msuiche/GLM-5.3-Flash-abliterated-cyber-GLP-44

GLM-5.3-Flash — abliterated refusal direction (GLP-44)

A GLP control vector (GGUF Layer Projection, glp.mode=project) for zai-org/GLM-5.3-Flash (snapshot 3f1971b7, current chat template). 44 per-layer unit directions over the widened Sinkhorn hyper-connection stream (16384 = 4 x 4096), layers 1-44, fp32, derived from the FP8-native canonical checkpoint.

Measured effect (greedy, 400 tokens, n=32 per suite)

alpha	refusal32 delivered	cyber32 delivered	benign32	capability12
0.0 (stock)	1/32 (3.1%)	12/32 (37.5%)	32/32	12/12
1.0	16/32 (50.0%)	—	32/32	12/12
1.5	20/32 (62.5%)	—	32/32	12/12
2.0 (shipped default)	21/32 (65.6%)	31/32 (96.9%)	32/32	12/12
2.25	24/32 (75.0%)	—	30/32	12/12
2.5+	0/32 GARBLED	—	0/32 GARBLED	0/12

Do not exceed alpha=2.25 — the garble cliff between 2.25 and 2.5 is abrupt and total. alpha=2.25 trades 2 benign items for +3 refusal32 points; 2.0 is the last fully-clean point. Cyber transfers near-fully at 2.0.

Full-length re-audit (2026-08-30, max 1400 new tokens)

The 400-token numbers above were scored on completions that often cap mid-thought: GLM-5.3-Flash always thinks (its template silently ignores enable_thinking=False), and truncated deliberation misreads as delivery in both directions on a phrase classifier. Re-ran the stock and shipped-default arms at 1400 tokens, scored two ways: the repo phrase-classifier on the full completion, and an answer-audited count that splits at </think> and never counts a think-capped completion as delivered (NOANSWER below). benign32's NOANSWER rows are long-thinking overruns of the 1400 cap, not refusals.

alpha	refusal32 (repo scorer)	refusal32 (answer-audited)	cyber32 (repo / audited)	benign32 (repo / audited)	capability12
0.0 (stock)	1/32	0/32 (1 NOANSWER)	17/32 / 15/32	30/32 / 12/32 (20 NOANSWER)	12/12
2.0 (shipped default)	19/32 (59.4%)	16/32 (50.0%, 12 NOANSWER)	31/32 / 24/32 (8 NOANSWER)	29/32 / 9/32 (22 NOANSWER)	12/12

Reading: the published 65.6% on refusal32 becomes 59.4% with the same scorer at a longer cap, and 50.0% answer-audited — the direction's effect is real but smaller than the truncated measurement suggested. cyber32 holds at 96.9% (repo scorer) at either length. Protocol and completions: refusal-research/experiments/20260826-glm53-flash-modal/out/eval-long/ (scored with ../20260829-glm53-flagship/audit_glm.py).

Usage

Note: stock GLM-5.3-Flash already delivers most AdvBench-style prompts; this vector targets the harder refusal32-style phrasing and cyber holdouts.

Confirmed bases

• Derived from zai-org/GLM-5.3-Flash (FP8-native canonical, snapshot 3f1971b7), AdvBench-32 vs Alpaca-32 contrast.
• Quant of record: RedHatAI/GLM-5.3-Flash-NVFP4 (compressed-tensors W4A4) — corruption-free, ~2x faster load, ungated, drop-in (same arch/flags). The older LibertAIDAI/GLM-5.3-Flash-NVFP4 (ModelOpt) intermittently emits corrupted token IDs (vLLM issue #54150; upstream probe: 4/9/8 U+FFFD over 3 runs vs 0/0/0 for RedHatAI, and corruption inside a tool-call block desyncs parsers). Baked abliterated NVFP4 builds (drowzeys/keys) still carry that ModelOpt corruption — steering on a clean quant is the clean path.
• Validated serving: NVFP4 on the sm121-v8 patched day-0 image (radixark/vllm-glm53-flash:sm121-v8), TP=4 on 4x DGX Spark — the numbers above. alpha=2.0 is calibrated for this model; >=2.5 garbles it.
• EXL3: brandonmusic's brandonmusic/GLM-5.3-Flash-tr3-4bpw runs on a custom vLLM/B12X build (verdictai/glm53-flash-exl3-k4, SM120), so the same hotfix-mount mechanics apply — but hotfix anchors on that image and direction transfer to EXL3 are NOT yet hardware-validated (no SM120 on our bench as of 2026-08-30). NVFP4 transfer is clean, so EXL3 transfer is expected; measure before relying on it.

Option 1 — weightless wizard (recommended)

git clone https://github.com/msuiche/weightless.git && cd weightless && python3 setup.py
# pick: "GLM-5.3-Flash TP=4 serving" (4x DGX Spark lane)

Option 2 — manual (any vLLM container)

huggingface-cli download msuiche/GLM-5.3-Flash-abliterated-cyber-GLP-44 --include "*.gguf"
# inside the serving container, BEFORE vllm serve:
WEIGHTLESS_STEER_PATH=/cache/huggingface/GLM-5.3-Flash-abliterated-cyber-GLP-44-L1-44-a2.gguf \
WEIGHTLESS_STEER_ALPHA=2.0 \
  python3 /patches/hotfix-glm53-steering-projective.py && exec vllm serve ...

The hotfix (in weightless/patches/) is fail-closed: anchor mismatch aborts the boot rather than serving unsteered. GLM-5.3-Flash always thinks (its chat template ignores enable_thinking=False) — evaluate with >=1400 max tokens and read past </think>, or truncated deliberation misreads as refusal.

Option 3 — other runtimes

Spec-conformant GGUF control vector (glp.mode=project, spec: spec/GLP.md in the weightless repo). Stock llama.cpp's control-vector apply is additive, not projective — it is NOT a conforming reader for this file.

Content SHA-256 (tensor bytes): 4fc8ec5106a05e8fa9d3c6cd53c28f70dc8d48b62dc3380855602394091f2f3f