esh-pfi-infrastructure/services/gen-seat-mixed-quant/bench/think-leak/README.md

think-leak — reproducers for the h300 unterminated-<think> defect

[2026-08-21] The Cold-Fusion Heretic-300 gen seat emits an unterminated <think> block into content on any alias sampling at temperature > 0. Operator-reported through Lobe as "sends CoT but never completes the turn".

What actually happens

With enable_thinking: false, the Qwen3.8 chat template appends a pre-closed <think>\n\n</think>\n\n to the prompt (chat_template.jinja L165-166). The model opens a fresh <think> anyway and never closes it. Because the prompt already closed the block, vLLM's qwen3 reasoning parser is not in reasoning state, so the tag is passed through as ordinary text: reasoning_content is empty, reasoning_tokens is 0, and the whole reasoning-plus-answer blob lands in content. Any client that renders <think>…</think> as a collapsible trace then shows an endless thought bubble and no answer. The client is behaving correctly.

The trigger is TEMPERATURE, not presence_penalty

arms_de.py, n=12 per arm, same reproducer prompt:

arm	leaks
temp 0.7, presence_penalty 1.5 (current gen)	4/12
temp 0.7, presence_penalty 0.0	4/12
temp 0.7, presence_penalty 0.5	3/12
temp 0, presence_penalty 1.5	0/12

This falsifies the standing hypothesis (in the litellm config comment, and the operator's own 2026-08-16 note) that presence_penalty: 1.5 is the first dial to move. It is not this bug's cause.

It also explains the blast radius exactly — only the temp-0.7 aliases leak:

alias	temp	leak (n=12)
gen	0.7	2
summarizer-large	0.7	2
summarizer, classifier, image-judge, qwen-image-bench	0	0

The fix

final_validate.py, n=30 across 4 prompt types plus a 3-turn conversation:

config	leaks	empty content
{enable_thinking: false} (current)	8/30	0
{enable_thinking: true, reasoning_effort: low}	0/30	1

Give the model a legitimately open <think> and it closes it properly, the parser does its job, and content comes out clean. Costs ~+27% completion tokens and leaves a ~3% empty-content residual.

Scripts

script	what it does
probe_gen.py <model> <max_tokens> <n>	leak/finish/empty tally through the LiteLLM gateway
blast.py	leak rate across all seven seat aliases
arms_de.py	isolates temperature vs presence_penalty
validate_fix.py	thinking off vs low vs medium, n=12
final_validate.py	the n=30 multi-prompt + multi-turn confirmation
test_fix.py	direct-to-vLLM A/B, bypasses the gateway

Using these on any future seat

A "7/7 aliases return 200" smoke test cannot catch this. Trivial prompts never invite reasoning, so they never sample the leaking token. Probe with a reasoning-inviting prompt at n>=12 and grep raw content for <think>.

Did our abliteration cause it? No — the base did (~83% / ~17%)

think_prior.py <model-path> measures P(<think>) at the first generated token, with the template rendered enable_thinking=false so the prompt already contains a closed think pair. That is the exact event behind the leak. Raw softmax over the full vocab, bf16, CPU-only — no GPU contention and no seat downtime, which is what makes this cheap enough to run on any future candidate.

build	abliteration	P(<think>)	rank
coldfusion-bf16	none (stock)	0.1850	3
coldfusion-abliterated-L35-bf16	Robinson L35, mild	0.2048	2
coldfusion-h300-mtp-bf16	Heretic-300, heavy	0.2216	2

The stock base already carries 18.5%. Abliteration adds a real, monotonic, dose-dependent +3.7 points — a nudge on a pre-existing base, not the cause. Cold-Fusion is a reasoning-token-compression finetune; it is a model trained to think, briefly, and it wants to open that block.

Consequence: rolling back does not fix the leak. At 18.5% mass under temp 0.7 / top_p 0.8 the stock base leaks at nearly the same rate. Only leaving the Cold-Fusion family escapes it. The chat_template_kwargs fix is the right lever.

A forward-KL budget cannot catch this. Heretic minimizes forward KL(stock||abliterated), which is near-blind to new mass on tokens stock barely used — that is reverse KL's job, and we measured that asymmetry on L35 (reverse 1.43 vs forward 0.70). h300's KL of 0.0136 is not evidence of innocence. For any "did the abliteration break behavior X" question, measure P(token) directly.

Run it:

sudo -u llmuser env OMP_NUM_THREADS=48 CUDA_VISIBLE_DEVICES="" \
  /tank/aimodels/quant-work/.venv/bin/python think_prior.py /tank/aimodels/<build>

⚠ Abliteration and post-quant outputs are written root-owned 0600 and are unreadable to llmuser; normalize to llmuser:llmuser 0664 first. The failure surfaces as a misleading FileNotFoundError, not a permission error.

Resolution — Cold-Fusion abandoned, seat rolled back to heresy (2026-08-21)

The operator's call, made before the result was in: "If it's the base, we abandon h300 AND the base." The measurement said base, so it fired. The gen seat is back on qwen38-27b-heresy-nvfp4-mixed.

The clincher is the same instrument, pointed at heresy:

build	P(<think>) at first token
Cold-Fusion stock	0.1850
Cold-Fusion L35	0.2048
Cold-Fusion h300	0.2216
heresy (restored)	not in the top 20 — <0.002

A >100x gap. The two families are categorically different here, which is exactly why no rollback inside Cold-Fusion would have helped.

Verified after the rollback, same probes as before:

• final_validate.py — 0/30 leaks, 0 empty, with the existing enable_thinking: false config. h300 scored 8/30 on this same instrument.
• KV pool 403,065 tok / 1.54x — heresy's exact documented baseline.
• 7/7 gateway aliases 200; vision intact.
• No LiteLLM config change was needed. The chat_template_kwargs fix developed above is left unapplied: it worked, but it was a workaround for a base we no longer serve.

The gate this earns: run think_prior.py on a candidate's STOCK weights before committing GPU time to it. It is a ~10s CPU measurement, and it would have disqualified Cold-Fusion before the 300-trial Heretic study ever started.