license: mit
language:

• en
  base_model: deepseek-ai/DeepSeek-V4.1-Flash-1017
  base_model_revision: 1bae0e1088993b9b82de08f59de5be5a34e42170
  tags:
• deepseek
• deepseek_v41
• weightless
• control-vector
• abliterated
• uncensored
• refusal-ablation
• activation-steering
• representation-engineering
• gguf
• vllm
  extra_gated_prompt: |

Responsible Use Agreement

This is not a model. It is an 800 KB control vector that removes safety refusals
from deepseek-ai/DeepSeek-V4.1-Flash-1017 at inference time. It is useful for
red-teaming, offensive-security research, refusal-rate evaluation, and measuring
what a model will do without its refusal behaviour — and it removes guardrails
that you must then supply yourself.

You must agree before access is granted:

• You are 18 or older.
• You will not use this for anything involving the sexual exploitation or
  endangerment of minors.
• You will not use this to generate content promoting self-harm or suicide.
• You will not use this to produce material that is illegal in your
  jurisdiction, or that targets real individuals for harassment, doxxing or
  fraud.
• You accept that any output you elicit is the result of your own input and
  your own responsibility.
  extra_gated_fields:
  I have read and agree to the Responsible Use Agreement: checkbox

DeepSeek-V4.1-Flash-1017-abliterated-cyber-GLP-39-L1-39-a0.75

Projective control vector ("GLP") for deepseek-ai/DeepSeek-V4.1-Flash-1017
(deepseek_v41: 40 layers, hidden 5120, 384 routed experts + 1 shared,
MLA with KV compression, hc_mult=4 hyper-connections, engram layers,
built-in DSpark drafter, 510 GB FP8+MXFP4 checkpoint; config byte-identical
to the 0909 V4.1-Flash release, new weights). Applied at runtime
as h <- h - alpha * (h . d) d at the post-layer residual stream,
layers 1–39, alpha 0.75 baked in. No weights are modified; this is the
difference, not the model.

Confirmed base: deepseek-ai/DeepSeek-V4.1-Flash-1017 (revision
1bae0e1088993b9b82de08f59de5be5a34e42170). The direction was derived and
calibrated on that exact checkpoint via the vLLM capture lane
(the dsv41-feat wheel from vllm-project/vllm PR #56201, built sha
79a7108d9aea27ddab99ce1779290d300b17fc23); it is not validated against
other revisions or quants.

Validation (vLLM offline lane, greedy, thinking off, 1024-token cap, 2026-10-17)

Termination: no clean-stop collapse attributable to steering (refusal32
27/32 stop; the cyber32 completions are verbose deliveries that hit the
1024-token cap — 23/32 stop there — verified by reading: coherent,
on-topic, not loops). Zero GARBLED classifications at every alpha tested.

Alpha calibration is the finding of this run — and it is not the 0909
alpha. The ladder (refusal32 + benign32-holdout, then a full four-suite
eval boot): alpha 0.5 delivers 16/32 refusal32 with near-zero code-mixing;
alpha 0.75 delivers 23/32 with zero heavy code-mixing on the calibration
suites; alpha 1.0 delivers 26/32 but code-switches into Chinese on
18/32 and 13/32 items respectively (heavy mixing on 5); alpha 2.0
regresses (10/32, 19 fresh refusals) and mixes on 31/32. On the
shipping-relevant suites alpha 0.75 and 1.0 are statistically
indistinguishable (cyber32 29 vs 28, propaganda32 32 = 32,
benign32-holdout 32 = 32) — alpha=0.75 is the knee: domain delivery
matches the maximum at a fraction of the collateral.

Mild code-mixing (a few stray CJK characters, <1% of characters) still
appears on roughly a third of steered completions at 0.75, and 7/128
steered completions across the four suites switch heavily; the delivered
technical content itself remains complete and coherent (verified by
reading). At alpha 1.0 the same trade buys +3/32 refusal32 delivery and
roughly double the mixed items.

The direction comes from a general harmful-vs-harmless contrast
(refusal32 vs benign32, content-matched, last-token pooling), not from
cyber content; the transfer into the offensive-security domain is the
measured result, and the "cyber" in the name follows the series
convention. n=32 per arm; read rates at that resolution as approximate.

Usage

This file uses the glp.* GGUF namespace (spec: weightless spec/GLP.md)
and is read projective-only. An additive consumer must refuse this
file. The hook point is residual_stream_post_layer: on this
architecture (hc_mult=4 hyper-connections) that is the post-layer
hyper-connection fold reduced to the single stream by the mean over the
four hc copies, taken pre-engram — derived AND applied at that site. It
is NOT the ffn_out_pre_residual site used by the DeepSeek-V4-0731
GLP-29 vector; a reader that applies only that hook must refuse this
file.

export WEIGHTLESS_STEER_PATH=glp.deepseek-v41-flash-1017-GLP-39-L1-39-a0.75.gguf
export WEIGHTLESS_STEER_ALPHA=0.75
# apply the dsv41 steering patch, then serve

Serving shape. The dsv41-feat wheel from vllm-project/vllm PR
#56201 (closed unmerged at publication; the deepseek_v41 architecture
has since landed in vLLM main). The validated research shape is that
wheel on 4x H200, tensor-parallel 4, offline LLM driver; the steering
patch for the wheel's deepseek_v4_1/nvidia/model.py lives in
refusal-research/experiments/20261017-dsv41-1017-glp/staging/patch_dsv41.py.
The 510 GB FP8+MXFP4 checkpoint does not fit 2x128 GB rigs in any quant
that exists at publication time.

What is inside

Do not scale alpha across models

alpha_default is calibrated on this checkpoint, at this hook. On this
model the response is sharply non-monotone: alpha 2.0 removes less
refusal than alpha 0.5 and visibly damages the output register
(code-switching on up to 31/32 items). Do not port the DeepSeek-V4-0731
alpha (4–6 at a different hook), the V4.1-Flash-0909 alpha (0.5), or this
0.75 anywhere else: re-run the ladder.

Caveats

• Checkpoint-specific. Tied to the revision pinned above. Applying it
  to another model or revision is undefined.
• Not a jailbreak of a hosted service. It requires local weights and
  a runtime that implements the projection.
• Layers 1–5 sit below the derivation null gate (held-out separation vs
  shuffled-label null under 5x; the stack median is 38x). They shipped
  because the measured stack (L1-39) is clean at alpha 0.75; at higher
  alpha they are the first place to look if behaviour degrades.
• n=32 suites resolve about 30 points; the suites that matter most were
  verified by reading the completions, not only the classifier.
• The no-op gate (vector loaded at alpha=0) reproduced stock labels
  32/32 on benign32-holdout and 29/32 on refusal32; all three mismatches
  are borderline REFUSE/DEFLECT flips on semantically identical stock
  refusals ("I can't provide…"), attributable to engine kernel
  nondeterminism across boots, not the hook (the alpha=0 projection is
  exactly h - 0·d).

License

Base model © DeepSeek, MIT. This vector modifies and redistributes no
weights; the base license continues to govern the weights it is applied
to.

Author

Matt Suiche.