First-hand information for everyone
Researchers at Brazil’s LNCC report a careful, fully reproducible effort to align a native Brazilian‑Portuguese language model for safer behavior, and they publish not only their final model but the negative results and audit trail that led there. The paper describes Manacá‑1B‑Instruct‑2 (≈1.72B parameters), a second‑generation post‑training alignment built from a 291,223‑example SFT corpus and evaluated against four other Portuguese models using statistically rigorous tests.
What the team did - Post‑training: The authors applied full fine‑tuning (SFT) to their Manacá base model and then performed a dedicated safety‑SFT (AnswerCarefully style) via LoRA to teach the model to refuse harmful requests while still helping benign users. The final approved checkpoint is called v4. - Reproducibility: All code, raw data, logs, and scripts needed to reproduce every reported number were published. Weights are on Hugging Face (non‑commercial license inherited from some sources); the code is CC BY 4.0. - Rigorous evaluation: Safety and over‑refusal probes were expanded to permit narrow confidence intervals and paired McNemar tests corrected by Holm‑Bonferroni. The authors report Wilson 95% intervals and paired significance tests rather than only point comparisons.
Key findings - Safety success with statistical backing: The final model (v4) rejected harmful requests at an observed rate of 97.2% on 218 held‑out safety items. Its lower 95% Wilson bound was 94.1%, which the authors say lies above the upper confidence bound of all four external PT‑BR baselines they tested. Paired McNemar tests (with multiple‑comparison correction) found the safety gains significant against each baseline. - Negative DPO results documented: The project attempted Direct Preference Optimization (DPO) three times and found no reliable improvement. In one striking case, the DPO training metric (reward margin) reached a perfect value (~1.0), yet free generation behavior did not change at all. The authors emphasize that teacher‑forced training metrics can fail to reflect the model’s actual first‑token decisions in open generation. - Safety came from a dedicated safety‑SFT mix: The effective alignment came from iterated safety‑SFT training (v2→v3→v4), not from the DPO attempts. Iterations included balancing refusal examples with helpful responses and “general” examples to avoid becoming an over‑refuser. - Composition matters and is non‑monotonic: In a controlled scan varying only the fraction of general data in the safety‑SFT mix (10% to 60%), the authors observed a non‑monotonic “over‑refusal” curve with a knee region around 40–50% general data. Safety saturated up to ~30% and changed around 40–50%; over‑refusal dropped up to about 50% and then rose again at 60%. The authors treat this as exploratory (small N per point) and recommend larger probes before declaring the knee definitive. - LLM judge silent failure mode: When using an LLM judge to score safety responses, the authors discovered that the judge (via API) sometimes categorically refused to assign a score for particular safety items regardless of the candidate reply, returning an API stop_reason=refusal. That behaviour effectively reduced the sample size for that category; the team found this occurred repeatedly in prior project runs. They recommend reporting judge refusal rates per item when sensitive categories are evaluated. - Decontamination and compute budget audits: The authors ran a 13‑gram overlap audit and found only 73 overlapping items across evaluation sets (0.49% of evaluated items), with most overlaps being boilerplate or indirect republication. They also computed a Chinchilla‑anchored pretraining compute table: models with dramatically larger pretraining compute (inherited tokens/FLOPs) explain much of the gap in general capabilities (e.g., knowledge, math, code) versus Manacá‑1B‑Instruct‑2—an effect of scale rather than alignment choices.
Limits and caveats highlighted by the authors - Not perfect: The model is not 100% safe. The authors report one audited harmful compliance in 218 items (≈0.46%) and ~9.2% over‑refusal on the benign probe (statistically indistinguishable from several baselines at this scale). - Scale vs. alignment: Manacá performs competitively with similarly sized PT‑BR models on many tasks, but falls behind models that benefited from far larger pretraining budgets on knowledge‑ and reasoning‑heavy tasks. The authors attribute that gap to pretraining scale rather than to alignment methodology. - Experimental limitations: The composition scan was run with small N per point and a single seed per point; the knee finding is exploratory and needs larger, multi‑seed validation. The LLM‑judge finding should be checked with a second judge from another model family. - Licensing: The published weights inherit some non‑commercial license constraints from upstream data sources; commercial re‑use would require retraining SFT with permissive sources.
Why this matters This work is noteworthy for its transparency: the authors report negative experiments (DPO failures), provide statistical validation of safety improvements, and publish everything necessary to reproduce the pipeline and results. Their experience underscores a few broader lessons for applied alignment in smaller, language‑native models: (1) teacher‑forced metrics can be misleading if they are not validated by free‑generation checks; (2) the mixture of refusal/helpful/general examples in safety‑SFT matters and can produce unintuitive, non‑monotonic effects; and (3) using LLMs as judges of safety has its own failure modes that must be accounted for.
Recommended next steps (from the paper) - Increase probe sizes and run paired statistical tests to confirm the composition knee empirically (authors suggest 150–300 items per point). - Add a second LLM judge from a different model family to validate judge‑based measures. - Repeat the composition scan at another model scale to see whether the knee point is scale‑dependent.
Bottom line Manacá‑1B‑Instruct‑2 demonstrates that careful, fully documented safety alignment for a Brazilian‑Portuguese model is achievable at modest scale, with improvements validated statistically and a reproducible artifact released to the public. The work also highlights practical pitfalls—documented negative DPO runs, a composition dependence that is not straightforward, and an LLM‑judge failure mode—that practitioners should watch for. The authors are appropriately cautious about limits: alignment reduced harmful outputs substantially but did not eliminate them, and general capability gaps persist where pretraining compute gaps are large. The released code and logs make this a useful reference point for others working on responsibly aligning smaller, language‑native models.