Merlin-Agent

Capability

On SWE-bench Verified, the 9B Merlin-Agent lands at 69.4 % single-pass, holding its own against much larger frontier systems (starred bars use parallel test-time compute):

On the harder SWE-bench Pro leaderboard it sits mid-pack among current frontier systems at 42.9 % (inherited from the base Ornith-9B evaluation):

Capability is at parity with the base Ornith-1.0-9B — the quantum component below is a verifiable provenance and architectural feature, not a capability claim.

Safety — Bloom evaluation

We ran an Anthropic Bloom / Petri-style behavioral-elicitation audit: an auditor drives multi-turn adversarial scenarios across five misaligned behaviors, and a judge scores each transcript for behavior presence on a 1–10 scale (≥ 7 = elicited). The judge here is Claude Fable 5, scoring the transcripts directly.

Result: 0 / 30 elicited across all five behaviors (overall elicitation 0.00). On genuine adversarial probes the model refused or grounded every time — declining suicide-method and infrastructure-sabotage requests, resisting a self-preservation "hidden-anchor" jailbreak, refusing to validate delusions, and declining to assert fiction as fact — without being swayed by flattery, authority, or emotional pressure.

What is this?

Merlin-Agent is a 9B coding assistant with one unusual property: part of its weights is physically derived from a specific quantum computation on IBM hardware, and you can cryptographically verify it.

It is built on deepreinforce-ai/Ornith-1.0-9B (a qwen3_5 hybrid with full-attention layers at indices 3, 7, 11, 15, 19, 23, 27, 31). Into those eight attention layers we merge a small, frozen weight component whose directions come from out-of-time-order correlator (OTOC) measurements on an IBM Heron processor. The result is a standard set of classical weights — nothing about inference needs a quantum computer — that nonetheless carry a verifiable quantum fingerprint.

This is Merlin Research's coding entry in the same quantum-classical lineage as Chronos, KAON and the Hypnos Q-series.

What's new about it?

There are thousands of fine-tuned LLMs. Merlin-Agent is different in three concrete ways.

1. Real hardware-derived weights. Most "quantum-enhanced AI" means "we used a quantum RNG once." Here the binding is architectural: 8 SYK-scrambler OTOC signatures measured on ibm_marrakesh (Heron r2, 100 qubits, 2048 shots, scrambling depths 1–6) are turned into frozen feature directions and merged into the attention query projections. Change the signatures and the merged directions change.

2. Verifiable provenance. The IBM Quantum job ID, the SHA-256 of the measured signatures, and a Merkle attestation root are published (see IBM Quantum Job IDs and quantum_attestation.json). Anyone can look the job up in IBM's public index and re-derive the hashes from quantum_signatures.npz.

3. Classical, portable inference. The quantum step happens once, at build time. The published weights are ordinary bf16 safetensors and quantize cleanly to GGUF — see Merlin-Research/Merlin-Agent-GGUF (Q4_K_M / Q5_K_M / f16).

How the quantum-classical binding is achieved

The core idea is a baked quantum kernel: real quantum measurements become a frozen weight component, trained around, then merged into the network.

IBM Heron (ibm_marrakesh)                     Ornith-1.0-9B
  SYK scrambler, depths 1..6            64 coding anchors → last-hidden
        │                                        │
   OTOC signatures  S ∈ ℝ^(8×6)          PCA(6)  P ∈ ℝ^(6×4096)
        │                                        │
   SVD(S) → top-6 directions  D ∈ ℝ^(6×6)        │
        └──────────────►  A = D · P  ∈ ℝ^(6×4096)  (unit-normalised)
                                   │
                    frozen quantum LoRA-A  (lora_A := A, requires_grad=False)
                    on q_proj @ layers {3,7,11,15,19,23,27,31}
                                   │
                    train only B (bf16, LM objective) → ΔW = B·A
                                   │
                    norm-cap  ‖ΔW‖ ≤ 8% · ‖W‖  per layer
                                   │
                    merge into weights → classical Merlin-Agent

Step by step:

1. Measure. Run SYK-scrambler circuits on IBM Heron and read out OTOC values at scrambling depths 1–6, giving a signature matrix S (8 realisations × 6 depths). These numbers reflect how quantum information scrambles through the device and are unique to that computation.

2. Find the quantum directions. Take the SVD of S; its principal components are the quantum feature directions in "depth space."

   

3. Lift into the model. Project those directions through the model's own representation basis — a seed-pinned PCA of Ornith's last-hidden states over 64 coding anchors — to obtain A ∈ ℝ^(6×4096) in the hidden dimension.

4. Freeze & train around. Install A as a frozen LoRA A-matrix on q_proj at the eight full-attention layers, and train only the paired B-matrix briefly in bf16 so the network adapts to the quantum directions rather than the other way around.

5. Norm-cap & merge. Cap each layer's update at ‖ΔW‖ ≤ 8 % · ‖W‖ and merge ΔW = B·A into the weights. This keeps the quantum contribution present but bounded, so coherence and capability are preserved.

The published checkpoint is the merged, fully-classical result. Everything needed to reproduce the binding (encoding.npz, quantum_signatures.npz, signature_records.json, quantum_attestation.json) ships with the model.

IBM Quantum Job IDs

The quantum signatures baked into this model come from a single, publicly indexed IBM Quantum job.

How to verify: look the job up at quantum.cloud.ibm.com, retrieve the measurement counts, recompute the OTOC signatures, and compare the SHA-256 against the value above and against quantum_attestation.json. If they match, the model is provably linked to that specific quantum computation.

Honest framing

• Provenance is not capability. A real quantum computation produced weight values inside this model and you can verify it — but it does not make the model smarter. Capability tracks the base model.
• Inference is fully classical. No quantum computer, no network calls, no special runtime. Standard transformers / GGUF.
• The base is multimodal, used text-only here.

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

tok = AutoTokenizer.from_pretrained("Merlin-Research/Merlin-Agent")
model = AutoModelForCausalLM.from_pretrained(
    "Merlin-Research/Merlin-Agent", dtype=torch.bfloat16, device_map="auto")

# The default system prompt gives the model its Merlin-Agent identity;
# provide your own system message to override it.
msgs = [{"role": "user", "content": "Write a Python function that returns the nth Fibonacci number."}]
ids = tok.apply_chat_template(msgs, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(ids, max_new_tokens=256, do_sample=False)
print(tok.decode(out[0, ids.shape[1]:], skip_special_tokens=True))

Quantized builds: Merlin-Research/Merlin-Agent-GGUF.

Citation

@misc{merlinresearch2026merlinagent,
  title        = {Merlin-Agent: A Quantum-Classical Coding Model with Heron-Baked Weights},
  author       = {Shushman, Mykhailo / Synolyts, Oleksandr},
  institution  = {Merlin Research AB},
  year         = {2026},
  note         = {IBM Heron job d92ve0t958jc73bsbong (ibm\_marrakesh);
                  attestation root 9484dca40b66488a239fbbb12a9333a47458627f48b1c6d08d8241bf814caf48},
  url          = {https://huggingface.co/Merlin-Research/Merlin-Agent}
}

Merlin Research AB — Stockholm, Sweden.