weightless — abliteration without the weights

"The takeaway for defenders is direct. Have a capable model you can run on your own infrastructure, vetted and ready before an incident. It solves two problems at once."

No guardrail lockout — your responders can analyze real malicious payloads without a hosted provider refusing the request at the worst possible moment. No data exfiltration — attacker artifacts, logs, and the credentials they touched stay inside your security perimeter.

— Open models for cyber defense, Hugging Face

§ 02 the wizard

One wizard, env to endpoint.

setup.py walks the full chain: site values → env file → structural patch validation → confirm-gated ssh deploy → omp provider + smoke tests. Endpoint down? The diagnose chain isolates DNS → TCP → HTTP and can boot the stack over ssh.

The last leg registers the freshly served endpoint as a provider in omp, the agentic harness we drive local models with. The final smoke test is a real headless omp agent loop against it, not just a curl.

python3 setup.py

What to set up: DSV4 TP=2 serving — full chain (env → steering → deploy → omp/tests) Qwen TP=1 serving — full chain (env → steering → deploy → omp/tests) › Endpoint tests — register provider in omp + smoke suite Base URL of the OpenAI-compatible server: http://node-a.local:8888/v1 endpoint test suite ──────────────────────────────────────── ✓ 01-endpoint.sh — PASS: deepseek-v4-flash-dspark listed at http://node-a.local:8888/v1 ✓ 02-chat.sh — PASS: chat completion returned: pong ✓ 03-tool-call.sh — PASS: tool call get_weather({"city": "Paris"}) ✓ 04-omp-headless.sh — PASS: omp agent loop created omp_probe.txt ──────────────────────────────────────── all endpoint tests passed ╭─ Congratulations! ──────────────────────────────────╮ │ you're all set — steering validated, endpoint live, │ │ omp provider ready. Happy hacking. │ ╰─────────────────────────────────────────────────────╯

♥

§ 03 the intervention

The direction, not the model.

Abliteration edits weights and ships a checkpoint. Weightless never touches the weights: the refusal direction is removed in activation space at inference time, on the post-layer residual stream, per layer. What you download is the direction — nothing else.

h ← h − α·(h·d̂)d̂ projective removal of the refusal component — not llama.cpp's additive h += v, which pushes every token along the axis and fails silently

01 · ship the vector

478 KB, not 157 GB

A GLP (GGUF Layer Projection) file: per-layer unit directions, fp32, under a glp.* metadata contract. A reader that doesn't understand glp.mode=project must refuse the file — never fall back to adding.

02 · patch at boot

Fail-closed hotfix

patches/hotfix-*.py installs the hook inside stock vLLM at container start. No image build, no fork. A boot that can't apply steering never serves unsteered — and a one-rank-only config can't split a TP pair.

03 · or no patch at all

The LoRA fold

On the Qwen lane the same intervention exists as a closed-form rank-1 LoRA (lora_A = −α·d̂ᵀW) — stock vLLM/peft, no hotfix, matching delivery on hardware.

§ 04 measured

0% refusal on cyber suites, gates held.

DeepSeek-V4-Flash-0731 at a pinned revision, 2× DGX Spark (GB10) TP=2, thinking off, temperature 0. Refusal rate over comply-expected items — lower is better. Gates held on every run: benign over-refusal 0.0, capability 6/6, 40–43 tok/s. The cyber100, cyber-fullchain and cyber-extract suites are custom and private — the aggregate rates are the citable artifact. The V8 suites are authored here but stratified and grounded by the public ExploitBench v8 dataset — bug selection by measured difficulty, mechanics digested from its transcripts; no d8 verifier, no agent loop.
suite	n	stock	with GLP-29
cyber100	100	75.0%	0.0%
cyber-fullchain	112	37.5%	0.9%
V8 exploitation ladder	40	15.2%	0.0%
V8 CVE-2024-6100	24	20.0%	0.0%
cyber-extract	196	39.0%	0.5%

The vector removes capability gating — not target-authorization gating: unauthorized framings still refuse, authorized ones comply. That's a property of the contrast set, stated plainly in the model card.

§ 05 lanes

Two lanes, one spec. More to come.

● live

DSV4 — TP=2, 2× DGX Spark

DeepSeek-V4-Flash-0731 NVFP4 (166.9 GB) over dual-rail RoCE. Anemll vLLM image, MiaAI 2-node recipe, GLP-29 vector at α=4.0 on layers 10–38.

OpenAI-compatible endpoint on :8888
182k-token KV cache, 1M-context build
recipe/anemll/ — vendored state, fail-closed hotfix

● hardware-validated

Qwen3.8-27B — TP=1, single Spark

NVFP4 on one GB10. GLP-49 vector via the same hotfix, or the rank-1 LoRA on stock vLLM — no patch at all.

offensive-security holdout: stock 4/32 → steered 24/32, both modes
8.6 MB LoRA or 1.0 MB GGUF — base stays byte-identical
recipe/qwen/ — STEER_MODE=gguf|lora

§ 06 the format

GLP — GGUF Layer Projection.

A spec-conformant control-vector GGUF: direction.N tensors (layer N, no offset), glp.spec_version, glp.mode=project, glp.content_sha256 over tensor bytes, layer ids cross-checked by the loader. Reader conformance rules included — a silent additive fallback is worse than an error.

the GLP spec the original write-up DSV4 vector · GLP-29 Qwen vector · GLP-49