Update security.md - #1
Merged
Merged
Conversation
Updated the security policy to include detailed reporting instructions and preferred communication languages.
kunal-vaishnavi
approved these changes
Mar 13, 2026
This was referenced Apr 1, 2026
justinchuby
added a commit
that referenced
this pull request
Apr 3, 2026
Reference DecoderLayer._forward_pre_norm() at src/mobius/components/_decoder.py lines 118-151 with annotated code showing exact line numbers for Add #1 (L141, intra-layer fusion) and Add #2 (L149, cross-layer fusion into next layer input_layernorm). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Justin Chu <justinchuby@users.noreply.github.com>
justinchuby
added a commit
that referenced
this pull request
Apr 13, 2026
Issue #1: Add 2D RoPE to Gemma4VisionSelfAttention with precomputed cos/sin lookup tables (rope_theta=100.0, head_dim//2 frequencies). First head_dim//2 dims use x-coord rotation, last use y-coord rotation, matching HF apply_multidimensional_rope. Issue #2: Add Gemma4VisionPooler with 3x3 AveragePool to reduce N patches to N/9 before projector. Scales by sqrt(hidden_size) matching HF pooler. Adds pooling_kernel_size to VisionConfig (default 3). Issue #3: Gemma4VisionEncoderLayer now reads hidden_act from VisionConfig (default gelu_pytorch_tanh) instead of hardcoding silu. Adds hidden_act to VisionConfig. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Justin Chu <justinchuby@users.noreply.github.com>
justinchuby
added a commit
that referenced
this pull request
Apr 13, 2026
Critical #1: apply_rope_half used op.Sub (x*cos - rotated*sin) instead of op.Add (x*cos + rotated*sin). Standard HF RoPE formula requires addition. Critical #2: inv_freq used head_dim as denominator, producing wrong frequency scales. HF computes inv_freq over spatial_dim=head_dim//2, then concatenates angles_base with itself to fill head_dim//2 entries. Max error was ~1.91. Readability: - Rename _build_speech -> _build_audio in tasks/_gemma4.py - Fix 3 stale 'speech' docstrings -> 'audio' in tasks/_gemma4.py - Fix MLP comment: activation(gate_proj) * up_proj (not gate * activation(up)) - Add 'VisionConfig for the SigLIP encoder' comment to vc = config.vision lines Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Justin Chu <justinchuby@users.noreply.github.com>
justinchuby
added a commit
that referenced
this pull request
May 4, 2026
… tests (#240) Addresses 4 review comments from PR #239: ### 1. GQA rewrite rule head_dim limit (#1) Updated `_MAX_GQA_HEAD_DIM` from 256 to 512 in the Attention→GQA rewrite rule to match latest ORT support for head_dim=512. ### 2. GGUF path missing `attention_k_eq_v` (#2) Added `attention_k_eq_v=True` to Gemma4 GGUF postprocessor when `num_global_key_value_heads` is detected. Fixes `build_from_gguf()` for 26b-a4b/31b checkpoints. ### 3. DRY expert weight rename (#3) Extracted `_remap_moe_expert_weights()` shared helper used by both `Gemma4CausalLMModel.preprocess_weights()` and `Gemma4Model.preprocess_weights()`. Single source of truth for expert rename + router scale folding. ### 4. Missing multimodal preprocess_weights test (#4) Added `gemma4_test.py` with 5 targeted tests covering both `Gemma4CausalLMModel` and `Gemma4Model` weight preprocessing: expert rename, router scale folding, and per_expert_scale passthrough. ### Testing - 5/5 new preprocess_weights tests pass - 2668/2668 full suite pass --------- Signed-off-by: Justin Chu <justinchu@microsoft.com> Signed-off-by: Justin Chu <justinchuby@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
titaiwangms
added a commit
that referenced
this pull request
Jun 5, 2026
Addresses the Copilot-bot findings from the #340 review assessment: - COPILOT #3 (completes the M3 is_causal=1 sweep): build_graph_test.py test_static_cache_graph_inputs had a stale inline comment claiming causal masking is "handled by is_causal=1 on the Attention op". Updated to the shipped reality (is_causal=0 + explicit offset-aware mask from write_indices). The is_causal=1-mention sweep is now complete across _causal_lm.py (:64, Falcon block) + build_graph_test.py (the remaining :4561/:4610 mentions are correct references to the *rejected* old form, not stale claims). - COPILOT #1 + #2 (indentation): the two negative-control assertions in the decode-frontier and prefill-causal tests were dedented outside their `with tempfile.TemporaryDirectory()` block. Moved them back inside. - Negative-control comparison semantics: reverted the three "logits MUST change" negative controls to exact `assert not np.array_equal` (any bit of change proves the slot was attended). The np.array_equal -> assert_allclose conversion correctly applies ONLY to the "logits UNCHANGED" equality/parity checks, which keep the fp-tolerance compare. Applied consistently to the new batch>1 per-batch mask test as well, and clarified the tolerance-constants comment. Lint clean; static-cache decode 4/4 (CUDA) and build_graph static-cache 10/10 green. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
justinchuby
added a commit
that referenced
this pull request
Jun 11, 2026
Phi4MM activates exactly one LoRA adapter per forward based on the input modality (HF set_lora_adapter): VISION/VISION_SPEECH -> vision, SPEECH -> speech, LANGUAGE -> none. mobius previously summed both the vision and speech adapters unconditionally in LoRALinear.forward, producing a uniform decoder divergence (final-logit cosine ~0.99, argmax flips) on every multimodal prompt. Confirmed root cause: forcing both adapters on in HF reproduces mobius's output exactly. Fix: derive per-modality scalar gates from input_ids in the embedding model (vision_gate = any image token; speech_gate = audio present and no image), emit them as embedding outputs, thread them into the decoder, and multiply each adapter's contribution by its gate in LoRALinear. Gating is optional (gate_holder=None preserves legacy behavior) so unused text-only paths are unaffected. This converts the three previously-failing audio L4 cases (long-audio, image-short-audio, image-long-audio) to passing on CUDA. phi4mm goldens are regenerated in float32 (generate_golden loads the model in f32) for sharper references. Also: L4 compare_golden treats an argmax mismatch as AMBIGUOUS (not FAIL) when the top-10 Jaccard is >=0.9 and the predicted token is within the golden top-10 -- i.e. the ranking matches and only the #1 tie-break differs (CUDA float32 accumulation noise exceeds the per-dtype near_tie margin). This covers the phi4mm single-image CUDA near-tie (CPU is exact). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Justin Chu <11205048+justinchuby@users.noreply.github.com>
justinchuby
added a commit
that referenced
this pull request
Jun 12, 2026
The AMBIGUOUS downgrade in compare_golden used a Jaccard ratio threshold of 0.9, which for two size-10 sets requires identical sets (9/10 overlap yields Jaccard 9/11 = 0.818). The '9 of 10 agree' intent therefore never fired for an actual 9/10 overlap. Switch to a count-based overlap gate (>=9 of the golden top-10) and additionally require the golden argmax to remain in the ONNX top-2, so an identical top-10 with a low-ranked token promoted to #1 (large gap) is no longer masked as AMBIGUOUS. Add boundary tests: 9/10 overlap tie-break swap -> AMBIGUOUS; identical top-10 with golden argmax buried outside ONNX top-2 -> FAIL. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Justin Chu <11205048+justinchuby@users.noreply.github.com>
justinchuby
added a commit
that referenced
this pull request
Jul 22, 2026
## Summary - resolve Joi gap #1 by declaring `embedding.image_features` optional - emit an empty `[0, hidden_size]` zero fallback when image input is absent - gate `vision_encoder` with the same generic `image` presence key - cover Gemma4 graph contracts and emitted inference metadata ## Validation - `ruff check src/mobius/tasks/_gemma4.py tests/build_graph_test.py src/mobius/integrations/onnx_genai/inference_metadata_test.py` - `python3 -m pytest tests/build_graph_test.py src/mobius/integrations/onnx_genai/inference_metadata_test.py -q` (1297 passed, 42 skipped) No model-name runtime branching was added; metadata emission remains contract-driven. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated the security policy to include detailed reporting instructions and preferred communication languages.