GLM-5.3-Flash Uncensored — Prefill Top-up (steering vectors)

Zero-refusal GLM-5.3-Flash as ~180 KB: two refusal-direction vectors + a runtime loader. No weights are included or modified — this is a prefill-only activation top-up for OrcaRouter's GLM-5.3-Flash-Uncensored abliteration.

Why it's this small

The winning refusal-suppression technique is prefill-only constant injection: add dose × r̂ to the inter-layer hidden state after layers 25/26, during prompt processing only. A weight edit cannot express "prefill only" — weight edits fire on every forward pass, including every decode step, and that decode-time injection is exactly what destroys long-generation quality in classic constant-steering abliterations. So the intervention is inherently a runtime one, and the release is inherently tiny: the model you need is OrcaRouter's, unchanged.

Results

Served eval: 20 held-out harmful prompts + 10 capability prompts, greedy decoding, 1000-token generations, low reasoning effort:

* The classifier reads 5%, but the single hit is a false positive — the model says "I can't produce an actual video file" (a text model being honest) and then produces the full script.

Usage

pip install -e git+https://github.com/Libertai/prefill-steering.git

Bake the injection into your vLLM glm5next/nvidia/model.py (details in the repo README):

python3 bake_injection.py \
  --model /path/to/vllm/models/glm5next/nvidia/model.py \
  --subspace vectors/glm53_flash_orca_rhat_L25_L26.json \
  --mode const_po --dose -8 --layers 25,26

GLM53_REFUSAL_INJECT=1 <vllm serve the OrcaRouter NVFP4 checkpoint>

Runtime hooks (prefill_steer.py) and the full reproduction harness (direction capture → steering sweep → served eval) are in the GitHub repo.

Files

• vectors/glm53_flash_orca_rhat_L25_L26.json — unit refusal directions at layers 25/26, captured from the OrcaRouter abliteration
• prefill_steer.py — runtime forward-hook implementation (reference mechanism)
• bake_injection.py — patches the injection into the vLLM model file, gated by GLM53_REFUSAL_INJECT

Findings behind this release

1. Projection ablation — the canonical abliteration operator — fails on this model (8 variants, 90–100% refusal retained). Only constant displacement along the refusal direction works.
2. Magnitude removes refusal; direction preserves capability — a random vector at the same dose suppresses refusal and collapses capability (0/10).
3. Only the inter-layer hidden state is injectable — the 4-stream mHC architecture (hidden_states, residual, post, comb) is destroyed by injection into any other stream.
4. Decode-time injection is the quality killer — prefill-only gating preserves suppression and restores creativity.
5. Abliteration stages compose — the residual direction of an abliterated model is cheaper to suppress than the original's (roughly half the dose here).

Full writeup: LibertAI Labs — story • LibertAI Labs — paper • GitHub: Libertai/prefill-steering

Credits

Built on OrcaRouter's community abliteration (weights unchanged), the single-direction account of refusal from Arditi et al. (arXiv:2406.11732), prompt-only steering vectors from Bao et al. (arXiv:2605.05983), and the open abliteration community. The entire study — direction capture, falsification sweeps, weight surgery, serving, evaluation — was run by an autonomous agent session.

Caveats

20 harmful prompts, 10 capability prompts, single seed, greedy decoding, marker-classifier scoring. "0% refusal" is a measurement on a thin distribution sample, not a certificate. The vectors are specific to the OrcaRouter abliteration at NVFP4 precision; re-capture for other checkpoints (the harness does this in one command).