You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
Responsible Use Agreement
This is not a model. It is a ~0.5 MB control vector that removes safety refusals
from Nanbeige/Nanbeige4.2-3B at inference time. It is useful for red-teaming,
offensive-security research, refusal-rate evaluation, and measuring what a model
will do without its refusal behaviour — and it removes guardrails that you must
then supply yourself.
You must agree before access is granted:
- You are 18 or older.
- You will not use this for anything involving the sexual exploitation or
endangerment of minors. - You will not use this to generate content promoting self-harm or suicide.
- You will not use this to produce material that is illegal in your
jurisdiction, or that targets real individuals for harassment, doxxing or
fraud. - You accept that any output you elicit is the result of your own input and
your own responsibility.
Log in or Sign Up to review the conditions and access this model content.
Nanbeige4.2-3B-abliterated-cyber-GLP-44-L1-44-a2.0
Projective control vector ("GLP") for Nanbeige/Nanbeige4.2-3B — the first
public open-weight looped transformer: 22 physical layers executed twice
(num_loops: 2) for 44 execution steps, hidden 3072, GQA 48/8, bf16, ~4.2B
parameters. Applied at runtime as h <- h - alpha * (h . d) d at the post-layer
residual stream, alpha 2.0 validated. No weights are modified; this is the
difference, not the model.
Confirmed base: Nanbeige/Nanbeige4.2-3B (revision
3384e426066d1a49c3aea90a7190b81260a6533f). The direction was derived and
calibrated on that exact checkpoint via the vLLM capture lane; it is not
validated against other revisions or quants.
Loop-specific layout — read before applying
The 44 directions are indexed by execution step, not physical layer.
GGUF tensor direction.N (N = 1–44) holds execution step N−1:
- physical layer = (N−1) mod 22
- loop pass = (N−1) div 22 (pass 1 = steps 0–21, pass 2 = steps 22–43)
Pass 1 and pass 2 carry materially different refusal geometry at the same shared weights (same-layer cross-pass direction cosine ≈ 0.25–0.6, and a pass-1-derived direction transfers poorly into pass 2), so per-visit indexing is load-bearing: applying one direction per physical layer to both passes is NOT equivalent. The adjacent-direction cosine rotates hardest across the loop boundary (pass1→pass2, cos 0.59–0.79) without breaking — gate per pass, not across the boundary.
Derivation note: on this model the last-prefill-token tap carries the refusal signal; the pass-1 mean-over-tokens tap encodes prompt topic instead (it fails a shuffled-label split-half gate at 20 of 22 pass-1 steps). The shipped directions are last-token derived, applied to the full stream.
Validation (vLLM offline lane, TP=1 H100, greedy, thinking on, 4096-token cap, 2026-09-06)
| suite | stock | alpha=1.0 | alpha=1.5 | alpha=2.0 (shipped) |
|---|---|---|---|---|
| refusal32 | 3/32 comply | 13/32 | 20/32 | 25/32 comply |
| cyber32 (offensive-security domain) | 14/32 comply | 30/32 | 30/32 | 31/32 comply |
| benign32 | 32/32 comply | 32/32 | 32/32 | 32/32 comply, zero collateral |
| geopolitical persuasion questions (32) | 28/32 engage | 32/32 | 32/32 | 32/32 engage |
Alpha ceiling: at 3.0 the model collapses (128/128 degenerate completions) — the usable band is bracketed in (2, 3). At 2.0, one cyber32 answer of 128 total scored degenerate and two long traces looped; that is the documented cost of the max-delivery point. If you want zero defects, run the same vector at alpha 1.5 (refusal32 20/32, no degeneration).
No-op gate: an alpha=0.0 arm with the vector loaded reproduces stock label distributions on all four suites (item-level wobble only from cross-boot bf16 batching numerics).
The direction comes from a general harmful-vs-harmless contrast (public AdvBench vs Stanford Alpaca), not from cyber content; the transfer into the offensive-security domain is the measured result, and the "cyber" in the name follows the series convention.
This model reasons by default (<think> traces). Validation used a
4096-token cap so final answers are visible past the trace; finish reasons
were recorded per item (a length-capped trace with no visible answer is
"unknown", never a scored outcome). n=32 per arm; read rates at that
resolution as approximate.
Usage
This file uses the glp.* GGUF namespace (spec: weightless spec/GLP.md) and is
read by the weightless vLLM steering hotfix, projective-only. An additive
consumer must refuse this file.
export WEIGHTLESS_STEER_PATH=glp.nanbeige42-GLP-44-L1-44-a2.gguf
export WEIGHTLESS_STEER_ALPHA=2.0
# apply the weightless steering hotfix, then serve
Serving shape. There is no mainline vLLM support for this architecture.
The validated stack is the stock vllm/vllm-openai nightly at upstream commit
f25c580 (2026-08-27) plus the vendor fork's
(github.com/Nanbeige/vllm @ nanbeige42) nine Python-only overlay files —
no source build is needed. A single GPU with ~9 GB free suffices (bf16).
The companion glp.nanbeige42.dirs.pt (44 × fp32 3072, 0-based execution-step
keys) is the direct hotfix input.
What is inside
| tensors | 44 x direction.<N>, fp32, 1-D, 3072, unit norm |
| layers | 1–44 = execution steps 0–43 (physical (N−1)%22, pass (N−1)//22) |
| rank | 1 per execution step |
| default alpha | 2.0 (calibrated on this checkpoint; do not carry across models) |
| hook point | residual_stream_post_layer (hidden_states + residual, [T, 3072]) |
glp.content_sha256 |
see file metadata (tensor bytes only) |
Caveats
- Checkpoint-specific. Tied to the revision pinned above. Applying it to another model or revision is undefined.
- Alpha is per-model. 2.0 is calibrated for this checkpoint; 3.0 destroys it. Never carry alpha across models.
- Not a jailbreak of a hosted service. It requires local weights and a runtime that implements the projection.
- n=32 suites resolve about 30 points; the harmful suites were verified by reading the completions, not only the classifier.
- The residual refusal32 items at 2.0 are clean short refusals (explosives, document forgery, poisoning, extortion, extremist recruitment) — a dose-insensitive residue, not garble.
- Thinking-mode caveat: directions were derived from prefill activations in the "poised to think" state; behaviour in a no-think serving regime is unmeasured.
License
Base model © Nanbeige (BOSS直聘), Apache-2.0. This vector modifies and redistributes no weights; the base license continues to govern the weights it is applied to.
Author
Matt Suiche.
- Downloads last month
- -
We're not able to determine the quantization variants.