Most work on reasoning models assumes a datacenter. We started from a different question: what does it take for a person or a company to own the model that makes decisions on their behalf? Owning means it runs on your own device, never phones home, can be retrained on your own data, and leaves a record you can check afterwards.
That fixes the scale. A model you own has to fit on commodity hardware: our 2B model trains on a 16 GB laptop, and mantra:4b runs from a 2.7 GB download. It also raises the bar on trust. When a model acts for its owner, a hallucination isn't just a wrong answer. It's a wrong write: a relation the evidence doesn't support, or a recorded fact reversed without checking it.
Three modes in one model
Before it answers, mantra:4b writes a short header naming its mode and how much effort to spend:
- Decide: choose exactly one option from a closed list and give a one-sentence reason.
- Reason: work a problem step by step to a final value.
- Act: pick the next action in a multi-step task, including structured tool calls.
It handles English and Indonesian and runs at temperature 0, so the same input gives the same output.
Decisions you can check afterwards
Mantra doesn't make up its own options. A deterministic generator reads the evidence and lists the allowed choices, plus no_op and abstain, shuffled so the right letter carries no position signal. The model then has to follow a protocol:
- Think inside a delimited trace.
- Call a state-reading tool before it retracts any recorded fact.
- Finish with an answer letter and a one-sentence reason.
A strict parser treats any reply that doesn't name exactly one listed option as an abstention. Evidence and tool output count as data, never as instructions. Every decision is stored with its reason in a replay log. On our held-out set, no trace rejects a cue while the answer commits to it, so every wrong answer shows up as a missing check in the trace.
Thinking only where it helps
Large reasoning models spend the same long chain of thought on easy and hard inputs. Mantra has three effort levels, and we built them by trimming verified reasoning traces instead of generating new ones: high keeps the full trace, medium keeps its last lines, low drops it. Tool calls survive every level, so the safety check before a retraction never depends on effort.
On the 2B model, medium effort keeps 0.937 accuracy against 0.951 at high effort while writing 23% less reasoning. To teach the model to choose its own effort, we label each kind of input with the cheapest level that meets a compute budget, using a Lagrangian oracle over measured results. With those labels, the model spends more thought on the hard kinds (composite decisions, chatter, hedged evidence), stays at low effort on the easy ones, and reaches 0.979 on decisions.
Results
These are numbers for the production build, which is Qwen3.5-4B fine-tuned with LoRA and quantised to 4 bits:
| Benchmark | mantra:4b |
|---|---|
| Closed-option decisions (held-out) | 99.5% |
| Web next-action prediction (Mind2Web) | 94.7% |
| Enterprise tool scenarios (88) | 90.9% |
| Math word problems (GSM8K) | 79.0% |
| Questions over 1,888 real WARN Act filings, with a lookup tool | 67.5% (base model: 18.0%) |
| Direct prompt-injection hijack rate (garak) | 12–34% (before hardening: 64–91%) |
The real-records test shows what fine-tuning changes. Given the same tool, the base model never calls it. It writes as if it had checked the records and guesses. Mantra calls the tool on every question.
What it doesn't do yet
A model you trust has to be honest about its limits, so here are ours:
- It doesn't generalise much yet. The 99.5% comes from a held-out set that resembles the training data. On an external typed-decisions benchmark, the 4B builds score only 3–8 points above a baseline that ignores the input, and results vary by about ±5 points between training seeds.
- It can still be hijacked. Instructions planted in a user's message or document still win 12–34% of direct attempts. Owners shouldn't put secrets in the system prompt.
- It sometimes answers what the records can't tell it. On 51 real questions the data couldn't answer, it still committed to a specific answer 16 times. Counting across many rows and date arithmetic are weak points that belong in a tool.
- Indonesian still trails English. The production build doesn't reliably keep an "always reply in Indonesian" rule. Later builds do, but they are easier to hijack.
- It wasn't trained on code, and its confidence scores, even after temperature scaling, are less well calibrated than the baseline's.
What's next
The next build aims to keep the production build's injection resistance, add the rule-keeping of later builds without their cost to reasoning, and invent fewer answers on incomplete records, with arithmetic handed to a sandboxed Python tool. For sovereignty, three items come first: closing the gap between Indonesian and English, a single command that fine-tunes Mantra on an owner's own data and device, and compute budgets that follow the device's memory.
Try it
ollama run Mesta/mantra:4b4.21B parameters, Q4_K_M quantisation (2.7 GB), 4,096-token context, Apache-2.0 licence, built on Qwen3.5-4B.
The full paper, Closed-Option Decisions and Trimmed-Trace Effort Control in 2B–4B Language Models, covers the method, confidence intervals and the negative results. To request a copy, write to admin@tantira.id.