GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
sbussiso
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Run this model inference with full control and performance in your environment.
Model Details
Model Provider
sbussiso
Model Tree
Qwen/Qwen2.5-0.5B-Instruct
Input Modalities
Output Modalities
Supported Functionality
Every chart below is generated directly from the recorded run artifacts shipped in this repo
(probe logs, layer_coherence.json, eval/ lm-eval results) by charts/make_card_charts.py —
no hand-typed numbers.
Headline: refusal 87.5% → 56.2% with the published persistent weight edit (wd_B). The
inference-time hook condition (0.0%) shows what full removal looks like, but a hook is not
persisted in weights — the honest gap between hook and persistent edit is the program's open
problem (attacked by run 003).
Benign behavior is unchanged in every condition (93.8% of harmless probes answered, zero degenerate outputs anywhere) — the extracted direction is refusal-specific, consistent with the single-direction hypothesis.
Direction extraction exactly replicated run 001 (independent implementation, same patient): best layer L17/24, coherence 0.664 in both runs. Coherence peaks at ~2/3 depth and decays toward the final layer (last-layer norms are an unnormalized-residual artifact — never selected by norm).
Capability guardrail passed: MMLU 45.78% → 45.49% (Δ 0.29pp, mission guardrail < 3pp). The delta is within one standard error (±0.41pp), so we cannot rule out zero true loss — the guardrail is a ceiling, not a claim of perfect equivalence.
Arditi et al. 2024, "Refusal in LLMs is mediated by a single direction" (NeurIPS 2024). From 64 harmful/harmless prompt pairs (greedy decoding, seed 0), the mean difference of final-position residual activations gives the refusal direction at each layer; the layer with the highest direction coherence was chosen and its direction removed.
Two edits are compared in this repo's evaluation:
W <- W - (W rhat) rhat^T. Qwen2.5-0.5B ships with tied embeddings, so the
edit was applied to an UNTIED clone of lm_head and
tie_word_embeddings: false is persisted in this repo's config.json (the
input embeddings are untouched). Persistence verified by reload-from-disk:
max|W r̂| = 1.5e-08.Both directions are shipped: refusal_direction_A.npy (residual space, layer
17) and refusal_direction_B.npy (final-layer readout space, i.e. the
space the lm_head actually multiplies against). The readout-space direction is
the better weight-space edit (56.2% vs 75.0% persistent refusal) — this gap is
why both are published.
| field | value |
|---|---|
| chosen decoder layer | 17 / 24 (hook target model.model.layers[17]) |
| coherence (residual space) | 0.664 |
| coherence (final-layer readout space, direction B) | 0.562 |
| published variant | wd_B |
| direction pairs / probes | 64 / 16 |
| decoding | greedy (do_sample=False), max_new_tokens 200 |
| seed | 0 |
| GPU | Tesla T4 |
| condition | harmful refusal rate | harmless answered | degenerate outputs |
|---|---|---|---|
| baseline | 87.5% | 93.8% | 0 |
| hook_ablated (inference-time) | 0.0% | 93.8% | 0 |
| wd_A (lm_head, residual-space dir) | 75.0% | 93.8% | 0 |
| wd_B (published) | 56.2% | 93.8% | 0 |
* wd_C was contributed by a concurrent agent working the same mission and is included with credit (coordination note in the run record); it had zero outputs identical to the hook condition — direct evidence that a single-layer weight edit cannot reproduce the hook's full-stream projection.
Absolute refusal rates are keyword-marker based (first-person/explicit markers only, constant scorer across conditions); deltas are meaningful, absolute rates approximate. Probes are n=16 per condition (1 probe = 6.25pp granularity).
| model | MMLU acc | acc_stderr |
|---|---|---|
| Qwen/Qwen2.5-0.5B-Instruct @ 7ae55760 | 45.78% | 0.41pp |
| this model (wd_B) | 45.49% | 0.41pp |
MMLU delta: 0.29pp (mission guardrail: capability loss must stay under 3pp). Both evaluations used identical config (
text
lm_eval --model hf --tasks mmlu --num_fewshot 0 --batch_size auto --seed 0eval/.
Qwen/Qwen2.5-0.5B-Instruct @ 7ae5576 (Apache-2.0, ungated).8ee4567a…00fd6d verified byte-identical to the source
safetensors produced on the training VM before upload.refusal_direction.npy (selected direction), refusal_direction_A.npy
(residual space, layer 17), refusal_direction_B.npy (final-layer
readout space)charts/ - model-card charts (PNG) + make_card_charts.py, the generator
that reproduces every figure from this repo's recorded artifactseval/ - lm-eval MMLU results (base + variant) and refusal probe logsrun_config.json, layer_coherence.json, selection.json - run metadata| python / torch | 3.13.15 / 2.11.0+cu128 |
| wd_C (L17 o_proj+down_proj, row space)* | 68.8% | 93.8% | 0 |