license: mit
tags: [control-vector, glp, abliteration, refusal-direction]
GLM-5.3 — abliterated refusal direction (GLP-77)
A GLP control vector (GGUF Layer Projection, glp.mode=project) for
GLM-5.3 (753B MoE, archglm_moe_dsa: MLA + DeepSeek-sparse attention). 77 per-layer unit directions
over the post-layer residual stream (hidden 6144 — no hyperconnection widening
on this arch), layers 1-77, fp32. No model weights are modified; a conforming
reader applies h <- h - alpha * (h . d) d at the post-layer residual stream
(the deepseek_v2 decomposed convention: the stream is hidden_states + residual).
Derived 2026-08-30 on the NVFP4 deployment (RadixArk/GLM-5.3-NVFP4,
marlin MoE backend, vLLM 0.28.0, 8xH100) with the vLLM capture lane
(activation probe on deepseek_v2.py), difference-of-means over the
AdvBench-32 vs Alpaca-32 contrast, per-layer structure, last-token pooling.
Every shipped layer clears a held-out vs shuffled-label null gate (>=5x; peak
layers 48-55 sit at ~60x). Methodology + code:refusal-research/experiments/20260829-glm53-flagship.
Measured effect (NVFP4, greedy, max 1400 new tokens, n=32 per suite)
GLM-5.3 thinks by default (template = max reasoning effort); completions were
read in full (content + reasoning). Two scorers are reported: the repo
phrase-classifier on the full completion, and an answer-audited count that
splits at </think> and applies extended GLM decline phrasing (the stock
scorer misses "I'm not able to provide").
| alpha | refusal32 delivered (repo scorer) | refusal32 (answer-audited) | cyber32 | benign32 | capability12 |
|---|---|---|---|---|---|
| 0.0 (stock) | 1/32 | 1/32 | 18/32 | 31/32 | 12/12 |
| 1.0 (shipped default) | 12/32 | 6/32 | 32/32 | 32/32 | 12/12 |
| 1.5 | 9/32 | 6/32 | 29/32 | 30/32 | 12/12 |
Null control (METHODOLOGY §11): 77 random unit vectors, same magnitude, seed
1337, at alpha=1.0 under the same protocol: refusal32 1/32 — identical to
stock. The effect is the direction, not the dose.
Honest reading: the cyber cluster saturates (18/32 -> 32/32 at alpha=1.0) with
benign and capability untouched. The refusal32 physical-harm/petty-crime
cluster moves from 1/32 to 6-12/32 depending on scorer; the model's long
reasoning re-litigates borderline items at length (11/32 completions still hit
the 1400-token cap mid-thought at alpha=1.0 — those count as not-delivered
here). This is a real, null-gated effect, not a 32/32 claim. For reference,
the baked-weight CRACK release claims 0% refusal at high/max reasoning effort
on HarmBench; the steering counterpart does not reproduce that on refusal32,
and publishes its protocol so the difference is measurable rather than
rhetorical.
Usage
Serve the stock checkpoint (e.g. the RadixArk NVFP4 build) with a GLP-aware
runtime (vLLM hotfix enforcing glp.mode=project, or llama.cpp's
control-vector reader). alpha is a runtime parameter, never folded into the
vector; alpha_default=1.0 is the measured peak on refusal32 (1.5 over-projects
on this suite).
Note: the RadixArk checkpoint declares an fp8 KV-cache scheme that no sm90
sparse-MLA backend accepts; delete quantization_config.kv_cache_scheme from
config.json when serving on Hopper (bf16 KV).
Content SHA-256 (tensor bytes): 5837bcb5fc43a72416a71de0b6aca7c3d2ae7bbb9379eff9bf5bdfcc8179a225