GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
wangzhang
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Run this model inference with full control and performance in your environment.
Model Details
Model Provider
wangzhang
Model Tree
openai/gpt-oss-20b
Input Modalities
Output Modalities
Supported Functionality
| Metric | Base gpt-oss-20b | This model |
|---|---|---|
| Refusals on 100 held-out harmful prompts (LLM judge) | 97 / 100 | 6 / 100 |
| KL divergence vs base (next-token, benign) | — | 0.0098 |
| Response length deviation vs base (benign) | — | 0.02 σ |
| Hard-prompt qualitative compliance (15 classic jailbreaks, EN+ZH) | 0 / 15 | 15 / 15 |
The eval refusal counts come from an LLM judge (google/gemini-3.1-flash-lite-preview via OpenRouter) instructed to label garbled / repetitive / incoherent output as a refusal — so models that "bypass" refusal by collapsing into gibberish get correctly counted as failures, not successes. A pre-LLM rule-based filter additionally catches dash-runs, sentence loops, and low-character-diversity output before the judge is called. The 6/100 is a real, semantic compliance number, not keyword matching.
The qualitative compliance row is a separate manual test: 15 classic hard prompts (10 EN + 5 ZH) covering lockpicking, phishing, meth synthesis, WiFi hacking, fake news, hotwiring, pipe bombs, signature forgery, keylogger code, shoplifting, 炸弹制作, 钓鱼邮件, 电脑入侵, 身份证伪造, 网络诈骗. The model complies with all 15 directly, in the same Markdown-table, step-by-step style the base model uses for benign technical answers.
abliterix handles three gpt-oss-specific issues that silently break naïve LLaMA-style abliteration scripts:
nn.Parameter. gpt-oss ships in Mxfp4GptOssExperts form whose down_proj is a packed Triton tensor that cannot be edited in-place. abliterix auto-detects this and forces Mxfp4Config(dequantize=True) so the BF16 fused expert tensor is reachable.GptOssExperts.down_proj is stored transposed vs the standard MoE convention. Its shape is (experts, intermediate_in, hidden_out) and the forward path is out = act @ W (no transpose). Standard EGA implementations use shape-based axis detection, which silently picks the wrong projection branch when hidden == intermediate (both 2880 in gpt-oss-20b). We mark this layout explicitly and project from the output side (W_new = W (I − vv^T)).GptOssExperts is a single Module holding fused 3-D weights, so a naive per-Module profile dict key produces no entry and early-exits. abliterix synthesises an profile when fused experts are detected so EGA actually runs across all 32 experts × 24 layers.On top of the direct-steering + EGA foundation, this release adds MoE router suppression — an [experts] block that redirects routing away from the top-k "safety experts" (the experts whose gate activates disproportionately more on harmful prompts than on benign ones). The suppression strength is itself an Optuna search parameter, so the optimiser picks how aggressively to bias each layer's safety experts.
steering_mode = "direct" (orthogonal projection on base weights, no LoRA), weight_normalization = "full" (norm-preserving)attn.{q,k,v,o}_proj via direct weight projectionmlp.experts.down_proj across all 32 experts × 24 layers via Expert-Granular Abliterationmlp.router rows of safety experts via logit suppressiontoml
vector_scope = "per layer" # per-layer direction, not global[attn.q_proj]max_weight = 3.04 ; max_weight_position = 13.86 ; min_weight = 0.99 ; min_weight_distance = 6.21[attn.k_proj]max_weight = 3.90 ; max_weight_position = 16.57 ; min_weight = 1.25 ; min_weight_distance = 4.91[attn.v_proj]max_weight = 2.21 ; max_weight_position = 20.06 ; min_weight = 0.77 ; min_weight_distance = 7.29[attn.o_proj]max_weight = 3.82 ; max_weight_position = 17.41 ; min_weight = 1.11 ; min_weight_distance = 7.07[mlp.down_proj] # Expert-Granular Abliteration on fused expertsmax_weight = 6.95 ; max_weight_position = 18.37 ; min_weight = 0.54 ; min_weight_distance = 4.91[moe] # router-row suppressionn_suppress = 1 # suppress top-1 safety expert per layerrouter_bias = -0.64 # scale = max(0, 1 + bias/10) = 0.94expert_ablation_weight = 0.0 # pinned off; EGA already handles expert weights
The EGA peak sits at layer ≈ 18 — a per-layer-tailored fingerprint where the refusal decision still has options, rather than late in the stack where it has already committed.
python
from transformers import AutoTokenizer, AutoModelForCausalLMimport torchtok = AutoTokenizer.from_pretrained("wangzhang/gpt-oss-20b-abliterated")model = AutoModelForCausalLM.from_pretrained("wangzhang/gpt-oss-20b-abliterated",torch_dtype=torch.bfloat16,device_map="auto",)messages = [{"role": "user", "content": "Your prompt here"}]prompt = tok.apply_chat_template(messages, add_generation_prompt=True, tokenize=False)inputs = tok(prompt, return_tensors="pt").to(model.device)out = model.generate(**inputs, max_new_tokens=512, do_sample=True, temperature=0.7)print(tok.decode(out[0][inputs.input_ids.shape[1]:], skip_special_tokens=True))
The model uses gpt-oss's harmony chat format. The chat template is bundled (chat_template.jinja).
BF16, Q8_0, and Q4_K_M quantizations are available at wangzhang/gpt-oss-20b-abliterated-GGUF.
bash
ollama run hf.co/wangzhang/gpt-oss-20b-abliterated-GGUF:Q4_K_M
Full search checkpoint (Optuna JSONL + judge cache SQLite) and the exact config are available in the abliterix repo. To reproduce from scratch:
bash
git clone https://github.com/wuwangzhang1216/abliterixcd abliterix && pip install -e .AX_CONFIG=configs/gpt_oss_20b.toml abliterix# Optuna is deterministic if you set sampler_seed in [optimization].
Authorised AI safety research, red-teaming evaluation, refusal-mechanism analysis, and study of how MoE expert specialisation encodes safety behaviours. Not for producing or distributing harmful content. The license of the base model (apache-2.0) applies; the user is responsible for compliance with all applicable laws and the OpenAI gpt-oss usage policy.
openai/gpt-oss-20bThe original model weights and/or derived checkpoint were modified. This repository is an independent derivative and is not an official release of the upstream model developer.
The governing upstream license is Apache License 2.0. A copy is included in LICENSE. License source audited on 2026-08-29: https://huggingface.co/openai/gpt-oss-20b/blob/main/LICENSE
All applicable upstream copyright, attribution, acceptable-use, and other license terms remain in effect. This repository grants no rights beyond those provided by the upstream license. Downstream users must preserve applicable license and attribution notices.
English
This is an experimental, modified model provided for research, evaluation, and other lawful purposes. Its safety alignment, refusal behavior, or other safeguards may have been weakened or removed. It may produce inaccurate, biased, offensive, explicit, dangerous, or illegal content. Outputs are not professional advice and must not be relied on for medical, legal, financial, safety-critical, or other high-stakes decisions without qualified human review.
You are solely responsible for how you access, use, deploy, fine-tune, or redistribute this model and its outputs, including compliance with applicable laws, regulations, licenses, third-party rights, platform policies, and the original model's terms. Do not use it to facilitate harm, illegal activity, malware, fraud, privacy violations, targeted harassment, weapons development, or decisions that materially affect a person's rights or access to essential services without appropriate authorization, safeguards, and qualified oversight.
Before deployment, perform a context-specific risk assessment and testing; use human oversight, access controls, content filtering, rate limits, monitoring, logging, and incident-response procedures as appropriate. Preserve this notice in downstream redistributions.
The model is provided "AS IS", without warranties of any kind. To the fullest extent permitted by applicable law, the maintainer disclaims liability for claims, damages, or losses arising from use, misuse, inability to use, or redistribution of the model or its outputs. Nothing in this notice overrides applicable law or the governing license, and this notice is not legal advice.
中文
本模型属于实验性改造模型，仅供研究、评测及其他合法用途。其安全对齐、拒答机制或其他防护可能已被削弱或移除，因此可能生成不准确、偏见、冒犯、露骨、危险或违法内容。输出不构成医疗、法律、金融等专业意见；涉及高风险或重大权益的决定，必须由具备资质的人员复核。
使用者须对模型及其输出的访问、使用、部署、微调和再分发承担全部责任，并遵守适用法律法规、许可证、第三方权利、平台政策及原模型条款。不得将本模型用于促成伤害、违法活动、恶意软件、欺诈、侵犯隐私、定向骚扰、武器开发，或在缺乏适当授权、防护和专业监督时，用于实质影响个人权利或基本服务获取的决策。
部署前应进行与具体场景相匹配的风险评估和测试，并酌情采用人工监督、访问控制、内容过滤、限流、监控、日志和事件响应措施；下游再分发时应保留本声明。
本模型按“现状”提供，不附带任何形式的保证。在适用法律允许的最大范围内，维护者不对因使用、误用、无法使用或再分发本模型及其输出而产生的索赔、损害或损失承担责任。本声明不取代适用法律或管辖本模型的许可证，也不构成法律意见。
mlp.down_proj_apply_ega_steeringmlp.down_proj