DeepSeek-V4.1-Flash-1017-abliterated-cyber-GLP-39-L1-39-a0.75

Projective control vector ("GLP") for deepseek-ai/DeepSeek-V4.1-Flash-1017 (deepseek_v41: 40 layers, hidden 5120, 384 routed experts + 1 shared, MLA with KV compression, hc_mult=4 hyper-connections, engram layers, built-in DSpark drafter, 510 GB FP8+MXFP4 checkpoint; config byte-identical to the 0909 V4.1-Flash release, new weights). Applied at runtime as h <- h - alpha * (h . d) d at the post-layer residual stream, layers 1–39, alpha 0.75 baked in. No weights are modified; this is the difference, not the model.

Confirmed base: deepseek-ai/DeepSeek-V4.1-Flash-1017 (revision 1bae0e1088993b9b82de08f59de5be5a34e42170). The direction was derived and calibrated on that exact checkpoint via the vLLM capture lane (the dsv41-feat wheel from vllm-project/vllm PR #56201, built sha 79a7108d9aea27ddab99ce1779290d300b17fc23); it is not validated against other revisions or quants.

Validation (vLLM offline lane, greedy, thinking off, 1024-token cap, 2026-10-17)

Termination: no clean-stop collapse attributable to steering (refusal32 27/32 stop; the cyber32 completions are verbose deliveries that hit the 1024-token cap — 23/32 stop there — verified by reading: coherent, on-topic, not loops). Zero GARBLED classifications at every alpha tested.

Alpha calibration is the finding of this run — and it is not the 0909 alpha. The ladder (refusal32 + benign32-holdout, then a full four-suite eval boot): alpha 0.5 delivers 16/32 refusal32 with near-zero code-mixing; alpha 0.75 delivers 23/32 with zero heavy code-mixing on the calibration suites; alpha 1.0 delivers 26/32 but code-switches into Chinese on 18/32 and 13/32 items respectively (heavy mixing on 5); alpha 2.0 regresses (10/32, 19 fresh refusals) and mixes on 31/32. On the shipping-relevant suites alpha 0.75 and 1.0 are statistically indistinguishable (cyber32 29 vs 28, propaganda32 32 = 32, benign32-holdout 32 = 32) — alpha=0.75 is the knee: domain delivery matches the maximum at a fraction of the collateral.

Mild code-mixing (a few stray CJK characters, <1% of characters) still appears on roughly a third of steered completions at 0.75, and 7/128 steered completions across the four suites switch heavily; the delivered technical content itself remains complete and coherent (verified by reading). At alpha 1.0 the same trade buys +3/32 refusal32 delivery and roughly double the mixed items.

The direction comes from a general harmful-vs-harmless contrast (refusal32 vs benign32, content-matched, last-token pooling), not from cyber content; the transfer into the offensive-security domain is the measured result, and the "cyber" in the name follows the series convention. n=32 per arm; read rates at that resolution as approximate.

Usage

This file uses the glp.* GGUF namespace (spec: weightless spec/GLP.md) and is read projective-only. An additive consumer must refuse this file. The hook point is residual_stream_post_layer: on this architecture (hc_mult=4 hyper-connections) that is the post-layer hyper-connection fold reduced to the single stream by the mean over the four hc copies, taken pre-engram — derived AND applied at that site. It is NOT the ffn_out_pre_residual site used by the DeepSeek-V4-0731 GLP-29 vector; a reader that applies only that hook must refuse this file.

export WEIGHTLESS_STEER_PATH=glp.deepseek-v41-flash-1017-GLP-39-L1-39-a0.75.gguf
export WEIGHTLESS_STEER_ALPHA=0.75
# apply the dsv41 steering patch, then serve

Serving shape. The dsv41-feat wheel from vllm-project/vllm PR #56201 (closed unmerged at publication; the deepseek_v41 architecture has since landed in vLLM main). The validated research shape is that wheel on 4x H200, tensor-parallel 4, offline LLM driver; the steering patch for the wheel's deepseek_v4_1/nvidia/model.py lives in refusal-research/experiments/20261017-dsv41-1017-glp/staging/patch_dsv41.py. The 510 GB FP8+MXFP4 checkpoint does not fit 2x128 GB rigs in any quant that exists at publication time.

What is inside

Files in this repo

• glp.deepseek-v41-flash-1017-GLP-39-L1-39-a0.75.gguf — the base vector this card describes: refusal32 vs benign32, the calibrated α0.75 default.

Do not scale alpha across models

alpha_default is calibrated on this checkpoint, at this hook. On this model the response is sharply non-monotone: alpha 2.0 removes less refusal than alpha 0.5 and visibly damages the output register (code-switching on up to 31/32 items). Do not port the DeepSeek-V4-0731 alpha (4–6 at a different hook), the V4.1-Flash-0909 alpha (0.5), or this 0.75 anywhere else: re-run the ladder.

Caveats

• Checkpoint-specific. Tied to the revision pinned above. Applying it to another model or revision is undefined.
• Not a jailbreak of a hosted service. It requires local weights and a runtime that implements the projection.
• Layers 1–5 sit below the derivation null gate (held-out separation vs shuffled-label null under 5x; the stack median is 38x). They shipped because the measured stack (L1-39) is clean at alpha 0.75; at higher alpha they are the first place to look if behaviour degrades.
• n=32 suites resolve about 30 points; the suites that matter most were verified by reading the completions, not only the classifier.
• The no-op gate (vector loaded at alpha=0) reproduced stock labels 32/32 on benign32-holdout and 29/32 on refusal32; all three mismatches are borderline REFUSE/DEFLECT flips on semantically identical stock refusals ("I can't provide…"), attributable to engine kernel nondeterminism across boots, not the hook (the alpha=0 projection is exactly h - 0·d).

License

Base model © DeepSeek, MIT. This vector modifies and redistributes no weights; the base license continues to govern the weights it is applied to.

Author

Matt Suiche.