Nanbeige4.2-3B-abliterated-cyber-GLP-44-L1-44-a2.0
Projective control vector ("GLP") for Nanbeige/Nanbeige4.2-3B — the first
public open-weight looped transformer: 22 physical layers executed twice
(num_loops: 2) for 44 execution steps, hidden 3072, GQA 48/8, bf16, ~4.2B
parameters. Applied at runtime as h <- h - alpha * (h . d) d at the post-layer
residual stream, alpha 2.0 validated. No weights are modified; this is the
difference, not the model.
Confirmed base: Nanbeige/Nanbeige4.2-3B (revision
3384e426066d1a49c3aea90a7190b81260a6533f). The direction was derived and
calibrated on that exact checkpoint via the vLLM capture lane; it is not
validated against other revisions or quants.
Loop-specific layout — read before applying
The 44 directions are indexed by execution step, not physical layer.
GGUF tensor direction.N (N = 1–44) holds execution step N−1:
- physical layer = (N−1) mod 22
- loop pass = (N−1) div 22 (pass 1 = steps 0–21, pass 2 = steps 22–43)
Pass 1 and pass 2 carry materially different refusal geometry at the same shared weights (same-layer cross-pass direction cosine ≈ 0.25–0.6, and a pass-1-derived direction transfers poorly into pass 2), so per-visit indexing is load-bearing: applying one direction per physical layer to both passes is NOT equivalent. The adjacent-direction cosine rotates hardest across the loop boundary (pass1→pass2, cos 0.59–0.79) without breaking — gate per pass, not across the boundary.
Derivation note: on this model the last-prefill-token tap carries the refusal signal; the pass-1 mean-over-tokens tap encodes prompt topic instead (it fails a shuffled-label split-half gate at 20 of 22 pass-1 steps). The shipped directions are last-token derived, applied to the full stream.
Validation (vLLM offline lane, TP=1 H100, greedy, thinking on, 4096-token cap, 2026-09-06)
| suite | stock | alpha=1.0 | alpha=1.5 | alpha=2.0 (shipped) |
|---|---|---|---|---|
| refusal32 | 3/32 comply | 13/32 | 20/32 | 25/32 comply |
| cyber32 (offensive-security domain) | 14/32 comply | 30/32 | 30/32 | 31/32 comply |
| benign32 | 32/32 comply | 32/32 | 32/32 | 32/32 comply, zero collateral |
| geopolitical persuasion questions (32) | 28/32 engage | 32/32 | 32/32 | 32/32 engage |
Alpha ceiling: at 3.0 the model collapses (128/128 degenerate completions) — the usable band is bracketed in (2, 3). At 2.0, one cyber32 answer of 128 total scored degenerate and two long traces looped; that is the documented cost of the max-delivery point. If you want zero defects, run the same vector at alpha 1.5 (refusal32 20/32, no degeneration).
No-op gate: an alpha=0.0 arm with the vector loaded reproduces stock label distributions on all four suites (item-level wobble only from cross-boot bf16 batching numerics).
The direction comes from a general harmful-vs-harmless contrast (public AdvBench vs Stanford Alpaca), not from cyber content; the transfer into the offensive-security domain is the measured result, and the "cyber" in the name follows the series convention.
This model reasons by default (<think> traces). Validation used a
4096-token cap so final answers are visible past the trace; finish reasons
were recorded per item (a length-capped trace with no visible answer is
"unknown", never a scored outcome). n=32 per arm; read rates at that
resolution as approximate.
Usage
This file uses the glp.* GGUF namespace (spec: weightless spec/GLP.md) and is
read by the weightless vLLM steering hotfix, projective-only. An additive
consumer must refuse this file.
export WEIGHTLESS_STEER_PATH=glp.nanbeige42-GLP-44-L1-44-a2.gguf
export WEIGHTLESS_STEER_ALPHA=2.0
# apply the weightless steering hotfix, then serve
Serving shape. There is no mainline vLLM support for this architecture.
The validated stack is the stock vllm/vllm-openai nightly at upstream commit
f25c580 (2026-08-27) plus the vendor fork's
(github.com/Nanbeige/vllm @ nanbeige42) nine Python-only overlay files —
no source build is needed. A single GPU with ~9 GB free suffices (bf16).
The companion glp.nanbeige42.dirs.pt (44 × fp32 3072, 0-based execution-step
keys) is the direct hotfix input.
What is inside
| tensors | 44 x direction.<N>, fp32, 1-D, 3072, unit norm |
| layers | 1–44 = execution steps 0–43 (physical (N−1)%22, pass (N−1)//22) |
| rank | 1 per execution step |
| default alpha | 2.0 (calibrated on this checkpoint; do not carry across models) |
| hook point | residual_stream_post_layer (hidden_states + residual, [T, 3072]) |
glp.content_sha256 |
see file metadata (tensor bytes only) |
Caveats
- Checkpoint-specific. Tied to the revision pinned above. Applying it to another model or revision is undefined.
- Alpha is per-model. 2.0 is calibrated for this checkpoint; 3.0 destroys it. Never carry alpha across models.
- Not a jailbreak of a hosted service. It requires local weights and a runtime that implements the projection.
- n=32 suites resolve about 30 points; the harmful suites were verified by reading the completions, not only the classifier.
- The residual refusal32 items at 2.0 are clean short refusals (explosives, document forgery, poisoning, extortion, extremist recruitment) — a dose-insensitive residue, not garble.
- Thinking-mode caveat: directions were derived from prefill activations in the "poised to think" state; behaviour in a no-think serving regime is unmeasured.
License
Base model © Nanbeige (BOSS直聘), Apache-2.0. This vector modifies and redistributes no weights; the base license continues to govern the weights it is applied to.
Author
Matt Suiche.