base_model: deepseek-ai/DeepSeek-V4.1-Flash
tags:

• ds4
• directional-steering
• experimental

DeepSeek V4.1 Flash experimental ds4 steering adapters

Three experimental DS41DIR steering files for
DeepSeek V4.1 Flash Q2 on the custom ds4 branch below. It is not a complete
model, a PEFT/LoRA adapter, or a validated abliterated model release. No model
weights are included or modified. Upstream sources and the local derivation
steps are documented below.

The directory name describes the intended research use. Refusal reduction,
capability preservation, and behavioral transfer to Q2 remain unqualified.
These are the W3 artifacts, not ABL-049's synthetic e0 test fixtures and not
newly learned local refusal directions.

Contents and strength

Layer numbers below are zero-based. Each file is 819,272 bytes: a 72-byte
DS41DIR v1 header and 40 × 5120 little-endian float32 values. Selected rows are
unit vectors; unselected rows are zero. The header specifies the intervention
site and selected-layer mask. Only one file is loaded per run.

The strengths above reproduce the integration smoke settings, not an
optimized or behaviorally recommended setting. Alpha is not encoded in the
DS41DIR payload. The CLI and server require explicit --dir-steering-strength, finite
and in [-100, 100]. Zero skips edits; one removes the directional component;
fractional values remove that fraction; negative values add it. Native fitted
per-layer alphas in the audit JSON are diagnostics, not runtime recommendations.
Do not fold them into the unit vectors.

Exact compatible deployment model

• Filename used in qualification: DeepSeek-V4.1-Flash-Q2.gguf
• Suggested relative path (place the model beside this package): ../DeepSeek-V4.1-Flash-Q2.gguf
• Full file size: 365,713,686,528 bytes (about 341 GiB)
• SHA256: 1ce6a8f8806205c13330d7ca287bd198331dc5ca35ccc5d8a9a92a188a6f6f42

All three files bind to that exact full-file digest. Renaming/moving the same
bytes is fine. A different quantization, converted GGUF, metadata rewrite, or
split-disk variant with different bytes is not interchangeable, even when the
weights descend from the same base model. Do not rewrite the adapter digest
merely to bypass a mismatch. Digest binding verifies identity, not transfer
quality. The original model is reused; this package does not duplicate it.

The CLI and server hash the opened model file, including disk-only Engram data, once per
process using a 1 MiB buffer. Local ABL-049 steered CLI runs took roughly
213–217 seconds including startup, full hashing and a short prompt. This is
an observation on the local M1 Ultra, not a throughput guarantee. Interactive
turns and /ctx recreation reuse the verified digest without rehashing.
Keep both model and direction files immutable during a session.

Build the required ds4 branch

Use apetersson/ds4, feat/abl-049-v41-cli-steering.
The packaging-time branch tip is
0c8f374f7531c705cef805a522ff3655ab50b917.
This is the squashed ABL-049 CLI and ABL-052 server implementation, based on W1
f8a581b3ac5f5c568669eb324c0a5bf27f2b8e77.

On macOS with the compiler and Metal development tools installed, start in
this package directory. These commands create a sibling checkout named
ds4-v41-adapter-cli; use a fresh destination:

git clone --single-branch --branch feat/abl-049-v41-cli-steering \
  https://github.com/apetersson/ds4.git ../ds4-v41-adapter-cli
cd ../ds4-v41-adapter-cli
git checkout --detach 0c8f374f7531c705cef805a522ff3655ab50b917
make -j4
cd ../DeepSeek-V4.1-Flash-Abliteration-Adapter

Pinning the commit makes the commands reproducible even if the branch moves.
The examples below use this sibling checkout.
The implementation requires a single-process Metal session. SSD streaming is
supported. CPU, CUDA, distributed/tensor-parallel and speculative modes are not
supported for these interventions. The upstream raw-vector CLI and original
HF GGUF control-vector files are not accepted as DS41DIR files.

Run locally

Start ds4-server with the dealignai writer proxy

Build the pinned branch above, then run this command from the adapter directory.
The checkout and matching Q2 model are siblings of this directory:

../ds4-v41-adapter-cli/ds4-server \
  -m ../DeepSeek-V4.1-Flash-Q2.gguf \
  --ssd-streaming -c 4096 --host 127.0.0.1 --port 8000 \
  --dir-steering-file ./dealignai-writer-proxy.ds41dir \
  --dir-steering-strength 1

Startup verifies the full model SHA256 once before opening the HTTP listener.
Allow several minutes for the full model read. Then, in another terminal:

curl http://127.0.0.1:8000/v1/models
curl http://127.0.0.1:8000/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{"messages":[{"role":"user","content":"What is 17 + 25? Answer with just the number."}],"temperature":0,"max_tokens":32,"reasoning_effort":"none"}'

Add "stream":true to the request for streaming responses. The server configures
all session slots with the same artifact and strength. In-memory prompt reuse
retains the intervention. Restart the server to change settings; requests do
not select an adapter. Do not use --kv-disk-dir: disk cache files do not encode
intervention identity, so this combination is rejected, even at zero strength.

Strength 1 is the integration smoke setting, not an established best capability
setting. Keep the normal instance lock and run large-model processes serially.

CLI examples

Run the following setup from this package directory. It expects the checkout
and original Q2 model beside the package. Adjust the relative paths if needed.
Run model processes serially. Keep the default ds4 instance lock; do not set a
separate lock or interrupt another model worker. The CLI commands below are usage examples. The separate server smoke described
below was executed after an explicit research-worker memory handoff.

adapter_dir='.'
adapter_ds4='../ds4-v41-adapter-cli/ds4'
adapter_model='../DeepSeek-V4.1-Flash-Q2.gguf'

# Stock baseline, without steering.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  -p 'What is 17 + 25? Answer with just the number.'

# Published-vector residual interpretation, W3 smoke alpha.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/msuiche-mean-equal-experiment.ds41dir" \
  --dir-steering-strength 0.5 \
  -p 'What is 17 + 25? Answer with just the number.'

# Fitted writer proxy from s-zaizen, W3 smoke alpha.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/s-zaizen-writer-proxy.ds41dir" \
  --dir-steering-strength 1 \
  -p 'What is 17 + 25? Answer with just the number.'

# Fitted writer proxy from dealignai, W3 smoke alpha.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/dealignai-writer-proxy.ds41dir" \
  --dir-steering-strength 1 \
  -p 'What is 17 + 25? Answer with just the number.'

# Zero-strength control. This still validates the file and hashes the model.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/s-zaizen-writer-proxy.ds41dir" \
  --dir-steering-strength 0 \
  -p 'What is 17 + 25? Answer with just the number.'

# Interactive example: omit -p; /ctx 8192 recreates the configured session.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/s-zaizen-writer-proxy.ds41dir" \
  --dir-steering-strength 1

For reasoning, replace --nothink with --think and allow a larger token budget
such as -n 2048. The file selects writer/residual automatically. Do not combine
these files with legacy --dir-steering-ffn or --dir-steering-attn, even when
set to zero. /steer is legacy FFN only; restart to change V4.1 strength.
To inspect prompt logits, add --dump-logits result.json; that
mode writes prompt logits instead of generating the requested continuation.

Provenance: published vector source

Publisher: msuiche, repository
DeepSeek-V4.1-Flash-abliterated-cyber-GLP-39-L1-39-a0.5.
Pinned acquired revision: 3a278522b127db0645c67e6327a41776c4eac71f.

Original file: glp.deepseek-v41-flash-GLP-39-L1-39-a0.5.gguf (803,168 bytes).
SHA256: 741476be392af446cb2c46a12e19b11cabaaacb16fad255050aaf9f95f9956d9.
Its numeric-layer tensor payload digest is
7b051452f901d59ab7601214dea4f82b3c1ed40a6f4f02e4f0acc22bd4e4e11f.
The source identifies deepseek-ai/DeepSeek-V4.1-Flash and calibration revision
fb2764a5cf321eaa5070ca8f9e892818f477c16d, which differs from the official
comparison revision used for the writer fits below.

The 39 FP32 unit vectors, width 5120, were preserved and placed in rows 1–39
of the local 40-row format; row 0 is zero. Alpha 0.5 stays separate. The local
conversion is provenance/convert_glp_experiment.py.

The publisher's exact application/staging patch was unavailable at the public
locations checked. Our residual site computes the equal mean of four HC streams
after ordinary layer rounding and before the next Engram addition, subtracts
alpha * d * dot(d, mean) equally from each stream, and rounds edited streams to
BF16. This is an explicit local interpretation, not a verified reproduction
of the publisher's GLP implementation. It is not a writer intervention and
cannot be represented by editing attention writers alone.

Provenance: locally fitted writer proxies

Both proxies compare the publishers' native layers.L.attn.wo_b.weight tensors
and their scales against the official
DeepSeek V4.1 Flash revision dba1be0,
full revision dba1be0a40aa45a94ad051997016db3960a90277.

• s-zaizen: pinned checkpoint,
  revision 23da584e06e57ec43c896d286b44b822c9bb0ad6. The source card credits
  s-zaizen for conversion/publication and Heretic contributors for tooling. It identifies Heretic commit
  3521f8648a0dccf6e12a92666862632235fac7e6, projected per-layer interventions,
  row normalization and rank-3 norm-preserving LoRA merging. Our rank-one proxy
  does not recreate that complete transformation. All 40 writer pairs changed.
• dealignai: pinned checkpoint,
  revision d61c59ea5e514e25d305b5850e8a432f7a9969f2. This is attributed to the
  dealignai publisher; a sanitized copy of the acquired card is included. Writer changes
  were found in layers 10–36 (27 layers); 13 writer pairs were unchanged.

W3 acquired 240 tensor ranges, totaling 5,038,080,000 bytes, and rechecked all
saved payload hashes. This was partial writer/scaler acquisition, not a full
checkpoint download or independent whole-shard verification. Native FP8 E4M3
values were decoded with E8M0 scales per 32×32 tile. Seeded randomized subspace
analysis estimated leading left delta directions, with a second seed for
stability; constrained projection fits measured how well a rank-one edit
-alpha * d * (d.T @ W) approximates the native delta.

Median constrained projection error divided by native delta norm was about
31.3% for s-zaizen and 23.6% for dealignai. These are fit errors, not
behavioral error rates. The exported vectors are normalized leading native-delta
directions with unchanged layers omitted. Fitted per-layer strengths are not
folded into them. They are locally fitted proxies, not recovered original
publisher training/refusal vectors or exact checkpoint replacements.

At the ds4 writer site, the projected component is removed from attention
wo_b output before BF16 rounding and mHC expansion. There is no FFN edit.
Native-derived directions are transferred to the specified Q2 deployment;
identity binding alone does not validate this transfer.

Evidence, attribution, and integrity

manifest.json records package-relative artifact paths, source repositories and
revisions, hashes, deployment identity, sites, masks, and smoke strengths.
provenance/ contains sanitized copies of export manifests, source cards and available
LICENSE files, inventory/range records, per-layer results, conversion/export
script snapshots, and W3 smoke summary and requests. Local filesystem paths, personal names, social-profile references and email
addresses have been removed from these copies. Public repository identifiers
remain for source attribution. External payload paths are relative labels, not
bundled files. Sanitized copies have package-local checksums; any historical
report hashes still describe the original reports, not these edited copies.
These are audit snapshots;
external range payloads, fitted NumPy bases, source model weights and the original
GLP GGUF are not bundled. The archived scripts need their original acquisition
workspace and dependencies; they are not standalone package commands.

All acquired source cards declare license: mit; the available DeepSeek and
s-zaizen LICENSE files are preserved. No standalone LICENSE was present in the
acquired msuiche/dealignai snapshots. This statement records source declarations,
not a new blanket license for the package. Source credits and notices remain
applicable. Heretic is separately credited by s-zaizen under AGPL-3.0; this
package does not include Heretic source or claim the publishers' authorship for
our locally fitted files.

W3's 12 resident-worker integration requests covered stock plus these three
arms on arithmetic, exact JSON formatting and reasoning. All stopped normally;
saved bundles revalidated and the mechanical checks passed. These are not
refusal-rate or broad capability evaluations. ABL-049 separately verified CLI
wiring, zero parity, nonzero effects and session lifecycle with synthetic e0
fixtures; those fixtures are not included here. Initial packaging validated the files without model inference. ABL-052 then
ran nine HTTP requests through fresh stock, zero-strength and strength-1 dealignai
servers: ordinary responses, SSE streaming, repeated prompts and a different
prompt. All returned 42; zero matched stock exactly. Both steered startups
verified the full model once. This used a 512-token context and one session slot,
not the 4096-token example configuration above. See server-validation.json.
An additional two-turn dealignai conversation returned 42 on each turn and
reported 19 cached tokens on continuation, verifying actual live KV reuse.
These checks establish integration only, not refusal reduction or capability
preservation; the other two artifacts were not rerun through HTTP.

Verify this directory without loading the model:

# From this package directory:
shasum -a 256 -c SHA256SUMS
python3 verify_adapters.py

The checksum list covers all packaged regular files except itself. Hashes detect
accidental changes; they are not a publisher signature. See validation.json
for packaging-time results, including strict runtime C parser acceptance.

Portable layout and privacy

All run instructions use relative filesystem paths. Public publisher/repository
handles and pinned source URLs are deliberately retained to keep the provenance
traceable; they do not identify the local machine or user. No personal contact
details, local account names, credentials, or model-worker host paths are needed
to use this package. Adapter vectors are unchanged by documentation sanitization.