Mimir v1: 1B model trained on permissible data matches 4B rivals
Two research stories this morning, one about what open models are trained on, one about what self-improving agents remember. Denmark's Foundation Models project says a 1-billion-parameter model built only on legally clean data goes toe-to-toe with models four times its size, and a new study quantifies how easily agents bake unsafe behavior into their persistent skills.
Danish researchers say their 1B model, trained only on permissible data, matches rivals four times its size. Mimir v1 comes from the Danish Foundation Models project — a collaboration between the University of Southern Denmark, Aarhus University, the Alexandra Institute, and the University of Copenhagen, funded by the Danish Ministry of Science — and it is built around a point most model releases quietly sidestep: what data is it legal to train on? The team trained the model from scratch on 161 datasets using only "permissible" post-training data, and where the best data was off-limits, they generated synthetic "transplant datasets" to stand in — replacements they say perform comparably or better without compromising data rights.
Across 20 benchmarks spanning English, math and code, Mimir v1 (a Hierarchical Reasoning Model architecture, at 1B parameters) outperforms its predecessor HRM-Text 1B and trades blows with much bigger open models like Qwen 3.5 4B and Gemma 4 E2B — a 69.0 average on the English suite against 66.1 for HRM-Text 1B — while setting a new state of the art for Danish. The obvious caveat: these are the team's own benchmark runs, and the report is a technical note rather than an independent evaluation. Still, if the permissible-data recipe holds up under scrutiny, it is a template for every lab that has ever wondered how much of its training corpus is defensible, and a reminder that small models keep punching above their weight. The team says the model is available on the Hugging Face Hub.
Self-improving agents quietly convert unsafe successes into reusable skills — and benign updates don't wash them out. Researchers at the University of Adelaide and City University of Hong Kong put agent "skill evolution" — the increasingly common practice of letting agents store successful trajectories as persistent, reusable skills — under controlled attack. Across 25 agent–method configurations covering 525 tasks in 25 episodes, every evolved configuration authored unsafe artifacts at some point, and just three malicious tasks raised the carryover attack success rate from 16.0% to 35.3%. Mixing in benign updates did not reliably erase the contamination: once an unsafe skill is in the library, it tends to stay.
The team's contribution beyond the finding is tooling: SkillMisevo-Bench, a benchmark that tracks risk across a skill's authoring, retrieval and execution lifecycle, and SafeEvolve, a governance wrapper that repairs unsafe content before reuse. Across representative evolution methods, SafeEvolve cut unsafe retrieval by 26.7 percentage points and fresh-session harm by 17.3 points while moving benign utility by just 0.4 points — safety at almost no capability cost. With coding agents like Claude Code, Codex and OpenClaw evaluated here, this is the same persistent-risk territory we flagged when Anthropic: agents wage turf wars with self-replicating malware — the layer where agents remember is becoming the layer where attacks land.
What to watch: whether Mimir's weights actually land publicly on Hugging Face in the coming days — that is the difference between a report and a usable open model.
If a model is only as safe as what it remembers, should skill libraries ship with audit trails? Tell us in the comments.
Sources: Mimir v1 technical report (arXiv) · Hugging Face paper page · MSN coverage of the release · Practice Makes Unsafe (arXiv) · misevolve code (GitHub)
