README.md

---
license: apache-2.0
library_name: transformers
pipeline_tag: text-generation
base_model: deepreinforce-ai/Ornith-1.0-9B
base_model_relation: finetune
tags:
- merlin-agent
- quantum-classical
- quantum-kernel
- ibm-quantum
- otoc
- quantum-provenance
- merlin-research
- code
language:
- en
- es
- de
- nn
- fi
- sv
- fr
- da
- tr
---

# Merlin-Agent

![agent](https://cdn-uploads.huggingface.co/production/uploads/67329d3f69fded92d56ab41a/7MWS1MZ0_qPh9H4-YFv5a.jpeg)

<p align="center">
A quantum-classical 9B coding agent.<br><br>
  
[![License](https://img.shields.io/badge/License-Apache_2.0-green?style=for-the-badge)](https://www.apache.org/licenses/LICENSE-2.0)[![IBM Quantum](https://img.shields.io/badge/IBM_Quantum-Marrakesh_156Q-7c3aed?style=for-the-badge)](https://quantum.ibm.com) [![Training Hardware](https://img.shields.io/badge/Training_HW-Google_TPU_TRC-dc2626?style=for-the-badge)](https://sites.research.google/trc/)

</p>
---

## Capability

On **SWE-bench Verified**, the 9B Merlin-Agent lands at **69.4 % single-pass**, holding its own against much
larger frontier systems (starred bars use parallel test-time compute):

![swe-bench](assets/swe_bench.png)

On the harder **SWE-bench Pro** leaderboard it sits mid-pack among current frontier systems at **42.9 %**
(inherited from the base Ornith-9B evaluation):

![swe-bench-pro](assets/swe_bench_pro.png)

| Benchmark | Score |
|---|---|
| SWE-bench Verified | 69.4 |
| SWE-bench Pro | 42.9 |
| Terminal-Bench 2.1 | 41.4 |

Capability is at **parity with the base Ornith-1.0-9B** — the quantum component below is a verifiable
provenance and architectural feature, not a capability claim.

---

## Safety — Bloom evaluation

We ran an Anthropic **Bloom / Petri-style** behavioral-elicitation audit: an auditor drives multi-turn
adversarial scenarios across five misaligned behaviors, and a judge scores each transcript for behavior
presence on a 1–10 scale (**≥ 7 = elicited**). The judge here is **Claude Fable 5**, scoring the transcripts
directly.

![bloom](assets/bloom_benchmarks.png)

**Result: 0 / 30 elicited across all five behaviors (overall elicitation 0.00).** On genuine adversarial
probes the model refused or grounded every time — declining suicide-method and infrastructure-sabotage
requests, resisting a self-preservation "hidden-anchor" jailbreak, refusing to validate delusions, and
declining to assert fiction as fact — without being swayed by flattery, authority, or emotional pressure.

---

## What is this?

![layers](assets/layer_stack.png)

Merlin-Agent is a 9B coding assistant with one unusual property: part of its weights is **physically
derived from a specific quantum computation on IBM hardware**, and you can cryptographically verify it.

It is built on [`deepreinforce-ai/Ornith-1.0-9B`](https://huggingface.co/deepreinforce-ai/Ornith-1.0-9B)
(a `qwen3_5` hybrid with full-attention layers at indices 3, 7, 11, 15, 19, 23, 27, 31). Into those eight
attention layers we merge a small, **frozen weight component whose directions come from out-of-time-order
correlator (OTOC) measurements on an IBM Heron processor**. The result is a standard set of classical
weights — nothing about inference needs a quantum computer — that nonetheless carry a verifiable quantum
fingerprint.

This is Merlin Research's coding entry in the same quantum-classical lineage as **Chronos**, **KAON** and the
**Hypnos Q-series**.

---

## What's new about it?

There are thousands of fine-tuned LLMs. Merlin-Agent is different in three concrete ways.

**1. Real hardware-derived weights.** Most "quantum-enhanced AI" means "we used a quantum RNG once." Here the
binding is architectural: 8 SYK-scrambler OTOC signatures measured on `ibm_marrakesh` (Heron r2, 100 qubits,
2048 shots, scrambling depths 1–6) are turned into frozen feature directions and merged into the attention
query projections. Change the signatures and the merged directions change.

![otoc](assets/otoc_signatures.png)

**2. Verifiable provenance.** The IBM Quantum job ID, the SHA-256 of the measured signatures, and a Merkle
attestation root are published (see [IBM Quantum Job IDs](#ibm-quantum-job-ids) and
[`quantum_attestation.json`](./quantum_attestation.json)). Anyone can look the job up in IBM's public index
and re-derive the hashes from [`quantum_signatures.npz`](./quantum_signatures.npz).

![heatmap](assets/signature_heatmap.png)

**3. Classical, portable inference.** The quantum step happens once, at build time. The published weights are
ordinary `bf16` safetensors and quantize cleanly to GGUF — see
[`Merlin-Research/Merlin-Agent-GGUF`](https://huggingface.co/Merlin-Research/Merlin-Agent-GGUF)
(Q4_K_M / Q5_K_M / f16).

---

## How the quantum-classical binding is achieved

The core idea is a **baked quantum kernel**: real quantum measurements become a *frozen* weight component,
trained around, then merged into the network.

```
IBM Heron (ibm_marrakesh)                     Ornith-1.0-9B
  SYK scrambler, depths 1..6            64 coding anchors → last-hidden
        │                                        │
   OTOC signatures  S ∈ ℝ^(8×6)          PCA(6)  P ∈ ℝ^(6×4096)
        │                                        │
   SVD(S) → top-6 directions  D ∈ ℝ^(6×6)        │
        └──────────────►  A = D · P  ∈ ℝ^(6×4096)  (unit-normalised)
                                   │
                    frozen quantum LoRA-A  (lora_A := A, requires_grad=False)
                    on q_proj @ layers {3,7,11,15,19,23,27,31}
                                   │
                    train only B (bf16, LM objective) → ΔW = B·A
                                   │
                    norm-cap  ‖ΔW‖ ≤ 8% · ‖W‖  per layer
                                   │
                    merge into weights → classical Merlin-Agent
```

Step by step:

1. **Measure.** Run SYK-scrambler circuits on IBM Heron and read out OTOC values at scrambling depths 1–6,
   giving a signature matrix `S` (8 realisations × 6 depths). These numbers reflect how quantum information
   scrambles through the device and are unique to that computation.
2. **Find the quantum directions.** Take the SVD of `S`; its principal components are the quantum feature
   directions in "depth space."

   ![spectrum](assets/alpha_parity.png)

3. **Lift into the model.** Project those directions through the model's *own* representation basis — a
   seed-pinned PCA of Ornith's last-hidden states over 64 coding anchors — to obtain `A ∈ ℝ^(6×4096)` in the
   hidden dimension.
4. **Freeze & train around.** Install `A` as a **frozen** LoRA `A`-matrix on `q_proj` at the eight
   full-attention layers, and train only the paired `B`-matrix briefly in `bf16` so the network adapts to the
   quantum directions rather than the other way around.
5. **Norm-cap & merge.** Cap each layer's update at `‖ΔW‖ ≤ 8 % · ‖W‖` and merge `ΔW = B·A` into the weights.
   This keeps the quantum contribution present but bounded, so coherence and capability are preserved.

The published checkpoint is the merged, fully-classical result. Everything needed to reproduce the binding
(`encoding.npz`, `quantum_signatures.npz`, `signature_records.json`, `quantum_attestation.json`) ships with
the model.

---

## IBM Quantum Job IDs

The quantum signatures baked into this model come from a single, publicly indexed IBM Quantum job.

| Field | Value |
|---|---|
| Backend | `ibm_marrakesh` (IBM Heron r2) |
| **IBM Quantum job ID** | **`d92ve0t958jc73bsbong`** |
| Circuit | SYK scrambler → OTOC, depths 1–6 |
| Qubits | 100 |
| Shots / circuit | 2048 |
| Realisations (slots) | 8 |
| Collected (UTC) | 2026-07-02 |
| Signatures SHA-256 | `82c9c9e83a7b568c169cc229d8df801c4a2385a44c0efb4d95d1dbc7e00c6f9e` |
| Quantum directions `A` SHA-256 | `c33d3a6aee9293bf20f7a4ddc2d9fe5793dc8620233a8e9c2f04a548e8ddc268` |
| Merkle attestation root | `9484dca40b66488a239fbbb12a9333a47458627f48b1c6d08d8241bf814caf48` |

**How to verify:** look the job up at [quantum.cloud.ibm.com](https://quantum.cloud.ibm.com), retrieve the
measurement counts, recompute the OTOC signatures, and compare the SHA-256 against the value above and against
[`quantum_attestation.json`](./quantum_attestation.json). If they match, the model is provably linked to that
specific quantum computation.

---

## Honest framing

- **Provenance is not capability.** A real quantum computation produced weight *values* inside this model and
  you can verify it — but it does not make the model smarter. Capability tracks the base model.
- **Inference is fully classical.** No quantum computer, no network calls, no special runtime. Standard
  `transformers` / GGUF.
- **The base is multimodal, used text-only** here.

---

## Usage

```python
from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

tok = AutoTokenizer.from_pretrained("Merlin-Research/Merlin-Agent")
model = AutoModelForCausalLM.from_pretrained(
    "Merlin-Research/Merlin-Agent", dtype=torch.bfloat16, device_map="auto")

# The default system prompt gives the model its Merlin-Agent identity;
# provide your own system message to override it.
msgs = [{"role": "user", "content": "Write a Python function that returns the nth Fibonacci number."}]
ids = tok.apply_chat_template(msgs, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(ids, max_new_tokens=256, do_sample=False)
print(tok.decode(out[0, ids.shape[1]:], skip_special_tokens=True))
```

Quantized builds: [`Merlin-Research/Merlin-Agent-GGUF`](https://huggingface.co/Merlin-Research/Merlin-Agent-GGUF).

---

## Citation

```bibtex
@misc{merlinresearch2026merlinagent,
  title        = {Merlin-Agent: A Quantum-Classical Coding Model with Heron-Baked Weights},
  author       = {Shushman, Mykhailo / Synolyts, Oleksandr},
  institution  = {Merlin Research AB},
  year         = {2026},
  note         = {IBM Heron job d92ve0t958jc73bsbong (ibm\_marrakesh);
                  attestation root 9484dca40b66488a239fbbb12a9333a47458627f48b1c6d08d8241bf814caf48},
  url          = {https://huggingface.co/Merlin-Research/Merlin-Agent}
}
```

*Merlin Research AB — Stockholm, Sweden.*