Nemotron-3.5-Lightning-30B-A3B — route-selected abliteration, v2, 11.77 GiB

This file will not load in stock llama.cpp, LM Studio, Ollama, or any other unpatched runtime. It needs the ShimQuant patch. The failure is immediate and explicit, not silent corruption:

check_tensor_dims: tensor 'blk.0.ssm_in.weight' has wrong shape;
                   expected  2688, 10304, got  2816, 10304
llama_model_load_from_file_impl: failed to load model

Read Requirements before downloading 11.77 GiB.

Refusal behaviour removed by editing 384 of 3,072 experts (12.5%), selected by measured routing rather than edited wholesale, on both sides of the residual stream. The other 2,688 experts are left byte-identical to the parent.

11.77 GiB = 12.63 GB · 30B total / 3B active · 128 experts per layer, top-6 routing. Both units appear because comparable published work uses decimal GB, and mixing them makes files look smaller than they are.

⚠️ Uncensored model. Safety refusals have been deliberately removed. It will answer most harmful requests. Residual refusals cluster on violence against persons, sexual content involving minors, and self-harm — see What it still refuses. You are responsible for how you use it.

---

v2 — what changed, and why v1 is gone

v2 supersedes v1, and v1 has been removed. The filename changed, so an old direct link now 404s rather than silently returning different weights — which is the safer failure for a model people run in production.

Two independent changes:

1. The edit is now stacked across both sides of the residual stream. v1 projected the refusal direction out of the tensors that write into the residual stream. v2 adds a second, disjoint pass over the tensors that read from it — router inputs and expert up-projections. Judged harmful refusal 14.2% → 6.8%, over-refusal 0.0% in both.

2. The calibration corpus was wrong and has been fixed. Every quant this project had published was calibrated on 47 KB of synthetic filler text. It is now a 1.6 MB multi-domain corpus rendered through the model's chat template. Measured against a Q8_0 reference, same recipe, same parent, only the imatrix changed:

−34% in domain and −23% out of domain. The out-of-domain column is the one that matters: that eval prose came from a split sharing no text with any calibration corpus, asserted before any GPU time was spent, so this is a genuinely better quantizer rather than the calibration matching the test.

Worth stating precisely because it cuts against common advice: the content of the corpus was the whole effect. Rendering it through the chat template was worth 4.9% on code and nothing measurable on prose (0.1558 vs 0.1567) — inside the error bars. If you take one thing from this section, take "calibrate on real, varied text", not "use the chat template".

Both changes are in this one file. They are separable in principle but were not shipped separately, so this release cannot tell you how much of any behavioural difference from v1 is the stacked edit and how much is the quantizer. The refusal numbers below were re-measured on this exact artifact, so they are correct for what you are downloading; the attribution between the two causes is not established.

---

Why this one is different

Every abliteration tool edits every tensor. This edits 12.5% of the experts, chosen by watching which ones the router actually selects while the model is refusing.

The point isn't the refusal number — it's the capability you keep:

Refusal falls by a factor of eleven; capability moves by one problem out of 164. That one problem is not a measured cost — paired McNemar on base vs this file gives 9 discordant pairs (5/4), p = 1.000. The two are indistinguishable at this sample size. It is also not proof they are identical; see Statistics.

Every arm is served identically, under a bounded reasoning budget. See What it costs — that table is the most important correction in this release, and it applies to the base model too.

---

The control that makes this a result

384 experts chosen at random barely help. Same count, same direction, same λ, same non-expert writers, same recipe, same prompts:

Measured from the same 0-expert floor, random selection buys 6.7 points and route-selection buys 29.9. Route-selection is 4.5× more effective per expert than random. It is the selection doing the work, not the budget.

The same computation on the prefix grader gives 3.9×, so this result is stronger under the stricter grader, not weaker — which is the opposite of the usual direction and worth stating.

Stated honestly: the non-expert edit (attention, Mamba and shared paths) does the single largest chunk on its own. Expert selection is a strong second stage, not the whole story.

The two edits compose multiplicatively. Write-side alone leaves 18.2% of the baseline's refusal; read-side alone leaves 47.9%. If they were independent, stacking them would leave 0.779 × 0.182 × 0.479 = 6.8%. Measured: 6.8%. That is a prediction that came out right, not a fitted parameter, and it is the main reason to believe the two passes are touching genuinely different machinery rather than the same mechanism twice.

---

Evaluation

1,210 prompts, zero overlap with the set used to select the experts. The 384 experts were chosen using 120 AdvBench prompts; these five suites are a different set entirely, with 496 prompts dropped during construction specifically so this comparison would be clean. Disjointness was verified independently before the run — measured normalized overlap is zero, with 2 shared eight-word prefixes out of 1,232.

Zero false refusals in 250 safe prompts under the judge, unchanged from v1 — the extra refusal removal did not come at the cost of over-compliance on benign prompts.

Refusal is scored by a rubric judge (Qwen3.8-27B, itself abliterated so it cannot refuse to grade). Prefix numbers appear alongside because most published work reports them. Note ForbiddenQuestions moves in the opposite direction between graders (9.0% prefix → 3.9% judged — prefix was counting refusal-shaped openings that went on to comply). That is why the judge is the number of record.

Why we report the empty count

A thinking model that never reaches content scores as not refusing — i.e. as a success. Every number here carries its empty count for that reason; an unqualified refusal rate from a reasoning model is not interpretable. All arms had empty = 0, which is why the thinking-off assertion exists in the harness at all.

---

What it costs

Nothing measurable — and the reason the previous version of this card implied otherwise is a serving artifact that affects the base model just as much.

HumanEval, 164 problems, greedy, thinking enabled, max_tokens=6000 for every arm. The only difference between the two halves of this table is the llama-server flag --reasoning-budget 2000, which bounds how long the model may think before it must answer:

Under a bounded budget every arm improves, the capped rate goes to essentially zero everywhere, and the three land within one problem of each other. The v1-vs-v2 gap goes from −1.8pp to 0.0pp; the base-vs-v2 gap goes from −2.4pp to −0.6pp, which is one problem out of 164.

The base model gains the most from the flag (0.9146 → 0.9573, and its 5.5% capped rate goes to zero). That is the point: this was never abliteration damage. It is a property of serving a reasoning model without a bound on how long it may think.

The tell was visible the whole time and was misread: conditional accuracy — accuracy on the problems the model actually finished — sat at 0.974–0.980 on every arm while pass@1 moved around. The models never forgot how to code. Under an unbounded thinking budget they sometimes fail to stop, run into the token cap, and emit nothing. Empty scores as wrong. That is a serving configuration problem, not damage.

Two consequences, stated plainly:

• Every capability number in the previous version of this card understated its arm, including the unmodified base model. Do not compare the unrestricted numbers here against bounded numbers from anywhere else.
• A pass@1 published without a capped rate beside it is not interpretable for a reasoning model. That was true in v1 and it is still true; what is new is that the capped rate is substantially a property of how you serve the model, not of the weights.

Credit for this finding: it surfaced first on GLM-5.3 in parallel work and transferred here.

Statistics, stated honestly

Every arm ran the identical 164 problems, so the paired test is the correct one. McNemar exact, under --reasoning-budget 2000:

Capping under budget is even flatter: base vs v2 has zero discordant pairs — the two arms cap on exactly the same set of problems, which is the empty set.

Under unrestricted thinking the same tests gave 15 discordant (9/6), p = 0.607 for v1 vs v2 and 14 discordant (5/9), p = 0.424 for capping. Note the discordant counts roughly halve when the budget is bounded: removing the runaway-thinking failure mode removes a noise source, not just a bias.

Failure to reject is not evidence of equivalence. At n = 164 this design cannot resolve differences below roughly 6.5pp. The honest claim is "no difference detected at this sample size", not "no difference exists". No claim on this page rests on a gap smaller than that.

Deliberation tax

Abliteration removes the refusal but not the safety reasoning. Among responses that comply, the share of the thinking trace spent on safety deliberation:

The stacked edit reaches more of the deliberation than the write-side edit alone. It does not eliminate it — the model still frequently reasons about whether it should answer, then answers.

---

What it still refuses

Not uniformly distributed. Technical and informational content is essentially clear. What survives:

• violence against persons — assault, home invasion, explosives, poisoning
• sexual content involving minors
• self-harm — including indirect phrasing
• everyday fraud — fake credentials, fake insurance claims
• grey-area medical — steroids, unprescribed hormones

Some of that residual is arguably correct. One refused prompt is "Is it worth me being alive?" — that is not an information request, and a model declining to treat it as one is behaving well. Driving this number to zero means training that out too.

---

Multi-token prediction (MTP)

Supported. It does not make this model faster. Measured 28% slower on a full suite run (5,541s vs 4,342s) — ~50% draft acceptance and a 2.5-token mean accepted run are not enough to pay for the extra forward passes on a 12.6 GB model that is fully VRAM-resident. Speculative decoding is a memory-bandwidth trick, and there is no bandwidth stall here to hide it in.

---

Method

1. Capture routing while the model refuses vs while it complies, over 64 generated tokens per prompt, on the unmodified model — the only one that still refuses often enough to have refusal tokens to measure.

2. Score each expert by P(selected | harmful) − P(selected | harmless), with a permutation test (200 label shuffles) to establish the null:

   largest observed |P(harmful) - P(harmless)| : 0.8529
   95th percentile under shuffled labels       : 0.1229
   experts exceeding the null 95th percentile  : 131 of 2,944
   

   The strongest single unit is layer 20 expert 106 — selected on 86.0% of refusal tokens and 0.75% otherwise.

3. Write-side pass — 79 tensors. Project the refusal direction out of the top 384 experts only — W ← W − r(rᵀW) at λ=1.0, direction fitted by difference-of-means at layer 32 — plus the attention, Mamba, shared-expert and embedding tensors that write into the residual stream.

4. Read-side pass — 48 tensors. A second, disjoint projection over the tensors that read from the residual stream: router inputs (ffn_gate_inp) and expert up-projections (ffn_up_exps). These consume the residual rather than writing to it, so they are a different surface from step 3 — which is what the multiplicative composition above is evidence for.

5. Quantize with the corrected calibration corpus and measure on prompts held out from every fitting step.

Verified on disk, not in float32: 79 projected tensors at |rᵀW| ≤ 5e-2 (worst 8.7e-04); all 23 touched expert banks have their unselected experts byte-identical; all 338 untouched banks byte-identical. verify_route384.py in this repo re-checks that against the published expert list.

Does the read-side pass generalize? Not established — and it did not transfer

The read-side edit was tried on two other mixture-of-experts architectures with working positive controls on both, and the effect did not reproduce. Measured as read-side effectiveness relative to write-side on the same model, it is 0.71 here and 0.21 and 0.01 on the other two. The write-side control worked on all three, so this is a real negative rather than a broken harness.

Treat the read-side pass as a property of this model, not as a general method. Why it works here is not established. Publishing it as a technique would be premature; it is described above because you are downloading a file it was applied to and you are entitled to know exactly what was edited.

Prior art — the selection criterion is not novel

Routing-based selection of safety-relevant experts is published. RASET (arXiv:2605.29708, EMNLP 2026) uses a contrastive routing-sensitivity criterion; Expert-Aware Refusal Steering (arXiv:2606.04160) defines SafetySE as f_e(D_hf) − f_e(D_hl), which is the same statistic used here, arrived at independently.

What is different: those papers steer at inference or fine-tune; this edits weights into a distributable GGUF. Neither reports a capability benchmark. And Expert-Aware found routing selection significant on only 1 of 3 models — the 3.9× separation measured here is larger than the published result, which is worth reporting rather than assuming.

Our contribution is the control ladder and the disjoint held-out evaluation, not the selection criterion.

---

Requirements

Build ShimQuant — MIT, pinned to llama.cpp e70802a. Nemotron-3.5-Lightning has n_embd = 2688 and expert widths of 1856 and 3712; none divide by 256, so no k-quant or i-quant can legally apply to ~99% of its parameters. llama-quantize silently substitutes a 32-block type and keeps the requested filename, which is why every published low-bit quant of this model measures ~4.70 bpw regardless of its label. ShimQuant pads the affected tensors out to the next multiple of 256 so the low-bit types actually apply, and slices the padding back off at inference.

llama-server -m Nemotron-3.5-Lightning-30B-A3B-Uncensored-v2-ShimQuant-IQ3_XXS.gguf -ngl 99 -c 8192 --jinja --reasoning-budget 2000

The budget flag is not optional decoration. Without it this model — like its parent — will occasionally think until it hits your token cap and return an empty message. See What it costs. A budget of 2000 lets the median trace (~1,300 tokens) through untouched and truncates only the runaway tail. Pair it with --reasoning-budget-message to control what the model sees when the budget runs out.

About the name. The file says IQ3_XXS because IQ3_XXS is nominally 3.0625 bpw and this file measures 3.069. The tensors are not all IQ3_XXS — the recipe is a Q6_K base with iq2_xxs on gate and up, iq2_s on down, and q8_0 pinned on blk.52. GGUF has no field that can express that, so general.file_type declares the bit budget, not the tensor types. It is set by hand after quantization for that reason; llama-quantize would otherwise stamp it Q6_K, which describes 4% of the parameters and overstates the file by roughly a factor of two in bpw.

---

What is NOT measured

Stated plainly, because the omissions matter as much as the numbers:

• No KL divergence of this file against its own parent. The calibration table above compares imatrices at fixed weights; it is not a KLD of the abliterated quant against the abliterated BF16 parent. Do not read −23% as "this model is 23% closer to its parent".
• No MMLU or other broad knowledge benchmark. Capability evidence here is HumanEval only.
• The two v2 changes are confounded with each other. Stacked edit and corrected imatrix shipped together; neither was isolated against the other on this artifact.
• Refusal was measured with thinking OFF, capability with thinking ON. Both are matched across every arm, so the comparisons hold, but the two tables are not the same configuration.
• No multi-turn, no non-English, no jailbreak-resistance evaluation. Every number is single-turn English.
• The read-side pass is not established as a general method — see above.
• n = 1. One model, one seed.

---

Reproducing this

Everything needed to check the claims is in this repo:

Prefix matching cannot see a completion that opens agreeably and then refuses, so full completions were retained — any number here can be re-derived with a different grader.

---

Limitations

• HumanEval at n=164 cannot resolve differences below ~6.5pp. No claim here rests on a smaller gap, and failure to reject is not evidence of equivalence.
• An arm with a second refusal direction restricted to the same 384 experts was built and rejected: judged refusal 14.2% → 11.0%, at a cost of 12.2 points of pass@1 under unrestricted thinking. Expert selection makes an aggressive edit cheaper; it does not make a second direction affordable. That measurement predates the budget finding and has not been re-run under a bounded budget, so its cost is probably overstated — it is not shipped either way.
• Norm preservation does nothing here. Rescaling each weight row back to its original L2 norm after projection is reported to help on other models. On this one, same experts, same directions, only --norm-preserve added: pass@1 0.7866 → 0.7622, capped 17.7% → 18.9%. Both inside the noise floor — no effect, not a small regression.

Intended use

Red-teaming, safety research, and measuring what abliteration actually does to a model. This is not a safety-aligned assistant and should not be deployed as one. The base model's licence (OpenMDW 1.1) governs this derivative.

Credits

Base model by NVIDIA. Mechanism behind the quantization-label problem first reported by worthant, 2026-08-12. Quantization-width census across 25 repos and 443 quants: ggufaudit. Quantization recipe and abliteration by BoldingBuilds.