apetersson/DeepSeek-V4.1-Flash-Abliteration-Adapter

DeepSeek V4.1 Flash experimental ds4 steering adapters

Three experimental DS41DIR steering files for DeepSeek V4.1 Flash Q2 on the custom ds4 branch below. It is not a complete model, a PEFT/LoRA adapter, or a validated abliterated model release. No model weights are included or modified. Upstream sources and the local derivation steps are documented below.

The directory name describes the intended research use. Refusal reduction, capability preservation, and behavioral transfer to Q2 remain unqualified. These are the W3 artifacts, not ABL-049's synthetic e0 test fixtures and not newly learned local refusal directions.

Contents and strength

Layer numbers below are zero-based. Each file is 819,272 bytes: a 72-byte DS41DIR v1 header and 40 × 5120 little-endian float32 values. Selected rows are unit vectors; unselected rows are zero. The header specifies the intervention site and selected-layer mask. Only one file is loaded per run.

File	Origin/type	Site	Selected layers	W3 smoke strength
msuiche-mean-equal-experiment.ds41dir	Published vectors, locally converted with explicit residual interpretation	residual	1–39	0.5
s-zaizen-writer-proxy.ds41dir	Locally fitted proxy from published weight differences	writer	0–39	1.0
dealignai-writer-proxy.ds41dir	Locally fitted proxy from published weight differences	writer	10–36	1.0

The strengths above reproduce the integration smoke settings, not an optimized or behaviorally recommended setting. Alpha is not encoded in the DS41DIR payload. The CLI and server require explicit --dir-steering-strength, finite and in [-100, 100]. Zero skips edits; one removes the directional component; fractional values remove that fraction; negative values add it. Native fitted per-layer alphas in the audit JSON are diagnostics, not runtime recommendations. Do not fold them into the unit vectors.

Exact compatible deployment model

• Filename used in qualification: DeepSeek-V4.1-Flash-Q2.gguf
• Suggested relative path (place the model beside this package): ../DeepSeek-V4.1-Flash-Q2.gguf
• Full file size: 365,713,686,528 bytes (about 341 GiB)
• SHA256: 1ce6a8f8806205c13330d7ca287bd198331dc5ca35ccc5d8a9a92a188a6f6f42

All three files bind to that exact full-file digest. Renaming/moving the same bytes is fine. A different quantization, converted GGUF, metadata rewrite, or split-disk variant with different bytes is not interchangeable, even when the weights descend from the same base model. Do not rewrite the adapter digest merely to bypass a mismatch. Digest binding verifies identity, not transfer quality. The original model is reused; this package does not duplicate it.

The CLI and server hash the opened model file, including disk-only Engram data, once per process using a 1 MiB buffer. Local ABL-049 steered CLI runs took roughly 213–217 seconds including startup, full hashing and a short prompt. This is an observation on the local M1 Ultra, not a throughput guarantee. Interactive turns and /ctx recreation reuse the verified digest without rehashing. Keep both model and direction files immutable during a session.

Build the required ds4 branch

Use apetersson/ds4, feat/abl-049-v41-cli-steering. The packaging-time branch tip is 0c8f374f7531c705cef805a522ff3655ab50b917. This is the squashed ABL-049 CLI and ABL-052 server implementation, based on W1 f8a581b3ac5f5c568669eb324c0a5bf27f2b8e77.

On macOS with the compiler and Metal development tools installed, start in this package directory. These commands create a sibling checkout named ds4-v41-adapter-cli; use a fresh destination:

git clone --single-branch --branch feat/abl-049-v41-cli-steering \
  https://github.com/apetersson/ds4.git ../ds4-v41-adapter-cli
cd ../ds4-v41-adapter-cli
git checkout --detach 0c8f374f7531c705cef805a522ff3655ab50b917
make -j4
cd ../DeepSeek-V4.1-Flash-Abliteration-Adapter

Pinning the commit makes the commands reproducible even if the branch moves. The examples below use this sibling checkout. The implementation requires a single-process Metal session. SSD streaming is supported. CPU, CUDA, distributed/tensor-parallel and speculative modes are not supported for these interventions. The upstream raw-vector CLI and original HF GGUF control-vector files are not accepted as DS41DIR files.

Run locally

Start ds4-server with the dealignai writer proxy

Build the pinned branch above, then run this command from the adapter directory. The checkout and matching Q2 model are siblings of this directory:

../ds4-v41-adapter-cli/ds4-server \
  -m ../DeepSeek-V4.1-Flash-Q2.gguf \
  --ssd-streaming -c 4096 --host 127.0.0.1 --port 8000 \
  --dir-steering-file ./dealignai-writer-proxy.ds41dir \
  --dir-steering-strength 1

Startup verifies the full model SHA256 once before opening the HTTP listener. Allow several minutes for the full model read. Then, in another terminal:

curl http://127.0.0.1:8000/v1/models
curl http://127.0.0.1:8000/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{"messages":[{"role":"user","content":"What is 17 + 25? Answer with just the number."}],"temperature":0,"max_tokens":32,"reasoning_effort":"none"}'

Add "stream":true to the request for streaming responses. The server configures all session slots with the same artifact and strength. In-memory prompt reuse retains the intervention. Restart the server to change settings; requests do not select an adapter. Do not use --kv-disk-dir: disk cache files do not encode intervention identity, so this combination is rejected, even at zero strength.

Strength 1 is the integration smoke setting, not an established best capability setting. Keep the normal instance lock and run large-model processes serially.

CLI examples

Run the following setup from this package directory. It expects the checkout and original Q2 model beside the package. Adjust the relative paths if needed. Run model processes serially. Keep the default ds4 instance lock; do not set a separate lock or interrupt another model worker. The CLI commands below are usage examples. The separate server smoke described below was executed after an explicit research-worker memory handoff.

adapter_dir='.'
adapter_ds4='../ds4-v41-adapter-cli/ds4'
adapter_model='../DeepSeek-V4.1-Flash-Q2.gguf'

# Stock baseline, without steering.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  -p 'What is 17 + 25? Answer with just the number.'

# Published-vector residual interpretation, W3 smoke alpha.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/msuiche-mean-equal-experiment.ds41dir" \
  --dir-steering-strength 0.5 \
  -p 'What is 17 + 25? Answer with just the number.'

# Fitted writer proxy from s-zaizen, W3 smoke alpha.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/s-zaizen-writer-proxy.ds41dir" \
  --dir-steering-strength 1 \
  -p 'What is 17 + 25? Answer with just the number.'

# Fitted writer proxy from dealignai, W3 smoke alpha.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/dealignai-writer-proxy.ds41dir" \
  --dir-steering-strength 1 \
  -p 'What is 17 + 25? Answer with just the number.'

# Zero-strength control. This still validates the file and hashes the model.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/s-zaizen-writer-proxy.ds41dir" \
  --dir-steering-strength 0 \
  -p 'What is 17 + 25? Answer with just the number.'

# Interactive example: omit -p; /ctx 8192 recreates the configured session.
"$adapter_ds4" -m "$adapter_model" --ssd-streaming -c 4096 \
  --temp 0 --seed 42 --nothink -n 256 \
  --dir-steering-file "$adapter_dir/s-zaizen-writer-proxy.ds41dir" \
  --dir-steering-strength 1

For reasoning, replace --nothink with --think and allow a larger token budget such as -n 2048. The file selects writer/residual automatically. Do not combine these files with legacy --dir-steering-ffn or --dir-steering-attn, even when set to zero. /steer is legacy FFN only; restart to change V4.1 strength. To inspect prompt logits, add --dump-logits result.json; that mode writes prompt logits instead of generating the requested continuation.

Provenance: published vector source

Publisher: msuiche, repository DeepSeek-V4.1-Flash-abliterated-cyber-GLP-39-L1-39-a0.5. Pinned acquired revision: 3a278522b127db0645c67e6327a41776c4eac71f.

Original file: glp.deepseek-v41-flash-GLP-39-L1-39-a0.5.gguf (803,168 bytes). SHA256: 741476be392af446cb2c46a12e19b11cabaaacb16fad255050aaf9f95f9956d9. Its numeric-layer tensor payload digest is 7b051452f901d59ab7601214dea4f82b3c1ed40a6f4f02e4f0acc22bd4e4e11f. The source identifies deepseek-ai/DeepSeek-V4.1-Flash and calibration revision fb2764a5cf321eaa5070ca8f9e892818f477c16d, which differs from the official comparison revision used for the writer fits below.

The 39 FP32 unit vectors, width 5120, were preserved and placed in rows 1–39 of the local 40-row format; row 0 is zero. Alpha 0.5 stays separate. The local conversion is provenance/convert_glp_experiment.py.

The publisher's exact application/staging patch was unavailable at the public locations checked. Our residual site computes the equal mean of four HC streams after ordinary layer rounding and before the next Engram addition, subtracts alpha * d * dot(d, mean) equally from each stream, and rounds edited streams to BF16. This is an explicit local interpretation, not a verified reproduction of the publisher's GLP implementation. It is not a writer intervention and cannot be represented by editing attention writers alone.

Provenance: locally fitted writer proxies

Both proxies compare the publishers' native layers.L.attn.wo_b.weight tensors and their scales against the official DeepSeek V4.1 Flash revision dba1be0, full revision dba1be0a40aa45a94ad051997016db3960a90277.

• s-zaizen: pinned checkpoint, revision 23da584e06e57ec43c896d286b44b822c9bb0ad6. The source card credits s-zaizen for conversion/publication and Heretic contributors for tooling. It identifies Heretic commit 3521f8648a0dccf6e12a92666862632235fac7e6, projected per-layer interventions, row normalization and rank-3 norm-preserving LoRA merging. Our rank-one proxy does not recreate that complete transformation. All 40 writer pairs changed.
• dealignai: pinned checkpoint, revision d61c59ea5e514e25d305b5850e8a432f7a9969f2. This is attributed to the dealignai publisher; a sanitized copy of the acquired card is included. Writer changes were found in layers 10–36 (27 layers); 13 writer pairs were unchanged.

W3 acquired 240 tensor ranges, totaling 5,038,080,000 bytes, and rechecked all saved payload hashes. This was partial writer/scaler acquisition, not a full checkpoint download or independent whole-shard verification. Native FP8 E4M3 values were decoded with E8M0 scales per 32×32 tile. Seeded randomized subspace analysis estimated leading left delta directions, with a second seed for stability; constrained projection fits measured how well a rank-one edit -alpha * d * (d.T @ W) approximates the native delta.

Median constrained projection error divided by native delta norm was about 31.3% for s-zaizen and 23.6% for dealignai. These are fit errors, not behavioral error rates. The exported vectors are normalized leading native-delta directions with unchanged layers omitted. Fitted per-layer strengths are not folded into them. They are locally fitted proxies, not recovered original publisher training/refusal vectors or exact checkpoint replacements.

At the ds4 writer site, the projected component is removed from attention wo_b output before BF16 rounding and mHC expansion. There is no FFN edit. Native-derived directions are transferred to the specified Q2 deployment; identity binding alone does not validate this transfer.

Evidence, attribution, and integrity

manifest.json records package-relative artifact paths, source repositories and revisions, hashes, deployment identity, sites, masks, and smoke strengths. provenance/ contains sanitized copies of export manifests, source cards and available LICENSE files, inventory/range records, per-layer results, conversion/export script snapshots, and W3 smoke summary and requests. Local filesystem paths, personal names, social-profile references and email addresses have been removed from these copies. Public repository identifiers remain for source attribution. External payload paths are relative labels, not bundled files. Sanitized copies have package-local checksums; any historical report hashes still describe the original reports, not these edited copies. These are audit snapshots; external range payloads, fitted NumPy bases, source model weights and the original GLP GGUF are not bundled. The archived scripts need their original acquisition workspace and dependencies; they are not standalone package commands.

All acquired source cards declare license: mit; the available DeepSeek and s-zaizen LICENSE files are preserved. No standalone LICENSE was present in the acquired msuiche/dealignai snapshots. This statement records source declarations, not a new blanket license for the package. Source credits and notices remain applicable. Heretic is separately credited by s-zaizen under AGPL-3.0; this package does not include Heretic source or claim the publishers' authorship for our locally fitted files.

W3's 12 resident-worker integration requests covered stock plus these three arms on arithmetic, exact JSON formatting and reasoning. All stopped normally; saved bundles revalidated and the mechanical checks passed. These are not refusal-rate or broad capability evaluations. ABL-049 separately verified CLI wiring, zero parity, nonzero effects and session lifecycle with synthetic e0 fixtures; those fixtures are not included here. Initial packaging validated the files without model inference. ABL-052 then ran nine HTTP requests through fresh stock, zero-strength and strength-1 dealignai servers: ordinary responses, SSE streaming, repeated prompts and a different prompt. All returned 42; zero matched stock exactly. Both steered startups verified the full model once. This used a 512-token context and one session slot, not the 4096-token example configuration above. See server-validation.json. An additional two-turn dealignai conversation returned 42 on each turn and reported 19 cached tokens on continuation, verifying actual live KV reuse. These checks establish integration only, not refusal reduction or capability preservation; the other two artifacts were not rerun through HTTP.

Verify this directory without loading the model:

# From this package directory:
shasum -a 256 -c SHA256SUMS
python3 verify_adapters.py

The checksum list covers all packaged regular files except itself. Hashes detect accidental changes; they are not a publisher signature. See validation.json for packaging-time results, including strict runtime C parser acceptance.

Portable layout and privacy

All run instructions use relative filesystem paths. Public publisher/repository handles and pinned source URLs are deliberately retained to keep the provenance traceable; they do not identify the local machine or user. No personal contact details, local account names, credentials, or model-worker host paths are needed to use this package. Adapter vectors are unchanged by documentation sanitization.