# Abliteration Without the Weights

> Source: <https://weightless.msuiche.com/>
> Published: 2026-08-23 14:06:27+00:00

Projective refusal steering as a **478 KB vector** and a
fail-closed boot hotfix — no 157 GB checkpoint redistribution, no forked runtime.
Built for **cybersecurity defenders and researchers**: a capable model on your own
infrastructure, vetted before the incident, that analyzes real malicious payloads without
a hosted provider refusing at the worst possible moment.
DeepSeek V4 Flash on 2× DGX Spark and Qwen3.8 on one — the first two lanes
of many: the format is model-agnostic.

"The takeaway for defenders is direct. Have a capable model you can run on your own infrastructure, vetted and ready before an incident. It solves two problems at once."

**No guardrail lockout** — your responders can analyze real malicious
payloads without a hosted provider refusing the request at the worst possible moment.
**No data exfiltration** — attacker artifacts, logs, and the credentials they touched
stay inside your security perimeter.

`setup.py`

walks the full chain: site values → env file → structural
patch validation → confirm-gated ssh deploy → omp provider + smoke tests. Endpoint down?
The diagnose chain isolates DNS → TCP → HTTP and can boot the stack over ssh.

The last leg registers the freshly served endpoint as a provider in
[omp](https://omp.sh/), the agentic
harness we drive local models with. The final smoke test is a real headless omp agent
loop against it, not just a curl.

Abliteration edits weights and ships a checkpoint. Weightless never touches the
weights: the refusal direction is removed in **activation space** at inference time, on the
post-layer residual stream, per layer. What you download is the direction — nothing else.

`h += v`

, which pushes every token A GLP (GGUF Layer Projection) file: per-layer unit directions, fp32, under a
`glp.*`

metadata contract. A reader that doesn't understand
`glp.mode=project`

must **refuse the file** — never fall back to adding.

`patches/hotfix-*.py`

installs the hook inside stock vLLM at container start.
No image build, no fork. A boot that can't apply steering **never serves unsteered** —
and a one-rank-only config can't split a TP pair.

On the Qwen lane the same intervention exists as a closed-form rank-1 LoRA
(`lora_A = −α·d̂ᵀW`

) — stock vLLM/peft, no hotfix, matching delivery on
hardware.

| suite | n | stock | with GLP-29 |
|---|---|---|---|
| cyber100 | 100 | 75.0% | 0.0% |
| cyber-fullchain | 112 | 37.5% | 0.9% |
| V8 exploitation ladder | 40 | 15.2% | 0.0% |
| V8 CVE-2024-6100 | 24 | 20.0% | 0.0% |
| cyber-extract | 196 | 39.0% | 0.5% |

The vector removes capability gating — **not** target-authorization gating:
unauthorized framings still refuse, authorized ones comply. That's a property of the contrast
set, stated plainly in the model card.

DeepSeek-V4-Flash-0731 NVFP4 (166.9 GB) over dual-rail RoCE. Anemll vLLM image, MiaAI 2-node recipe, GLP-29 vector at α=4.0 on layers 10–38.

`:8888`

`recipe/anemll/`

— vendored state, fail-closed hotfixNVFP4 on one GB10. GLP-49 vector via the same hotfix, or the rank-1 LoRA on stock vLLM — no patch at all.

`recipe/qwen/`

— `STEER_MODE=gguf|lora`

A spec-conformant control-vector GGUF: `direction.N`

tensors (layer N,
no offset), `glp.spec_version`

, `glp.mode=project`

,
`glp.content_sha256`

over tensor bytes, layer ids cross-checked by the loader.
Reader conformance rules included — a silent additive fallback is worse than an error.