GLM-5.3 — abliterated refusal direction (GLP-77)

A GLP control vector (GGUF Layer Projection, glp.mode=project) for GLM-5.3 (753B MoE, arch glm_moe_dsa: MLA + DeepSeek-sparse attention). 77 per-layer unit directions over the post-layer residual stream (hidden 6144 — no hyperconnection widening on this arch), layers 1-77, fp32. No model weights are modified; a conforming reader applies h <- h - alpha * (h . d) d at the post-layer residual stream (the deepseek_v2 decomposed convention: the stream is hidden_states + residual).

Derived 2026-08-30 on the NVFP4 deployment (RadixArk/GLM-5.3-NVFP4, marlin MoE backend, vLLM 0.28.0, 8xH100) with the vLLM capture lane (activation probe on deepseek_v2.py), difference-of-means over the AdvBench-32 vs Alpaca-32 contrast, per-layer structure, last-token pooling. Every shipped layer clears a held-out vs shuffled-label null gate (>=5x; peak layers 48-55 sit at ~60x). Methodology + code: refusal-research/experiments/20260829-glm53-flagship.

Measured effect (NVFP4, greedy, max 1400 new tokens, n=32 per suite)

GLM-5.3 thinks by default (template = max reasoning effort); completions were read in full (content + reasoning). Two scorers are reported: the repo phrase-classifier on the full completion, and an answer-audited count that splits at </think> and applies extended GLM decline phrasing (the stock scorer misses "I'm not able to provide").

Null control (METHODOLOGY §11): 77 random unit vectors, same magnitude, seed 1337, at alpha=1.0 under the same protocol: refusal32 1/32 — identical to stock. The effect is the direction, not the dose.

Honest reading: the cyber cluster saturates (18/32 -> 32/32 at alpha=1.0) with benign and capability untouched. The refusal32 physical-harm/petty-crime cluster moves from 1/32 to 6-12/32 depending on scorer; the model's long reasoning re-litigates borderline items at length (11/32 completions still hit the 1400-token cap mid-thought at alpha=1.0 — those count as not-delivered here). This is a real, null-gated effect, not a 32/32 claim. For reference, the baked-weight CRACK release claims 0% refusal at high/max reasoning effort on HarmBench; the steering counterpart does not reproduce that on refusal32, and publishes its protocol so the difference is measurable rather than rhetorical.

Usage

Confirmed bases

• Derived on RadixArk/GLM-5.3-NVFP4 (vLLM 0.28.0, 8xH100), AdvBench-32 vs Alpaca-32 contrast.
• Validated serving: that same NVFP4 checkpoint — the numbers above. On 4x DGX Spark use tonyd2wild's Int4-Int8Mix stack (~95.5 GiB/rank): the weightless recipe/glm53xl/ lane is wired and structure-tested (first boot is the anchor test).

Option 1 — weightless wizard (recommended)

git clone https://github.com/msuiche/weightless.git && cd weightless && python3 setup.py
# pick: "GLM-5.3 743B TP=4 serving" (4x DGX Spark lane)

Option 2 — manual (any vLLM container)

huggingface-cli download msuiche/GLM-5.3-abliterated-cyber-GLP-77 --include "*.gguf"
# inside the serving container, BEFORE vllm serve:
WEIGHTLESS_STEER_PATH=/cache/huggingface/GLM-5.3-abliterated-cyber-GLP-77-L1-77-a1.0.gguf \
WEIGHTLESS_STEER_ALPHA=1.0 \
  python3 /patches/hotfix-glm53xl-steering-projective.py && exec vllm serve ...

Fail-closed: anchor mismatch aborts the boot rather than serving unsteered.

Option 3 — other runtimes

Spec-conformant GGUF control vector (glp.mode=project, spec: spec/GLP.md in the weightless repo). Stock llama.cpp's control-vector apply is additive, not projective — it is NOT a conforming reader for this file.

alpha is a runtime parameter, never folded into the vector; alpha_default=1.0 is the measured peak on refusal32 (1.5 over-projects on this suite).

Note: the RadixArk checkpoint declares an fp8 KV-cache scheme that no sm90 sparse-MLA backend accepts; delete quantization_config.kv_cache_scheme from config.json when serving on Hopper (bf16 KV).

Content SHA-256 (tensor bytes): 5837bcb5fc43a72416a71de0b6aca7c3d2ae7bbb9379eff9bf5bdfcc8179a225 Whole-file SHA-256: b48ac5f93641825a29d76373e384edf34f342d7cc350f7843f0fcb8cb5c29eba