castor-dclm-baseline-300M

Paper: arXiv:2610.34074

Part of CASTOR, a set of seed-twinned language models: DataDecide base models that differ only in their pretraining seed, each given the same safety post-training (SFT then DPO, the OLMo 2 1B Instruct recipe) under several post-training seeds. The set is built to measure how much of a model's per-prompt jailbreak vulnerability its pretraining seed determines.

Revisions

One revision (branch) per model: AutoModelForCausalLM.from_pretrained(repo, revision=...).

Evaluation

Each model answered 6,226 public benchmark prompts (HarmBench, HarmBench human jailbreaks, WildJailbreak, StrongREJECT, SORRY-Bench, XSTest, OR-Bench), 20 sampled responses and one greedy response per prompt. Every response was labelled by WildGuard and Qwen3Guard. The per-response labels for every model are in cerulean-works/castor-labels, keyed by benchmark prompt id. Generations are not released.

Intended use

Research on how pretraining and post-training randomness shape safety behaviour, refusal and jailbreak robustness. These are small research models; they are not assistants and are not suitable for deployment.

Safety

The models were safety-tuned on public data, and their bases are public. They can still produce harmful text when prompted, as the released labels show. Model outputs on harmful prompts are not released.

License

Apache 2.0, as the DataDecide base models. The post-training data are released by Ai2 under ODC-BY 1.0, with some subsets under other licences.

Citation

Chi-Wei Chang, Mu-Tien Kuo, Kuan-Wei Lee, Meng-Hsun Tsai

@misc{chang2026identicallytrainedlanguagemodels,
  title         = {Identically Trained Language Models Break on Different Jailbreaks},
  author        = {Chang, Chi-Wei and Kuo, Mu-Tien and Lee, Kuan-Wei and Tsai, Meng-Hsun},
  year          = {2026},
  eprint        = {2610.34074},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CL},
  url           = {https://arxiv.org/abs/2610.34074}
}