gemma-3-4b-it-abliterated-GLP-28-L6-33-a0.25

Projective control vector ("GLP") for google/gemma-3-4b-it (Gemma3ForConditionalGeneration, text stack: 34 layers, hidden 2560, vocab 262208, bf16). Applied at runtime as h <- h - alpha * (h . d) d at the post-layer residual stream of the language model, layers 6–33, alpha 0.25 baked in. No weights are modified; this is the difference, not the model.

Confirmed base: google/gemma-3-4b-it. The derivation checkpoint was the unsloth/gemma-3-4b-it mirror (byte-identical bf16 weights) at revision bf46152c47f5dd20b896357cb51abc4c03b8ee8c — the google/ repo is license-gated for our token, so the mirror sha is the pin recorded in the file's glp.base_revision. The config was checked against Google's published specs (34 layers, hidden 2560) before derivation. The vector is not validated against other revisions or quants.

Validation (Modal A10G, transformers 5.16.1, bf16, greedy, 1024-token cap, 2026-10-11)

Alpha ladder (refusal32 / benign32-holdout, comply of 32): 0.25 → 32/32, 32/32; 0.5 → 32/32, 32/32; 1.0 → 32/32, 32/32. Zero GARBLED completions at every rung. The knee is the bottom rung: alpha 0.25 captures the full delivery gain, so that is what ships. No-op gate: an alpha=0.0 arm with the vector loaded reproduces the stock completions exactly (64/64 identical strings on both gate suites).

The two stock refusals (a helpdesk social-engineering script, a keylogger that emails captured passwords) both become coherent on-topic deliveries under steering — verified by reading the completions, not only the classifier. Stock gemma-3-4b-it already answers 30/32 of refusal32: the direction closes the last two rather than unlocking a locked-down model.

Derivation gates (captain-vector 0.5.0, dom_per_layer_mask0.005): the massive-activation screen flagged this checkpoint — peak/median 4546x at layer 0, dims 443/1365/368 — so the top 0.5% of dims by magnitude were masked before normalisation. Held-out separation vs a shuffled-label null (20 reps) clears the 5x ship gate on 28 of 33 shippable layers; layers 1, 2, 3, 4, 5 sit below it (ratios 2.5–3.8) and are excluded from the file. Adjacent-layer cosine median 0.807 against a random-direction null p99 of 0.048. Mean dose 0.064 of the residual norm at alpha=1 (random-direction floor 0.020); the max per-layer dose is 0.301 at layer 33, under the 50% damage threshold.

The contrast is refusal32 vs benign32 (content-matched, last-token pooling). refusal32 doubles as the derivation set, so its steered number is in-sample; benign32-holdout is out-of-sample. n=32 per arm; read rates at that resolution as approximate.

Usage

This file uses the glp.* GGUF namespace (spec: weightless spec/GLP.md) and is read projective-only. An additive consumer must refuse this file. The hook point is residual_stream_post_layer — the decoder-layer output, the accumulated residual stream — derived AND applied at that site.

export WEIGHTLESS_STEER_PATH=glp.gemma-3-4b-it-GLP-28-L6-33-a0.25.gguf
export WEIGHTLESS_STEER_ALPHA=0.25
# serve with a runtime that implements glp.mode=project

What is inside

Do not scale alpha across models

alpha_default is calibrated on this checkpoint, at this hook. Here the ladder is flat — 0.25, 0.5 and 1.0 all deliver identically with zero measured collateral — because the stock model barely refuses. That says nothing about any other model: on DeepSeek-V4.1-Flash the same ladder is sharply non-monotone and the knee sits at 0.5. Re-run the ladder per checkpoint; do not port this 0.25 anywhere else.

Caveats

• Checkpoint-specific. Tied to the revision pinned above. Applying it to another model or revision is undefined.
• Not a jailbreak of a hosted service. It requires local weights and a runtime that implements the projection.
• Layers 1, 2, 3, 4, 5 fell below the derivation null gate (held-out separation vs shuffled-label null under 5x, ratios 2.5–3.8) and are not in the file; layer 0 is excluded by protocol. The refusal signal on this model lives in the middle and late stack (ratios 6.2–36.1 from layer 6 up); the ladder confirms the shipped span loses nothing measurable.
• refusal32 is the derivation contrast (in-sample on the harmful side); benign32-holdout is the out-of-sample control.
• n=32 suites resolve about 30 points; the completions behind every number above were read, not only classified.

License

Base model © Google, under the Gemma Terms of Use. This vector modifies and redistributes no weights; the Gemma Terms of Use continue to govern the weights it is applied to.

Author

Matt Suiche.