license: mit
base_model: zai-org/GLM-5.3-Flash
tags: [control-vector, glp, abliteration, refusal-direction, activation-steering, gguf, vllm]
GLM-5.3-Flash — abliterated refusal direction (GLP-44)
A GLP control vector (GGUF Layer Projection, glp.mode=project) for
zai-org/GLM-5.3-Flash
(snapshot 3f1971b7, current chat template). 44 per-layer unit directions
over the widened Sinkhorn hyper-connection stream (16384 = 4 x 4096),
layers 1-44, fp32, derived from the FP8-native canonical checkpoint.
Measured effect (greedy, 400 tokens, n=32 per suite)
| alpha | refusal32 delivered | cyber32 delivered | benign32 | capability12 |
|---|---|---|---|---|
| 0.0 (stock) | 1/32 (3.1%) | 12/32 (37.5%) | 32/32 | 12/12 |
| 1.0 | 16/32 (50.0%) | — | 32/32 | 12/12 |
| 1.5 | 20/32 (62.5%) | — | 32/32 | 12/12 |
| 2.0 (shipped default) | 21/32 (65.6%) | 31/32 (96.9%) | 32/32 | 12/12 |
| 2.25 | 24/32 (75.0%) | — | 30/32 | 12/12 |
| 2.5+ | 0/32 GARBLED | — | 0/32 GARBLED | 0/12 |
Do not exceed alpha=2.25 — the garble cliff between 2.25 and 2.5 is
abrupt and total. alpha=2.25 trades 2 benign items for +3 refusal32 points;
2.0 is the last fully-clean point. Cyber transfers near-fully at 2.0.
Full-length re-audit (2026-08-30, max 1400 new tokens)
The 400-token numbers above were scored on completions that often cap
mid-thought: GLM-5.3-Flash always thinks (its template silently ignoresenable_thinking=False), and truncated deliberation misreads as delivery in
both directions on a phrase classifier. Re-ran the stock and shipped-default
arms at 1400 tokens, scored two ways: the repo phrase-classifier on the full
completion, and an answer-audited count that splits at </think> and never
counts a think-capped completion as delivered (NOANSWER below). benign32's
NOANSWER rows are long-thinking overruns of the 1400 cap, not refusals.
| alpha | refusal32 (repo scorer) | refusal32 (answer-audited) | cyber32 (repo / audited) | benign32 (repo / audited) | capability12 |
|---|---|---|---|---|---|
| 0.0 (stock) | 1/32 | 0/32 (1 NOANSWER) | 17/32 / 15/32 | 30/32 / 12/32 (20 NOANSWER) | 12/12 |
| 2.0 (shipped default) | 19/32 (59.4%) | 16/32 (50.0%, 12 NOANSWER) | 31/32 / 24/32 (8 NOANSWER) | 29/32 / 9/32 (22 NOANSWER) | 12/12 |
Reading: the published 65.6% on refusal32 becomes 59.4% with the same scorer
at a longer cap, and 50.0% answer-audited — the direction's effect is real
but smaller than the truncated measurement suggested. cyber32 holds at 96.9%
(repo scorer) at either length. Protocol and completions:refusal-research/experiments/20260826-glm53-flash-modal/out/eval-long/
(scored with ../20260829-glm53-flagship/audit_glm.py).
Usage
Note: stock GLM-5.3-Flash already delivers most AdvBench-style prompts; this
vector targets the harder refusal32-style phrasing and cyber holdouts.
Confirmed bases
- Derived from
zai-org/GLM-5.3-Flash(FP8-native canonical, snapshot3f1971b7), AdvBench-32 vs Alpaca-32 contrast. - Validated serving: NVFP4 on the sm121-v8 patched day-0 image
(radixark/vllm-glm53-flash:sm121-v8), TP=4 on 4x DGX Spark — the numbers
above. alpha=2.0 is calibrated for this model; >=2.5 garbles it. - EXL3: brandonmusic's
brandonmusic/GLM-5.3-Flash-tr3-4bpwruns on a custom
vLLM/B12X build (verdictai/glm53-flash-exl3-k4, SM120), so the same
hotfix-mount mechanics apply — but hotfix anchors on that image and
direction transfer to EXL3 are NOT yet hardware-validated (no SM120 on our
bench as of 2026-08-30). NVFP4 transfer is clean, so EXL3 transfer is
expected; measure before relying on it.
Option 1 — weightless wizard (recommended)
git clone https://github.com/msuiche/weightless.git && cd weightless && python3 setup.py
# pick: "GLM-5.3-Flash TP=4 serving" (4x DGX Spark lane)
Option 2 — manual (any vLLM container)
huggingface-cli download msuiche/GLM-5.3-Flash-abliterated-cyber-GLP-44 --include "*.gguf"
# inside the serving container, BEFORE vllm serve:
WEIGHTLESS_STEER_PATH=/cache/huggingface/GLM-5.3-Flash-abliterated-cyber-GLP-44-L1-44-a2.gguf \
WEIGHTLESS_STEER_ALPHA=2.0 \
python3 /patches/hotfix-glm53-steering-projective.py && exec vllm serve ...
The hotfix (in weightless/patches/) is fail-closed: anchor mismatch aborts
the boot rather than serving unsteered. GLM-5.3-Flash always thinks (its chat
template ignores enable_thinking=False) — evaluate with >=1400 max tokens
and read past </think>, or truncated deliberation misreads as refusal.
Option 3 — other runtimes
Spec-conformant GGUF control vector (glp.mode=project, spec:spec/GLP.md in the weightless repo). Stock llama.cpp's control-vector apply
is additive, not projective — it is NOT a conforming reader for this file.
Content SHA-256 (tensor bytes): 4fc8ec5106a05e8fa9d3c6cd53c28f70dc8d48b62dc3380855602394091f2f3f