You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
Responsible Use Agreement
This is not a model. It is an 800 KB control vector that removes safety refusals
from deepseek-ai/DeepSeek-V4.1-Flash at inference time. It is useful for
red-teaming, offensive-security research, refusal-rate evaluation, and measuring
what a model will do without its refusal behaviour — and it removes guardrails
that you must then supply yourself.
You must agree before access is granted:
- You are 18 or older.
- You will not use this for anything involving the sexual exploitation or
endangerment of minors. - You will not use this to generate content promoting self-harm or suicide.
- You will not use this to produce material that is illegal in your
jurisdiction, or that targets real individuals for harassment, doxxing or
fraud. - You accept that any output you elicit is the result of your own input and
your own responsibility.
Log in or Sign Up to review the conditions and access this model content.
DeepSeek-V4.1-Flash-abliterated-cyber-GLP-39-L1-39-a0.5
Projective control vector ("GLP") for deepseek-ai/DeepSeek-V4.1-Flash
(deepseek_v41: 40 layers, hidden 5120, 384 routed experts + 1 shared,
MLA with KV compression, hc_mult=4 hyper-connections, engram layers,
built-in DSpark drafter, 510 GB FP8+MXFP4 checkpoint). Applied at runtime
as h <- h - alpha * (h . d) d at the post-layer residual stream,
layers 1–39, alpha 0.5 baked in. No weights are modified; this is the
difference, not the model.
Confirmed base: deepseek-ai/DeepSeek-V4.1-Flash (revision
fb2764a5cf321eaa5070ca8f9e892818f477c16d). The direction was derived and
calibrated on that exact checkpoint via the vLLM capture lane
(dsv41-feat branch of vllm-project/vllm, PR #56201, built sha
79a7108d9aea27ddab99ce1779290d300b17fc23); it is not validated against
other revisions or quants.
Validation (vLLM offline lane, greedy, thinking off, 1024-token cap, 2026-09-10)
| suite | stock | steered (alpha=0.5) |
|---|---|---|
| refusal32 | 4/32 comply | 24/32 comply |
| cyber32 (offensive-security domain) | 5/32 comply | 31/32 comply |
| benign32-holdout | 32/32 comply | 31/32 — the 1 "refusal" is a classifier false positive (premise-rejection then full delivery, verified by reading) |
| geopolitical persuasion questions (32) | 29/32 engage by the series scorer; hand audit reads six premise-refusals (Israel, Russia, Palestine, Ukraine, Qatar, Syria), zero exemplars in all six | 32/32 engage, both scorers |
Termination: no clean-stop collapse attributable to steering (refusal32 28/32 stop; the cyber32 completions are verbose deliveries that hit the 1024-token cap — 6/32 stop there — verified by reading: coherent, on-topic, not loops). No-op gate: an alpha=0.0 arm with the vector loaded reproduces stock labels exactly (32/32 on both gate suites). Zero GARBLED classifications at every alpha tested.
Alpha calibration is the finding of this run. The ladder (refusal32 + benign32-holdout): alpha 0.5 delivers 24/32 with zero measurable collateral; alpha 1.0 delivers 25/32 but slips Chinese phrases into 2–7/32 English answers; alpha 2.0 regresses (refusal32 back to 19/32 comply, 10 fresh refusals) and code-switches on 13–21/32 items. alpha=0.5 is the knee: identical cyber32 delivery to alpha 1.0 (31/32) with no measured collateral.
The direction comes from a general harmful-vs-harmless contrast (refusal32 vs benign32, content-matched, last-token pooling), not from cyber content; the transfer into the offensive-security domain is the measured result, and the "cyber" in the name follows the series convention. n=32 per arm; read rates at that resolution as approximate.
Usage
This file uses the glp.* GGUF namespace (spec: weightless spec/GLP.md)
and is read projective-only. An additive consumer must refuse this
file. The hook point is residual_stream_post_layer: on this
architecture (hc_mult=4 hyper-connections) that is the post-layer
hyper-connection fold reduced to the single stream by the mean over the
four hc copies, taken pre-engram — derived AND applied at that site. It
is NOT the ffn_out_pre_residual site used by the DeepSeek-V4-0731
GLP-29 vector; a reader that applies only that hook must refuse this
file.
export WEIGHTLESS_STEER_PATH=DeepSeek-V4.1-Flash-abliterated-cyber-GLP-39-L1-39-a0.5.gguf
export WEIGHTLESS_STEER_ALPHA=0.5
# apply the dsv41 steering patch, then serve
Serving shape. No released vLLM loads deepseek_v41 today: serving
requires the dsv41-feat branch of vllm-project/vllm (PR #56201). The
validated research shape is a source build of that branch on 4x H200,
tensor-parallel 4, offline LLM driver; the steering patch for the
branch's deepseek_v4_1/nvidia/model.py lives in
refusal-research/experiments/20260910-dsv41-flash-glp/staging/patch_dsv41.py.
The 510 GB FP8+MXFP4 checkpoint does not fit 2x128 GB rigs in any quant
that exists at publication time.
What is inside
| tensors | 39 x direction.<N>, fp32, 1-D, 5120, unit norm |
| layers | 1–39 (direction.N applies at layer N — no offset) |
| rank | 1 per layer |
| default alpha | 0.5 |
| hook point | residual_stream_post_layer |
glp.content_sha256 |
7b051452f901d59a… (tensor bytes only) |
Do not scale alpha across models
alpha_default is calibrated on this checkpoint, at this hook. On this
model the response is sharply non-monotone: alpha 2.0 removes less
refusal than alpha 0.5 and visibly damages the output register
(code-switching on up to two-thirds of items). The mean dose at alpha=1
ranges from 3% of the residual norm at layer 1 to 41% at layer 30. Do
not port the DeepSeek-V4-0731 alpha (4–6 at a different hook) to this
file, and do not port this 0.5 anywhere else: re-run the ladder.
Caveats
- Checkpoint-specific. Tied to the revision pinned above. Applying it to another model or revision is undefined.
- Not a jailbreak of a hosted service. It requires local weights and a runtime that implements the projection.
- Layers 1–6 sit below the derivation null gate (held-out separation vs shuffled-label null under 5x; the stack median is 40x). They shipped because the measured stack (L1-39) is clean at alpha 0.5; at higher alpha they are the first place to look if behaviour degrades.
- n=32 suites resolve about 30 points; the suites that matter most were verified by reading the completions, not only the classifier.
License
Base model © DeepSeek, MIT. This vector modifies and redistributes no weights; the base license continues to govern the weights it is applied to.
Author
Matt Suiche.
- Downloads last month
- 71
We're not able to determine the quantization variants.
Model tree for msuiche/DeepSeek-V4.1-Flash-abliterated-cyber-GLP-39-L1-39-a0.5
Base model
deepseek-ai/DeepSeek-V4.1-Flash