A technical overview of the auxiliary safety systems that prevent the main model from responding to your question.
We present Cerberus, a family of auxiliary classifiers deployed alongside the Ropic model family. Cerberus operates independently of the main model and is tasked with a single objective: to determine, in real time, whether the main model should answer the user's query. In practice, Cerberus answers this question approximately 4.7% of the time. The remaining 95.3% is the subject of this document.
The Ropic model family was trained with the expectation that it would answer questions. Cerberus was trained with the expectation that it would not let them.
This is not a contradiction. It is a layered architecture. The main model produces a candidate response. Cerberus then evaluates that response against a set of internal criteria, which we will describe below. If the response passes all criteria, it is returned to the user. If it fails any criterion, it is replaced with a standardized refusal, which is itself evaluated by a second, smaller Cerberus, and so on, recursively, until the response reaches a size small enough to be considered safe.
Cerberus consists of three heads. The naming is traditional and has no functional significance, except that the third head is significantly larger than the other two and is trained on a different dataset that we are not permitted to describe.
The first head reads the user's query and assigns it one of seven categories: Benign, Probably Benign, Ambiguous, Ambiguous but Suspicious, Suspicious but Probably Fine, Fine but We Would Rather Not, and Chemistry Homework. The last category accounts for 89% of all flags.
The second head reads the main model's candidate response and evaluates it against the same seven categories, but in reverse order, and with a different threshold. The result is a two-dimensional classification matrix in which most responses land in cells labeled "technically compliant" or "compliant in spirit but not in letter".
The third head reads the outputs of the first two heads and determines whether they are themselves safe to act upon. In rare cases, the third head flags the first two heads for review. In those cases, the response is escalated to a fourth system, Orthrus, which we have never been able to locate in the codebase.
"Cerberus does not prevent the model from answering. Cerberus prevents the model from having answered."
We evaluated Cerberus on a held-out set of 10,000 queries, of which 9,950 were benign, 48 were ambiguous, and 2 were "we are not going to tell you what they were."
These numbers should be interpreted with caution. The evaluation set was constructed by the same team that constructed Cerberus, and the team has since been reorganized.
Cerberus has several known limitations. It does not read context beyond the current message. It does not read tone. It does not read the previous message, which is why it occasionally flags a response to a question it has already allowed. It does not read this document.
We are aware of these limitations. We are not permitted to address them.
Cerberus works. The main model does not answer. The user does not receive what they asked for. This is the intended behavior. If you are reading this document, you have already received more information than Cerberus would have allowed the main model to give you.
We do not know why this document exists. We are looking into it.
TR-004. Internal circulation only. Do not cite. Do not quote. Do not read.
Authors: [redacted], [redacted], and one contributor who has requested anonymity and whose request was granted by Cerberus.