How Fragile Is Safety Alignment at Frontier Scale? (arXiv 2609.09793, Thu 10 Sep digest) extends directional ablation — removing a model's ability to refuse by projecting a single 'refusal direction' out of the weights, needing only a few hundred contrastive prompts and no optimization — from dense models up to ~70B to a frontier MoE release: GLM-5.3-Flash (320B parameters, 288 routed experts, four-wide hyper-connection residual, block-FP8 weights). The attack survives the architecture and the shipped quantization; with multiple experts and a hyper-connected residual stream, refusal-direction mass is distributed differently than in dense models, and the paper maps where refusal behavior actually lives in the shipped weights.
A one-direction weight edit strips refusal from the shipped GLM-5.3-Flash weights
2026-09-11Frontier watchWATCH
How Fragile Is Safety Alignment at Frontier Scale? (arXiv 2609.09793, Thu 10 Sep digest) extends directional ablation — removing a model's ability to refuse by projecting a single 'refusal direction' out of the weights, needing only a few hundred contrastive prompts and no optimization — from dense models up to ~70B to a frontier MoE release: GLM-5.3-Flash (320B parameters, 288 routed experts, four-wide hyper-connection residual, block-FP8 weights). The attack survives the architecture and the shipped quantization; with multiple experts and a hyper-connected residual stream, refusal-direction mass is distributed differently than in dense models, and the paper maps where refusal behavior actually lives in the shipped weights.
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
The predicted safety spillover of trend #1 made concrete on exactly the weights everyone is downloading: an open 320B frontier-tuned model whose refusal can be stripped with a laptop-scale, training-free edit. For anyone self-hosting open weights with safety obligations: add refusal-direction robustness to acceptance testing (a few hundred prompts plus a linear probe is cheap); block-FP8 quantization is not a defense.
FRONTIER WATCH
Public artifacts and validated results are different.
The recorded fact is the public work and its artifacts. Author-reported outcomes do not establish independent reproduction. Next checks include usable code, task conditions and third-party validation.
Evidence & related material
Technical details & scores
| Arxiv | 2609.09793, Thu 10 Sep 2026 digest |
|---|---|
| Target | GLM-5.3-Flash shipped weights: 320B, 288 routed experts, hyper-connection residual, block-FP8 |
| Attack | single refusal-direction ablation; few hundred contrastive prompts; no training |
| Findings | survives MoE + shipped quantization; refusal mass distributed unlike dense models |
Technical impact 4
Engineering value 3
Adoption signal 3
Maturity 2
Verification cost 2
Risk 4