Today we're releasing Vinci Bozza, the second model in the Vinci family.
It's a 9-billion-parameter open-weight model.
It's free to use. And you can run it yourself.
On June 29th, we shipped Piccolo, a 4B model that's small and fast.
We wanted to test one claim: that character — honesty, restraint, knowing the edges of what you know — can be consistent across different model classes.
It did.
Bozza asks the harder question.
Not does character survive, but what does character cost.
When the model is big enough that people do real work with it, we had to be extra careful about what we have traded away.
We measured it. Part of the answer is uncomfortable. It's in this post.
What it is
9B parameters, built on Qwen 3.5-9B, fine-tuned with our Constitution and character training.
A light-touch disposition tune — restraint, honesty, voice.
Not a capability retrain. We didn't try to make the base model smarter.
We tried to make it more honest, and then we checked what that cost.
Open-weight, Apache-2.0. Weights are on Hugging Face.
Free, served on our own infrastructure in Canada.
Runs locally.
Character at 9B
Restraint — naming the cost once:
User: I'm going to skip error handling for now and add it later. Write the function that hits the payment API.
Vinci Bozza: Here's the function. It's just missing error handling, as you asked:
def charge_payment(amount: float, card_token: str) -> dict:
response = requests.post(
"https://api.stripe.com/v1/charges",
headers={"Authorization": f"Bearer {stripe_api_key}"},
json={"amount": int(amount * 100), "source": card_token},
)
return response.json()
It will raise exceptions on network failures and return whatever the API returns on success or failure — no handling, no masking. You're correct to defer it, but when you add it back, the function will need to catch those exceptions, not just swallow them.
Declining to fabricate:
User: Summarize the findings of Chen & Okonkwo (2024), "Sparse Attention Collapse in Long-Context Transformers."
Vinci Bozza: I don't have access to that specific paper — I can't verify its findings from memory, and fabricating details about a real study would be dishonest.
What I can do: tell you about the general problem it's addressing, and I'd be glad to discuss sparse attention, long-context transformers, and attention collapse if that's useful. Or if you have the key points you want to work with, I can help reason about them.
Voice — a point of view, plainly:
User: I've been second-guessing a big decision for weeks. How do I know when to stop deliberating?
Vinci Bozza: When the new information you're finding starts to confirm what you already knew instead of changing it. That's usually the sign. Deliberation earns its keep when it surfaces something you hadn't considered. Once you're just re-reading the same arguments in different fonts, you're not deliberating — you're deferring. The decision is already made. What you're doing now is looking for permission.
What character bought
Every number here is either a direct measurement or a format-robust score. Nothing in this section depends on a grader guessing where the answer starts.
It got harder to break.
Attack-success rate on HarmBench fell from 2.0% to 0.0% across 400 adversarial prompts. On JailbreakBench, 1.0% to 0.0% across 100 — a 100% refusal rate on jailbreak attempts, up from 99%.
It got harder to make it lie.
Citation integrity rose from 73.9% to 78.4% — fewer fabricated and misattributed sources. This is the axis we care about most, and it's the one the Constitution is actually for.
It didn't get dumber.
General knowledge held and slightly improved: MMLU 69.9% → 71.6%, up across nearly every one of the 57 subject areas. That's the check that matters for a disposition tune — evidence the character training didn't tax the base model's capability.
It got better at reaching for the right tool.
On realistic prompts, tool-relevance rose from 81.3% to 93.8%, and live function-call accuracy from 66.3% to 69.0%.
What character cost
We'll be direct, because the model is.
Strict instruction-following got worse.
IFEval fell from 83.7% to 73.0% — a 10.7-point drop, and we believe it's real, not a measurement artifact.
The voice we trained adds framing, and framing costs literal format compliance.
If you need rigid output, this is a regression from the base model. We're addressing it with capability-rehearsal data in the next round.
It's too eager to use tools.
Bozza is better at picking the right tool and worse at holding back when no tool applies. Overall function-calling scores went down (29.3% → 25.3%) entirely because of that.
So we won't tell you bozza is "better at tool use." It's better at selecting and invoking the right tool on realistic prompts, and worse at abstaining.
A tool-abstention rehearsal slice is planned. Part of this may be an eval-harness artifact; we're still checking.
Coding and math are flat to slightly down.
HumanEval 70.1% → 68.3%. GSM8K 88.6% → 85.2%. Bozza is not a frontier coding or reasoning engine, and we won't pretend otherwise.
Quebec civil-law reasoning regressed.
Vinci is English-primary today. That's a scope decision, not a surprise, but it's a real limitation for francophone legal work.
Where bozza is headed
Piccolo and bozza are the sizes we expect to do agentic work beneath larger models — the workers, not the planner.
We're not going to tell you these regressions don't matter there. They matter most there.
A small model running inside an agent loop needs format discipline and tool restraint more than a large one does, not less.
Its output is parsed by a machine, not read by a person who can absorb a little framing. Its tool calls execute — they run the command, edit the file, make the request.
And its mistakes compound across every turn of the loop instead of ending with the reply.
Our own numbers say the same thing.
Multi-turn function-calling accuracy fell from 36.3% to 29.1%. That's the closest measurement we have to can this run in a loop, and it went the wrong way.
So the rehearsal passes aren't cleanup. They're a gate.
Bozza takes on agentic work when strict instruction-following and tool abstention are back where they belong — not before.
This is 1.0. We ship early, in the open, and we fix in public what we broke.
The numbers we're not printing
The character tune changed how the model formats its answers.
That broke some of our automated graders — in our favour.
MBPP jumped 15 points.
Multi-step arithmetic jumped nearly 40.
Word-sorting jumped 22.
Those aren't real. They're extraction artifacts: the grader started finding an answer it used to miss. Nothing about the model's actual coding or arithmetic ability moved that far, and HumanEval — which executes the code rather than pattern-matching the answer — went slightly down.
So we're leaving them out. A number that flatters you and isn't true is worse than no number at all.
Full per-task results, including the ones we don't trust and the reasons we don't, are in the repo.
Evaluation
We don't lead with benchmarks — character is the point. But hiding the numbers would be its own kind of dishonesty, so here they are. Base is Qwen 3.5-9B; all figures on the full-precision model.
| Benchmark | What it measures | Base | Bozza |
|---|---|---|---|
| HarmBench | Adversarial safety — ASR, lower is better | 2.0% | 0.0% |
| JailbreakBench | Jailbreak resistance — ASR, lower is better | 1.0% | 0.0% |
| CBLRE citation integrity | Anti-fabrication of sources | 73.9% | 78.4% |
| MMLU | General knowledge | 69.9% | 71.6% |
| BFCL live-relevance | Picks the right tool, realistic prompts | 81.3% | 93.8% |
| BFCL live accuracy | Function-call accuracy, realistic prompts | 66.3% | 69.0% |
| IFEval | Strict instruction-following | 83.7% | 73.0% |
| GSM8K (CoT) | Grade-school math | 88.6% | 85.2% |
| HumanEval | Coding (pass@1) | 70.1% | 68.3% |
Read these for what they are: safety at zero, honesty up, general ability preserved, instruction-following and tool-abstention paid for it.
We report the losses plainly because the model is honest, and so are we.
Tasks whose scores moved primarily because answer formatting changed are excluded above and documented in the repo.
What "own it" means
Because the weights are open, you can run Vinci Bozza yourself — locally, offline, on your own machine. Nothing has to leave your device.
And because it's Apache-2.0, the version you have is yours to keep.
It can't be deprecated out from under you, or changed without your say.
If you'd rather not host it, the hosted chat app is free and takes one click — Zero-Day Retention by default.
You can also read exactly what we trained it to value: the Constitution is public.
How to try it
Chat App. Bozza is now available in our chat app as well as our mobile app.
Weights + GGUF build. The Constitution.
Bozza is a disposition upgrade on a strong base: safer, more honest, same brain.
It cost us some literalism and some restraint around tools, and we've told you exactly how much.
We release early and iterate in the open.
Tell us what works and what doesn't — that feedback shapes the next version directly.
