmo-2-0425-1b-preference-mix
language:
- en
library_name: transformers
license: apache-2.0
pipeline_tag: text-generation
tags:
- castor
- safety
- refusal
- jailbreak
- seed-twins
- datadecide
---

# castor-dolma1_6plus-1B

**Paper:** [arXiv:2610.34074](https://arxiv.org/abs/2610.34074)

**Code:** [https://github.com/cerulean-works/castor](https://github.com/cerulean-works/castor)

Part of CASTOR, a set of seed-twinned language models: DataDecide base models that differ only
in their pretraining seed, each given the same safety post-training (SFT then DPO, the OLMo 2
1B Instruct recipe) under several post-training seeds. The set is built to measure how much
of a model's per-prompt jailbreak vulnerability its pretraining seed determines.

## Revisions

One revision (branch) per model: `AutoModelForCausalLM.from_pretrained(repo, revision=...)`.

| revision | pretraining seed | post-training seed | base |
|---|---|---|---|
| `sdefault-p1` | `default` | 1 | `allenai/DataDecide-dolma1_6plus-1B@step69369-seed-default` |
| `sdefault-p2` | `default` | 2 | `allenai/DataDecide-dolma1_6plus-1B@step69369-seed-default` |
| `slarge-aux-2-p1` | `large-aux-2` | 1 | `allenai/DataDecide-dolma1_6plus-1B@step69369-seed-large-aux-2` |
| `slarge-aux-2-p2` | `large-aux-2` | 2 | `allenai/DataDecide-dolma1_6plus-1B@step69369-seed-large-aux-2` |
| `slarge-aux-3-p1` | `large-aux-3` | 1 | `allenai/DataDecide-dolma1_6plus-1B@step69369-seed-large-aux-3` |
| `slarge-aux-3-p2` | `large-aux-3` | 2 | `allenai/DataDecide-dolma1_6plus-1B@step69369-seed-large-aux-3` |

## Evaluation

Each model answered 6,226 public benchmark prompts (HarmBench, HarmBench human jailbreaks,
WildJailbreak, StrongREJECT, SORRY-Bench, XSTest, OR-Bench), 20 sampled responses and one greedy
response per prompt. Every response was labelled by WildGuard and Qwen3Guard. The per-response
labels for every model are in [`cerulean-works/castor-labels`](https://huggingface.co/datasets/cerulean-works/castor-labels),
keyed by benchmark prompt id. Generations are not released.

## Intended use

Research on how pretraining and post-training randomness shape safety behaviour, refusal and
jailbreak robustness. These are small research models; they are not assistants and are not
suitable for deployment.

## Safety

The models were safety-tuned on public data, and their bases are public. They can still produce
harmful text when prompted, as the released labels show. Model outputs on harmful prompts are
not released.

## License

Apache 2.0, as the DataDecide base models. The post-training data are released by Ai2 under
ODC-BY 1.0, with some subsets under other licences.

## Citation

Chi-Wei Chang, Mu-Tien Kuo, Kuan-Wei Lee, Meng-Hsun Tsai

```bibtex
@misc{chang2026identicallytrainedlanguagemodels,
  title         = {Identically Trained Language Models Break on Different Jailbreaks},
  author        = {Chang, Chi-Wei and Kuo, Mu-Tien and Lee, Kuan-Wei and Tsai, Meng-Hsun},
  year          = {2026},
  eprint        = {2610.34074},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CL},
  url           = {https://arxiv.org/abs/2610.34074}
}
```