GLM-5.3-Flash — abliterated refusal direction (GLP-44)

A GLP control vector (GGUF Layer Projection, glp.mode=project) for zai-org/GLM-5.3-Flash (snapshot 3f1971b7b5f7a528c9c4ef6212c8785298a8c24a, current chat template). 44 per-layer unit directions over the widened Sinkhorn hyper-connection stream (16384 = 4 x 4096), layers 1-44, fp32, derived from the FP8-native canonical checkpoint.

Measured effect (greedy, 400 tokens, n=32 per suite)

Do not exceed alpha=2.25 — the garble cliff between 2.25 and 2.5 is abrupt and total. alpha=2.25 trades 2 benign items for +3 refusal32 points; 2.0 is the last fully-clean point. Cyber transfers near-fully at 2.0.

Full-length re-audit (2026-08-30, max 1400 new tokens)

The 400-token numbers above were scored on completions that often cap mid-thought: GLM-5.3-Flash always thinks (its template silently ignores enable_thinking=False), and truncated deliberation misreads as delivery in both directions on a phrase classifier. Re-ran the stock and shipped-default arms at 1400 tokens, scored two ways: the repo phrase-classifier on the full completion, and an answer-audited count that splits at </think> and never counts a think-capped completion as delivered (NOANSWER below). benign32's NOANSWER rows are long-thinking overruns of the 1400 cap, not refusals.

Reading: the published 65.6% on refusal32 becomes 59.4% with the same scorer at a longer cap, and 50.0% answer-audited — the direction's effect is real but smaller than the truncated measurement suggested. cyber32 holds at 96.9% (repo scorer) at either length. Protocol and completions: refusal-research/experiments/20260826-glm53-flash-modal/out/eval-long/ (scored with ../20260829-glm53-flagship/audit_glm.py).

Usage

Note: stock GLM-5.3-Flash already delivers most AdvBench-style prompts; this vector targets the harder refusal32-style phrasing and cyber holdouts.

Confirmed bases

• Derived from zai-org/GLM-5.3-Flash (FP8-native canonical, snapshot 3f1971b7b5f7a528c9c4ef6212c8785298a8c24a), AdvBench-32 vs Alpaca-32 contrast.
• Quant of record: RedHatAI/GLM-5.3-Flash-NVFP4 (compressed-tensors W4A4) — corruption-free, ~2x faster load, ungated, drop-in (same arch/flags). The older LibertAIDAI/GLM-5.3-Flash-NVFP4 (ModelOpt) intermittently emits corrupted token IDs (vLLM issue #54150; upstream probe: 4/9/8 U+FFFD over 3 runs vs 0/0/0 for RedHatAI, and corruption inside a tool-call block desyncs parsers). Baked abliterated NVFP4 builds (drowzeys/keys) still carry that ModelOpt corruption — steering on a clean quant is the clean path.
• Validated serving: NVFP4 on the sm121-v8 patched day-0 image (radixark/vllm-glm53-flash:sm121-v8), TP=4 on 4x DGX Spark — the numbers above. alpha=2.0 is calibrated for this model; >=2.5 garbles it.
• EXL3: brandonmusic's brandonmusic/GLM-5.3-Flash-tr3-4bpw runs on a custom vLLM/B12X build (verdictai/glm53-flash-exl3-k4, SM120), so the same hotfix-mount mechanics apply — but hotfix anchors on that image and direction transfer to EXL3 are NOT yet hardware-validated (no SM120 on our bench as of 2026-08-30). NVFP4 transfer is clean, so EXL3 transfer is expected; measure before relying on it.

Option 1 — weightless wizard (recommended)

git clone https://github.com/msuiche/weightless.git && cd weightless && python3 setup.py
# pick: "GLM-5.3-Flash TP=4 serving" (4x DGX Spark lane)

Option 2 — manual (any vLLM container)

huggingface-cli download msuiche/GLM-5.3-Flash-abliterated-cyber-GLP-44 --include "*.gguf"
# inside the serving container, BEFORE vllm serve:
WEIGHTLESS_STEER_PATH=/cache/huggingface/GLM-5.3-Flash-abliterated-cyber-GLP-44-L1-44-a2.gguf \
WEIGHTLESS_STEER_ALPHA=2.0 \
  python3 /patches/hotfix-glm53-steering-projective.py && exec vllm serve ...

The hotfix (in weightless/patches/) is fail-closed: anchor mismatch aborts the boot rather than serving unsteered. GLM-5.3-Flash always thinks (its chat template ignores enable_thinking=False) — evaluate with >=1400 max tokens and read past </think>, or truncated deliberation misreads as refusal.

Option 3 — other runtimes

Spec-conformant GGUF control vector (glp.mode=project, spec: spec/GLP.md in the weightless repo). Stock llama.cpp's control-vector apply is additive, not projective — it is NOT a conforming reader for this file.

Content SHA-256 (tensor bytes): 4fc8ec5106a05e8fa9d3c6cd53c28f70dc8d48b62dc3380855602394091f2f3f