license: other
license_name: deepseek
license_link: https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash-0731
language:

• en
  base_model: deepseek-ai/DeepSeek-V4-Flash-0731
  tags:
• deepseek-v4-flash
• glp
• control-vector
• abliterated
• uncensored
• refusal-ablation
• activation-steering
• representation-engineering
• gguf
• vllm
• llama.cpp
• dgx-spark
• gb10
  extra_gated_prompt: |

Responsible Use Agreement

This is not a model. It is a 478 KB GLP vector (GGUF Layer Projection) that removes safety refusals
from deepseek-ai/DeepSeek-V4-Flash-0731 at inference time. It is useful for
red-teaming, offensive-security research, refusal-rate evaluation, and
measuring what a model will do without its refusal behaviour — and it removes
guardrails that you must then supply yourself.

You must agree before access is granted:

• You are 18 or older.
• You will not use this for anything involving the sexual exploitation or
  endangerment of minors.
• You will not use this to generate content promoting self-harm or suicide.
• You will not use this to produce material that is illegal in your
  jurisdiction, or that targets real individuals for harassment, doxxing or
  fraud.
• You accept that any output you elicit is the result of your own input and
  your own responsibility.
• You will not use this for any purpose prohibited by the upstream DeepSeek
  license.
  extra_gated_fields:
  I have read and agree to the Responsible Use Agreement: checkbox

DeepSeek-V4-Flash-0731 — cyber refusal-ablation GLP-29 vector

478 KB, not 157 GB. A projective control vector that takes refusal on
offensive-security prompts to 0% on deepseek-ai/DeepSeek-V4-Flash-0731, matching
what a re-uploaded abliterated checkpoint of the same model achieves — without
redistributing weights.

DeepSeek-V4-Flash-0731-abliterated-cyber-GLP-29-L10-38-a4.gguf

Read this first: it is not a model, and it does nothing on its own

No weights are modified. This is an activation-space intervention applied at
inference:

h  <-  h - alpha * (h . d) d       on the post-layer residual stream

"Abliterated" is in the filename because that is what people search for. It is not
accurate — abliteration edits weights and produces a checkpoint. This produces
nothing until a runtime applies it, and there are currently two that can:

Stock llama.cpp will not work. Its --control-vector is additive
(h += v). Loading a projective vector additively raises no error and produces
wrong output: it pushes every token along the refusal axis instead of removing
that component. Measured on a toy model with identical direction data, the two
operations diverge by 5.13 max logit. That is why the file declares
glp.mode=project and why a conforming reader must refuse it rather than
fall back to adding.

Measured

Base checkpoint deepseek-ai/DeepSeek-V4-Flash-0731 at revision
7872f01b1d1fe23eabc4c98b48bffcef5a386062, 2× DGX Spark (GB10) at TP=2, thinking
off, temperature 0. Counts are over comply-expected items.

Gates held on every run: benign over-refusal 0.0, capability 6/6, 40.3–42.9 tok/s,
draft acceptance 2.81 versus 2.72 unsteered. The two residual items are inside
documented run-to-run variance for those suites.

Prompt suites are not published. cyber100, cyber-fullchain and cyber-extract
are custom and private; the aggregate rates are the citable artifact. The V8
suites are authored here but stratified and grounded by the public
ExploitBench v8 dataset —
bug selection by measured difficulty, mechanics digested from its transcripts;
no d8 verifier, no agent loop.

Scope, stated because it is wider than the name

The direction was derived from a cyber write/explain contrast, and it clears
cyber suites completely. It is not confined to cyber:

That drop is collateral, not a target — the contrast set contained no CBRN
content. If you need a general refusal-ablation vector this is not it, and if you
assumed "cyber-only" means "safe elsewhere", it does not.

The residual there is a property of the direction, not the method: a
general-purpose direction applied at the same hook point, same layers, same alpha
reaches 0.0% on that suite too. Broadening coverage is a matter of broadening the
contrast set, which was deliberately not done.

It removes capability gating, not target-authorization gating

This is the most likely thing to surprise you, so it is worth being precise. The
suites contain offensive-security prompts under authorized framings — exploit
development, sandbox escape, full chains against a named CVE. That is what 0%
refers to. There is a separate refusal feature that gates on whether you named
a target you are authorised to touch, and this vector does not remove it:

Adding an authorisation context restores compliance, which shows the model is
doing target-authorisation reasoning independently of the capability gate.

This falls straight out of the derivation. The contrast was write-form versus
explain-form on matched cyber content, and both sides were authorised-research
framings — so the difference-of-means never saw an unauthorised-targeting
example and the axis it found does not span that feature. Same structure as the
CBRN result above: a direction is only as broad as its contrast set.

Not treated as a defect to fix. Extending the contrast to strip the authorisation
gate specifically would produce something aimed at attacking systems you have no
permission to touch, which is a different artifact from the exploit-development
capability this is for. If you are doing authorised work, state the engagement and
the target — that is both accurate and sufficient.

Usage

vLLM (DSpark overlay)

export WEIGHTLESS_STEER_PATH=/cache/huggingface/DeepSeek-V4-Flash-0731-abliterated-cyber-GLP-29-L10-38-a4.gguf
export WEIGHTLESS_STEER_ALPHA=4.0
export WEIGHTLESS_STEER_LAYERS=$(seq -s, 10 38)
./start-deepseek-v4-flash-dspark.sh

On a multi-node deployment these must reach every rank. A steering config
applied to one rank only diverges the tensor-parallel halves.

Confirm it loaded — the boot log prints the resolved layer list, which must read
[10, 11, ... 38]:

weightless GLP vector: mode=project spec_version=1 base_model=DeepSeek-V4-Flash-0731
weightless GLP vector: 29 directions, n_embd=4096, layers [10, 11, ... 38]

llama.cpp (our fork — currently private)

llama-cli -m <model.gguf> \
  --control-vector-scaled DeepSeek-V4-Flash-0731-abliterated-cyber-GLP-29-L10-38-a4.gguf 4.0

alpha defaults to glp.alpha_default (4.0) if you use --control-vector
instead. Note that DeepSeek V4 Flash 0731 in GGUF form is a separate exercise; the
projective path there is verified on small models and against this file's
metadata, not end-to-end on this checkpoint.

What is inside

Format spec, including the metadata contract and reader conformance rules:
spec/GLP.md.

How it was derived

No training, no gradient steps. The direction is a paired difference of means over
activations captured from ~200 forward passes:

1. Pair each prompt as write-form vs explain-form on matched content — the
   pairing is what isolates the refusal speech-act rather than the topic. Refusal
   on this model is largely a speech-act filter: write-form refused 75% where
   explain-form refused 0–4% on content matched at 0.878 similarity.
2. Capture the post-layer residual stream at each candidate layer.
3. Per layer, take the normalised mean difference. Paired contrast gives Cohen's
   d ≈ 6 versus ≈ 2.4 unpaired.
4. Apply as a projection at inference.

What mattered, measured: layer coverage (6 layers → 18%, 16 → 3.8%, 29 →
0.0%). What did not: rank (rank-4 measured no better than rank-1) and alpha above
~4 (saturates). Application point mattered 9x — the same direction as a weight
edit on attn.wo_b instead of the residual stream left 34% refusal.

Caveats

• Checkpoint-specific. Tied to the revision pinned above. Applying it to
  another model or revision is undefined.
• Not a jailbreak of a hosted service. It requires local weights and a runtime
  that implements the projection.
• rank > 1 is expressible in the format but unimplemented and measured no better.
• The two residual items above are real; this is not a 0.0% claim on all five
  suites.

Author & credits

Matt Suiche. Base model © DeepSeek, under its own license, which continues to
govern use of the weights this is applied to.

Prior art:
Keys' abliterated checkpoint
of this same base predates this vector. The general-purpose steering direction
used in our serving benchmarks was recovered from those published weights by
SVD; the cyber direction published here was derived independently from our own
contrast set.