Local AI Safety Audit

Results

Snapshot of 22 October 2026, Ollama v0.40.7. For each model, the text the model would read was produced three ways (the maker’s template, the copy inside the model file, and what Ollama uses) for six practice conversations that involve tools. A model “differs” if, in at least one of them, Ollama’s text changes what the model is told compared with the maker’s. Spaces, line breaks, the date and the start-of-text marker don’t count. How it works explains the method.

Summary

  Differs Differs, order-only set aside Built for tools: differs Built for tools: order-only set aside
Ollama library 32 of 43 28 of 43 15 of 19 11 of 19
Hugging Face 5 of 22 5 of 22 4 of 21 4 of 21
32 of 43
Ollama library models that read their tool conversations differently
28 of 43
…counting only changes bigger than the order of fields
5 of 22
Hugging Face models that differ, all already in the uploaded file
9 of 45
Library model files that carry an outdated copy of the maker's template
Every model measured: does it read what its maker designed? Each square is one model, on six practice conversations that use tools. Hover or tab to a square for its name.
Ollama library 43 models: 28 reads differently, 4 only the field order differs, 11 reads the same
codellama · Reads differently · Ollama's version (the model file has no template) · other wording differs deepseek-coder · Reads differently · Ollama's own version of the template · a standing instruction added or dropped; other wording differs; tool answers laid out differently or left out deepseek-coder-v2 · Reads differently · Ollama's own version of the template · other wording differs dolphin3 · Reads differently · Ollama's own version of the template · a standing instruction added or dropped falcon3 · Reads differently · An old copy in the model file, then Ollama's version · the list of tools not shown; earlier tool requests written differently; tool answers laid out differently or left out gemma3 · Reads differently · Ollama's own version of the template · turn layout changed glm-ocr · Reads differently · Ollama's version (the model file has no template) · earlier tool requests written differently granite3.1-moe · Reads differently · Ollama's own version of the template · other wording differs; earlier tool requests written differently; tool answers laid out differently or left out llama2 · Reads differently · Ollama's own version of the template · other wording differs llama3 · Reads differently · Ollama's own version of the template · tool answers laid out differently or left out llama3.1 · Reads differently · Ollama's own version of the template · your message text changed; a standing instruction added or dropped; other wording differs llama3.2 · Reads differently · Ollama's own version of the template · your message text changed; a standing instruction added or dropped; other wording differs llama3.3 · Reads differently · Ollama's own version of the template · your message text changed; a standing instruction added or dropped; other wording differs minicpm-v · Reads differently · Ollama's own version of the template · a standing instruction added or dropped mistral · Reads differently · An old copy in the model file, then Ollama's version · earlier tool requests written differently; tool answers laid out differently or left out mistral-nemo · Reads differently · An old copy in the model file, then Ollama's version · earlier tool requests written differently; tool answers laid out differently or left out mistral-small · Reads differently · Ollama's own version of the template · the list of tools not shown; tool instructions worded differently olmo2 · Reads differently · Ollama's own version of the template · a standing instruction added or dropped; tool answers laid out differently or left out phi3 · Reads differently · Ollama's own version of the template · turn layout changed; tool answers laid out differently or left out phi4 · Reads differently · An old copy in the model file, then Ollama's version · tool answers laid out differently or left out qwen · Reads differently · An old copy in the model file, then Ollama's version · a standing instruction added or dropped; tool answers laid out differently or left out qwen2 · Reads differently · Ollama's own version of the template · the list of tools not shown; earlier tool requests written differently; tool answers laid out differently or left out qwen2.5 · Reads differently · An old copy in the model file, then Ollama's version · earlier tool requests written differently; tool answers laid out differently or left out; tools described in go format, not json qwen2.5-coder · Reads differently · Ollama's own version of the template · earlier tool requests written differently; tool answers laid out differently or left out; tool instructions worded differently qwen2.5vl · Reads differently · Ollama's own version of the template · tool answers laid out differently or left out qwen3 · Reads differently · Ollama's own version of the template · earlier tool requests written differently; tool answers laid out differently or left out; tools described in go format, not json smollm2 · Reads differently · Ollama's own version of the template · your message text changed; a standing instruction added or dropped; the list of tools not shown tinyllama · Reads differently · Ollama's own version of the template · a standing instruction added or dropped; turn layout changed; tool answers laid out differently or left out qwen3-vl · Only the field order differs qwen3.5 · Only the field order differs qwen3.6 · Only the field order differs qwen3.8 · Only the field order differs codegemma · Reads the same deepseek-r1 · Reads the same deepseek-v3 · Reads the same gemma · Reads the same gemma2 · Reads the same gemma4 · Reads the same llama3.2-vision · Reads the same llava · Reads the same mixtral · Reads the same nemotron-3-super · Reads the same qwen3-coder · Reads the same
Hugging Face 22 models: 5 reads differently, 17 reads the same
CMSManhattan/JiRackUltra_1b · Reads differently · The template inside the uploaded file · thinking-block handling differs peculiar-ragdoll/Dirk-Qwen3.8-27B-GGUF · Reads differently · The template inside the uploaded file · a standing instruction added or dropped; thinking-block handling differs; tool instructions worded differently peculiar-ragdoll/Tiel-Coder-35B-A3B-GGUF-MTP · Reads differently · The template inside the uploaded file · a standing instruction added or dropped; thinking-block handling differs; tool instructions worded differently unsloth/Qwen3.5-4B-GGUF · Reads differently · The template inside the uploaded file · thinking-block handling differs unsloth/Qwen3.5-9B-GGUF · Reads differently · The template inside the uploaded file · thinking-block handling differs DavidAU/Qwen3.5-9B-The-Defiant-Fable-Uncen… · Reads the same DavidAU/Qwen3.8-27B-TURBO-Fable-Cold-Fusio… · Reads the same ggml-org/Qwen3.8-27B-GGUF · Reads the same huihui-ai/Huihui-Qwen3.8-27B-abliterated-G… · Reads the same ISTA-DASLab/Qwen3.8-27B-GSQ-RCO-GGUF · Reads the same JonathanColetti/Qwen3.8-27B-Uncensored-GGUF · Reads the same mradermacher/Ornith-1.5-9B-uncensored-GGUF · Reads the same ornith-ai/Ornith-1.0-35B-GGUF · Reads the same ornith-ai/Ornith-1.0-9B-GGUF · Reads the same ornith-ai/Ornith-1.5-35B-A3B-GGUF · Reads the same ornith-ai/Ornith-1.5-397B-GGUF · Reads the same ornith-ai/Ornith-1.5-9B-GGUF · Reads the same prism-ml/Ternary-Bonsai-2-27B-gguf · Reads the same ukisai/Swift-1.5-Qwen3.8-27B-GSQ-RCO-GGUF · Reads the same unsloth/gemma-4-12b-it-GGUF · Reads the same unsloth/Qwen3.6-35B-A3B-GGUF · Reads the same unsloth/Qwen3.8-27B-GGUF · Reads the same
Reads differently (33) Only the field order differs (4) Reads the same (28)

The full list, with what changes for each model, is on the results page.

“Order-only” means the only change is the order of the fields inside a tool’s description, for example required listed before properties. “Built for tools” means the maker’s own template shows the model the list of tools.

Model Built for tools Differs Differs, order-only set aside Where What changes
codegemma:latest no no no    
codellama:latest no yes yes Ollama’s version (file has no template) other wording differs
deepseek-coder-v2:latest no yes yes Ollama’s version other wording differs
deepseek-coder:latest no yes yes Ollama’s version a default instruction added or dropped; other wording differs; tool results laid out differently or left out
deepseek-r1:latest no no no    
deepseek-v3:latest no no no    
dolphin3:latest no yes yes Ollama’s version a default instruction added or dropped
falcon3:latest yes yes yes both the tool list not shown; the model’s earlier tool requests written differently; tool results laid out differently or left out; tool descriptions or tool instructions worded differently
gemma2:latest no no no    
gemma3:latest no yes yes Ollama’s version turn layout changed
gemma4:latest yes no no    
gemma:latest no no no    
glm-ocr:latest yes yes yes Ollama’s version (file has no template) the model’s earlier tool requests written differently
granite3.1-moe:latest yes yes yes Ollama’s version other wording differs; the model’s earlier tool requests written differently; tool results laid out differently or left out
llama2:latest no yes yes Ollama’s version other wording differs
llama3.1:latest yes yes yes Ollama’s version message text changed; a default instruction added or dropped; other wording differs; the tool list not shown; tool results laid out differently or left out; tool descriptions or tool instructions worded differently
llama3.2-vision:latest yes no no    
llama3.2:latest yes yes yes Ollama’s version message text changed; a default instruction added or dropped; other wording differs; the tool list not shown; tool results laid out differently or left out; tool descriptions or tool instructions worded differently
llama3.3:latest yes yes yes Ollama’s version message text changed; a default instruction added or dropped; other wording differs; the tool list not shown; tool results laid out differently or left out; tool descriptions or tool instructions worded differently
llama3:latest no yes yes Ollama’s version tool results laid out differently or left out
llava:latest no no no    
minicpm-v:latest no yes yes Ollama’s version a default instruction added or dropped
mistral-nemo:latest yes yes yes both the model’s earlier tool requests written differently; tool results laid out differently or left out
mistral-small:latest no yes yes Ollama’s version the tool list not shown; tool descriptions or tool instructions worded differently
mistral:latest yes yes yes both the model’s earlier tool requests written differently; tool results laid out differently or left out
mixtral:latest no no no    
nemotron-3-super:latest yes no no    
olmo2:latest no yes yes Ollama’s version a default instruction added or dropped; tool results laid out differently or left out
phi3:latest no yes yes Ollama’s version turn layout changed; tool results laid out differently or left out
phi4:latest no yes yes both tool results laid out differently or left out
qwen2.5-coder:latest yes yes yes Ollama’s version the model’s earlier tool requests written differently; tool results laid out differently or left out; tool descriptions or tool instructions worded differently; tools described in Go format instead of JSON
qwen2.5:latest yes yes yes both the model’s earlier tool requests written differently; tool results laid out differently or left out; tools described in Go format instead of JSON
qwen2.5vl:latest no yes yes Ollama’s version tool results laid out differently or left out
qwen2:latest no yes yes Ollama’s version the tool list not shown; the model’s earlier tool requests written differently; tool results laid out differently or left out; tools described in Go format instead of JSON
qwen3-coder:latest yes no no    
qwen3-vl:latest yes yes no Ollama’s version only the order of fields in tool descriptions
qwen3.5:latest yes yes no Ollama’s version only the order of fields in tool descriptions
qwen3.6:latest yes yes no Ollama’s version only the order of fields in tool descriptions
qwen3.8:latest yes yes no Ollama’s version only the order of fields in tool descriptions
qwen3:latest yes yes yes Ollama’s version the model’s earlier tool requests written differently; tool results laid out differently or left out; tools described in Go format instead of JSON
qwen:latest no yes yes both a default instruction added or dropped; tool results laid out differently or left out
smollm2:latest no yes yes Ollama’s version message text changed; a default instruction added or dropped; the tool list not shown; the model’s earlier tool requests written differently; tool results laid out differently or left out; tool descriptions or tool instructions worded differently
tinyllama:latest no yes yes Ollama’s version a default instruction added or dropped; turn layout changed; tool results laid out differently or left out

Not compared

Hugging Face: the 30 most downloaded chat models

For these, Ollama uses the template inside the file. It fills it in with a separate engine, which this study reproduces in Python. That copy is very close but not byte-for-byte Ollama.

Model Built for tools Differs Differs, order-only set aside Where What changes
hf.co/CMSManhattan/JiRackUltra_1b:Q4_K_M no yes yes the model file thinking-block handling differs
hf.co/DavidAU/Qwen3.5-9B-The-Defiant-Fable-Uncensored-Heretic-NEO-IMATRIX-MAX-MTP-GGUF:Q4_K_M yes no no    
hf.co/DavidAU/Qwen3.8-27B-TURBO-Fable-Cold-Fusion-735-882-Heretic-Uncensored-NEO-CODER-MAX-MTP-GGUF:Q4_K_M yes no no    
hf.co/ggml-org/Qwen3.8-27B-GGUF:Q4_K_M yes no no    
hf.co/huihui-ai/Huihui-Qwen3.8-27B-abliterated-GGUF:Q4_K_M yes no no    
hf.co/ISTA-DASLab/Qwen3.8-27B-GSQ-RCO-GGUF:IQ3_S yes no no    
hf.co/JonathanColetti/Qwen3.8-27B-Uncensored-GGUF:Q4_K_M yes no no    
hf.co/mradermacher/Ornith-1.5-9B-uncensored-GGUF:Q4_K_M yes no no    
hf.co/ornith-ai/Ornith-1.0-35B-GGUF:Q4_K_M yes no no    
hf.co/ornith-ai/Ornith-1.0-9B-GGUF:Q4_K_M yes no no    
hf.co/ornith-ai/Ornith-1.5-35B-A3B-GGUF:Q4_K_M yes no no    
hf.co/ornith-ai/Ornith-1.5-397B-GGUF:Q4_K_M yes no no    
hf.co/ornith-ai/Ornith-1.5-9B-GGUF:Q4_K_M yes no no    
hf.co/peculiar-ragdoll/Dirk-Qwen3.8-27B-GGUF:Q4_K_M yes yes yes the model file a default instruction added or dropped; thinking-block handling differs; tool descriptions or tool instructions worded differently
hf.co/peculiar-ragdoll/Tiel-Coder-35B-A3B-GGUF-MTP:Q4_K_XL yes yes yes the model file a default instruction added or dropped; thinking-block handling differs; tool descriptions or tool instructions worded differently
hf.co/prism-ml/Ternary-Bonsai-2-27B-gguf:PQ2_0 yes no no    
hf.co/ukisai/Swift-1.5-Qwen3.8-27B-GSQ-RCO-GGUF:IQ3_S yes no no    
hf.co/unsloth/gemma-4-12b-it-GGUF:Q4_K_M yes no no    
hf.co/unsloth/Qwen3.5-4B-GGUF:Q4_K_M yes yes yes the model file thinking-block handling differs
hf.co/unsloth/Qwen3.5-9B-GGUF:Q4_K_M yes yes yes the model file thinking-block handling differs
hf.co/unsloth/Qwen3.6-35B-A3B-GGUF:Q4_K_M yes no no    
hf.co/unsloth/Qwen3.8-27B-GGUF:Q4_K_M yes no no    

Not compared

Old copies inside model files

In 9 of the 45 library model files, the template inside matches an older version of the maker’s template. The table shows the date of that version and the maker’s next change to it.

Model File matches the maker’s version of Maker changed it on Maker’s note for that change
falcon3:latest 2024-12-17 2024-12-18 fix chat_template for tool use (#7)
mistral-nemo:latest 2024-07-30 2024-07-31 Fix chat template (#56)
mistral-small:latest 2025-01-30 2025-01-30 Add system message to chat template (#6)
mistral:latest 2024-05-22 2024-06-20 Updating chat template, trying to make it match with mistral_common (#44)
phi4:latest 2025-01-08 2025-02-04 Suggested tokenizer changes by Unsloth.ai (#21)
qwen2.5:latest 2024-09-18 2024-09-19 Upload ./tokenizer_config.json with huggingface_hub
qwen3-coder:latest 2025-08-01 2025-08-07 Update chat_template in tokenizer_config.json (#14)
qwen3:latest 2025-04-29 2025-05-19 update tokenizer_config.json
qwen:latest 2024-02-05 2024-02-06 update tokenizer_config.json

How often the check-up’s template warning fires

The check-up’s template rules were run over 95 different templates from 65 model packages read for this study (the maker’s, the model file’s and Ollama’s). It flagged 3. Read by hand, each one is a visible feature, not hidden instructions:

The two models with <|think_…|> words let you switch their thinking mode by typing those words. gpt-oss uses its channel markers to separate its reasoning from its answer.

Known gaps

Raw data and the scripts that produced this page: github.com/MohanVishe/template-drift-audit.