A one-direction weight edit strips refusal from the shipped GLM-5.3-Flash weights

How Fragile Is Safety Alignment at Frontier Scale? (arXiv 2609.09793, Thu 10 Sep digest) extends directional ablation — removing a model's ability to refuse by projecting a single 'refusal direction' out of the weights, needing only a few hundred contrastive prompts and no optimization — from dense models up to ~70B to a frontier MoE release: GLM-5.3-Flash (320B parameters, 288 routed experts, four-wide hyper-connection residual, block-FP8 weights). The attack survives the architecture and the shipped quantization; with multiple experts and a hyper-connected residual stream, refusal-direction mass is distributed differently than in dense models, and the paper maps where refusal behavior actually lives in the shipped weights.

The predicted safety spillover of trend #1 made concrete on exactly the weights everyone is downloading: an open 320B frontier-tuned model whose refusal can be stripped with a laptop-scale, training-free edit. For anyone self-hosting open weights with safety obligations: add refusal-direction robustness to acceptance testing (a few hundred prompts plus a linear probe is cheap); block-FP8 quantization is not a defense.