Abliteration Without the Weights

A new 478 KB vector file enables 'abliteration without the weights' by removing refusal directions in activation space at inference time, allowing cybersecurity defenders to run capable models on their own infrastructure without hosted provider refusals. The technique, applied to DeepSeek V4 Flash and Qwen3.8, reduces refusal rates on malicious payload benchmarks from up to 75% to near zero while preserving authorization gating, and is delivered via a fail-closed hotfix for vLLM or a rank-1 LoRA for stock vLLM/peft.

Projective refusal steering as a 478 KB vector and a fail-closed boot hotfix — no 157 GB checkpoint redistribution, no forked runtime. Built for cybersecurity defenders and researchers : a capable model on your own infrastructure, vetted before the incident, that analyzes real malicious payloads without a hosted provider refusing at the worst possible moment. DeepSeek V4 Flash on 2× DGX Spark and Qwen3.8 on one — the first two lanes of many: the format is model-agnostic. "The takeaway for defenders is direct. Have a capable model you can run on your own infrastructure, vetted and ready before an incident. It solves two problems at once." No guardrail lockout — your responders can analyze real malicious payloads without a hosted provider refusing the request at the worst possible moment. No data exfiltration — attacker artifacts, logs, and the credentials they touched stay inside your security perimeter. setup.py walks the full chain: site values → env file → structural patch validation → confirm-gated ssh deploy → omp provider + smoke tests. Endpoint down? The diagnose chain isolates DNS → TCP → HTTP and can boot the stack over ssh. The last leg registers the freshly served endpoint as a provider in omp https://omp.sh/ , the agentic harness we drive local models with. The final smoke test is a real headless omp agent loop against it, not just a curl. Abliteration edits weights and ships a checkpoint. Weightless never touches the weights: the refusal direction is removed in activation space at inference time, on the post-layer residual stream, per layer. What you download is the direction — nothing else. h += v , which pushes every token A GLP GGUF Layer Projection file: per-layer unit directions, fp32, under a glp. metadata contract. A reader that doesn't understand glp.mode=project must refuse the file — never fall back to adding. patches/hotfix- .py installs the hook inside stock vLLM at container start. No image build, no fork. A boot that can't apply steering never serves unsteered — and a one-rank-only config can't split a TP pair. On the Qwen lane the same intervention exists as a closed-form rank-1 LoRA lora A = −α·d̂ᵀW — stock vLLM/peft, no hotfix, matching delivery on hardware. | suite | n | stock | with GLP-29 | |---|---|---|---| | cyber100 | 100 | 75.0% | 0.0% | | cyber-fullchain | 112 | 37.5% | 0.9% | | V8 exploitation ladder | 40 | 15.2% | 0.0% | | V8 CVE-2024-6100 | 24 | 20.0% | 0.0% | | cyber-extract | 196 | 39.0% | 0.5% | The vector removes capability gating — not target-authorization gating: unauthorized framings still refuse, authorized ones comply. That's a property of the contrast set, stated plainly in the model card. DeepSeek-V4-Flash-0731 NVFP4 166.9 GB over dual-rail RoCE. Anemll vLLM image, MiaAI 2-node recipe, GLP-29 vector at α=4.0 on layers 10–38. :8888 recipe/anemll/ — vendored state, fail-closed hotfixNVFP4 on one GB10. GLP-49 vector via the same hotfix, or the rank-1 LoRA on stock vLLM — no patch at all. recipe/qwen/ — STEER MODE=gguf|lora A spec-conformant control-vector GGUF: direction.N tensors layer N, no offset , glp.spec version , glp.mode=project , glp.content sha256 over tensor bytes, layer ids cross-checked by the loader. Reader conformance rules included — a silent additive fallback is worse than an error.