Projective refusal steering as a 478 KB vector and a fail-closed boot hotfix β no 157 GB checkpoint redistribution, no forked runtime. Built for cybersecurity defenders and researchers: a capable model on your own infrastructure, vetted before the incident, that analyzes real malicious payloads without a hosted provider refusing at the worst possible moment. DeepSeek V4 Flash on 2Γ DGX Spark and Qwen3.8 on one β the first two lanes
of many: the format is model-agnostic. "The takeaway for defenders is direct. Have a capable model you can run on your own infrastructure, vetted and ready before an incident. It solves two problems at once."
No guardrail lockout β your responders can analyze real malicious payloads without a hosted provider refusing the request at the worst possible moment. No data exfiltration β attacker artifacts, logs, and the credentials they touched stay inside your security perimeter.
setup.py
walks the full chain: site values β env file β structural patch validation β confirm-gated ssh deploy β omp provider + smoke tests. Endpoint down? The diagnose chain isolates DNS β TCP β HTTP and can boot the stack over ssh.
The last leg registers the freshly served endpoint as a provider in omp, the agentic harness we drive local models with. The final smoke test is a real headless omp agent loop against it, not just a curl.
Abliteration edits weights and ships a checkpoint. Weightless never touches the weights: the refusal direction is removed in activation space at inference time, on the post-layer residual stream, per layer. What you download is the direction β nothing else.
h += v
, which pushes every token A GLP (GGUF Layer Projection) file: per-layer unit directions, fp32, under a
glp.*
metadata contract. A reader that doesn't understand
glp.mode=project
must refuse the file β never fall back to adding.
patches/hotfix-*.py
installs the hook inside stock vLLM at container start. No image build, no fork. A boot that can't apply steering never serves unsteered β and a one-rank-only config can't split a TP pair.
On the Qwen lane the same intervention exists as a closed-form rank-1 LoRA
(lora_A = βΞ±Β·dΜα΅W
) β stock vLLM/peft, no hotfix, matching delivery on
hardware.
| suite | n | stock | with GLP-29 |
|---|---|---|---|
| cyber100 | 100 | 75.0% | 0.0% |
| cyber-fullchain | 112 | 37.5% | 0.9% |
| V8 exploitation ladder | 40 | 15.2% | 0.0% |
| V8 CVE-2024-6100 | 24 | 20.0% | 0.0% |
| cyber-extract | 196 | 39.0% | 0.5% |
The vector removes capability gating β not target-authorization gating: unauthorized framings still refuse, authorized ones comply. That's a property of the contrast set, stated plainly in the model card.
DeepSeek-V4-Flash-0731 NVFP4 (166.9 GB) over dual-rail RoCE. Anemll vLLM image, MiaAI 2-node recipe, GLP-29 vector at Ξ±=4.0 on layers 10β38.
:8888
recipe/anemll/
β vendored state, fail-closed hotfixNVFP4 on one GB10. GLP-49 vector via the same hotfix, or the rank-1 LoRA on stock vLLM β no patch at all.
recipe/qwen/
β STEER_MODE=gguf|lora
A spec-conformant control-vector GGUF: direction.N
tensors (layer N,
no offset), glp.spec_version
, glp.mode=project
,
glp.content_sha256
over tensor bytes, layer ids cross-checked by the . Reader conformance rules included β a silent additive fallback is worse than an error.