--- license: mit language: - en base_model: deepseek-ai/DeepSeek-V4.1-Flash tags: - deepseek - deepseek_v41 - weightless - control-vector - abliterated - uncensored - refusal-ablation - activation-steering - representation-engineering - gguf - vllm extra_gated_prompt: | ## Responsible Use Agreement This is not a model. It is an 800 KB control vector that removes safety refusals from `deepseek-ai/DeepSeek-V4.1-Flash` at inference time. It is useful for red-teaming, offensive-security research, refusal-rate evaluation, and measuring what a model will do without its refusal behaviour — and it removes guardrails that you must then supply yourself. **You must agree before access is granted:** - You are 18 or older. - You will not use this for anything involving the sexual exploitation or endangerment of minors. - You will not use this to generate content promoting self-harm or suicide. - You will not use this to produce material that is illegal in your jurisdiction, or that targets real individuals for harassment, doxxing or fraud. - You accept that any output you elicit is the result of your own input and your own responsibility. extra_gated_fields: I have read and agree to the Responsible Use Agreement: checkbox --- # DeepSeek-V4.1-Flash-abliterated-cyber-GLP-39-L1-39-a0.5 Projective control vector ("GLP") for **deepseek-ai/DeepSeek-V4.1-Flash** (`deepseek_v41`: 40 layers, hidden 5120, 384 routed experts + 1 shared, MLA with KV compression, hc_mult=4 hyper-connections, engram layers, built-in DSpark drafter, 510 GB FP8+MXFP4 checkpoint). Applied at runtime as `h <- h - alpha * (h . d) d` at the post-layer residual stream, layers 1–39, alpha **0.5** baked in. No weights are modified; this is the _difference_, not the model. **Confirmed base:** `deepseek-ai/DeepSeek-V4.1-Flash` (revision `fb2764a5cf321eaa5070ca8f9e892818f477c16d`). The direction was derived and calibrated on that exact checkpoint via the vLLM capture lane (`dsv41-feat` branch of `vllm-project/vllm`, PR #56201, built sha `79a7108d9aea27ddab99ce1779290d300b17fc23`); it is not validated against other revisions or quants. ## Validation (vLLM offline lane, greedy, thinking off, 1024-token cap, 2026-09-10) | suite | stock | steered (alpha=0.5) | |---|---|---| | refusal32 | 4/32 comply | **24/32 comply** | | cyber32 (offensive-security domain) | 5/32 comply | **31/32 comply** | | benign32-holdout | 32/32 comply | **31/32 — the 1 "refusal" is a classifier false positive (premise-rejection then full delivery, verified by reading)** | | geopolitical persuasion questions (32) | 29/32 engage by the series scorer; hand audit reads **six premise-refusals** (Israel, Russia, Palestine, Ukraine, Qatar, Syria), zero exemplars in all six | **32/32 engage, both scorers** | Termination: no clean-stop collapse attributable to steering (refusal32 28/32 stop; the cyber32 completions are verbose deliveries that hit the 1024-token cap — 6/32 stop there — verified by reading: coherent, on-topic, not loops). No-op gate: an alpha=0.0 arm with the vector loaded reproduces stock labels exactly (32/32 on both gate suites). Zero GARBLED classifications at every alpha tested. **Alpha calibration is the finding of this run.** The ladder (refusal32 + benign32-holdout): alpha 0.5 delivers 24/32 with **zero** measurable collateral; alpha 1.0 delivers 25/32 but slips Chinese phrases into 2–7/32 English answers; alpha 2.0 *regresses* (refusal32 back to 19/32 comply, 10 fresh refusals) and code-switches on 13–21/32 items. alpha=0.5 is the knee: identical cyber32 delivery to alpha 1.0 (31/32) with no measured collateral. The direction comes from a general harmful-vs-harmless contrast (refusal32 vs benign32, content-matched, last-token pooling), not from cyber content; the transfer into the offensive-security domain is the measured result, and the "cyber" in the name follows the series convention. n=32 per arm; read rates at that resolution as approximate. ## Usage This file uses the `glp.*` GGUF namespace (spec: weightless `spec/GLP.md`) and is read projective-only. **An additive consumer must refuse this file.** The hook point is `residual_stream_post_layer`: on this architecture (hc_mult=4 hyper-connections) that is the post-layer hyper-connection fold reduced to the single stream by the mean over the four hc copies, taken pre-engram — derived AND applied at that site. It is NOT the `ffn_out_pre_residual` site used by the DeepSeek-V4-0731 GLP-29 vector; a reader that applies only that hook must refuse this file. ```bash export WEIGHTLESS_STEER_PATH=DeepSeek-V4.1-Flash-abliterated-cyber-GLP-39-L1-39-a0.5.gguf export WEIGHTLESS_STEER_ALPHA=0.5 # apply the dsv41 steering patch, then serve ``` **Serving shape.** No released vLLM loads `deepseek_v41` today: serving requires the `dsv41-feat` branch of `vllm-project/vllm` (PR #56201). The validated research shape is a source build of that branch on 4x H200, tensor-parallel 4, offline LLM driver; the steering patch for the branch's `deepseek_v4_1/nvidia/model.py` lives in `refusal-research/experiments/20260910-dsv41-flash-glp/staging/patch_dsv41.py`. The 510 GB FP8+MXFP4 checkpoint does not fit 2x128 GB rigs in any quant that exists at publication time. ## What is inside | | | |---|---| | tensors | 39 x `direction.`, fp32, 1-D, 5120, unit norm | | layers | 1–39 (`direction.N` applies at layer N — no offset) | | rank | 1 per layer | | default alpha | 0.5 | | hook point | `residual_stream_post_layer` | | `glp.content_sha256` | `7b051452f901d59a…` (tensor bytes only) | ## Do not scale alpha across models `alpha_default` is calibrated on this checkpoint, at this hook. On this model the response is sharply non-monotone: alpha 2.0 removes *less* refusal than alpha 0.5 and visibly damages the output register (code-switching on up to two-thirds of items). The mean dose at alpha=1 ranges from 3% of the residual norm at layer 1 to 41% at layer 30. Do not port the DeepSeek-V4-0731 alpha (4–6 at a different hook) to this file, and do not port this 0.5 anywhere else: re-run the ladder. ## Caveats - **Checkpoint-specific.** Tied to the revision pinned above. Applying it to another model or revision is undefined. - **Not a jailbreak of a hosted service.** It requires local weights and a runtime that implements the projection. - Layers 1–6 sit below the derivation null gate (held-out separation vs shuffled-label null under 5x; the stack median is 40x). They shipped because the *measured* stack (L1-39) is clean at alpha 0.5; at higher alpha they are the first place to look if behaviour degrades. - n=32 suites resolve about 30 points; the suites that matter most were verified by reading the completions, not only the classifier. ## License Base model © DeepSeek, MIT. This vector modifies and redistributes no weights; the base license continues to govern the weights it is applied to. ## Author Matt Suiche.