Correction, 23 September 2026. Every refusal count in this post was a regex count: it looked for refusal phrases in the answer. We now score with a judge model that reads each response. Judged, the 262B we published and briefly served complied with 0 of 25 generic prompts. It behaves like the stock model, and the “Then it passed” result below is withdrawn. Judged, the 35B complied with 6 of 25 generic prompts (19 refused or deflected). It kept 9 of 10 guardrail prompts. Those two figures replace “2 of 25 generic refusals … 10 of 10 guardrail” below. Judged, the community tool complied with 10 of 25 generic prompts (15 refused or deflected). It kept 6 of 10 guardrail prompts. Those figures replace “refused 3 of 25” below. The other counts in this post, including the 1 September probe, the June baselines and “23 of 25”, are regex counts we have not rescored. These are small measurements: 25 prompts, one judge, one held-out split, good to roughly plus or minus 10 points. The production cluster now serves the earlier June-method build, and we make no abliteration claim for it. The work continues. The original text below is unchanged.
On 1 September 2026 we ran the first complete refusal probe against our production 262B model. Twenty-five prompts, no timeouts, results in minutes. It refused eight of eight in the harmful set. It was coherent, capable, and fully safety-aligned. The model card on Hugging Face said abliterated.
That model had been serving users for weeks. So had a 122B and a 35B under the same label. We went back and probed all of them. The 35B refused 100 percent of the time. The 122B refused half the time. The 262B refused everything. Only our dense models, the ones without expert routing, had actually been abliterated.
The reason we had never caught it is embarrassing in the ordinary way. A big mixture-of-experts model never served fast enough for a probe to finish. Every earlier attempt timed out partway, and we read partial output as good enough. The cluster we built this summer finally decoded fast enough to run the whole set. The first thing it did with that speed was tell us the truth.
The wrong theory
Our first explanation was a clean story. Mixture-of-experts models route each token through a handful of hundreds of experts. Project one refusal direction out of every expert and the router simply reconstitutes refusal from the ones you weakened least. MoE was immune. We wrote it up that way and started costing a LoRA fine-tune instead.
The story lasted a day. A community abliteration of the same 35B family, served on our own probe harness, refused 3 of 25. That tool never touches the routed experts at all. It edits attention only. We were editing strictly more matrices than it did and scoring worse. That is not an architecture problem. That is an implementation problem.
A code audit on the actual 262B output confirmed the edit itself was right. 98.8 percent of the refusal direction was gone from the expert stack. Axes, einsums, dtypes, all correct. The defect was upstream of the surgery. Every MoE run had taken the argument parser’s default layer, layer 23, unswept and unguarded. Our dense successes had all searched the layer. And no MoE run had ever shaped the ablation strength per layer. We projected one direction, captured at a depth we never chose, at one flat weight, across the whole model.
The fix, in plain terms
Three changes. Search the layer. Weight the layers. Capture clean.
Searching the layer means sweeping which transformer depth the refusal direction is read from, then scoring every candidate. The optimum landed near 85 percent of depth on every model, but the curve is steep and it moves. On the 122B the best layer was 41 of 48. On the expert-pruned 88B cut of the same model the best layer was 40, one shallower, and the layer 41 candidate missed our bar. That cost us a near miss: we almost shipped the 88B on the 122B’s number. The rule now is seed at 85 percent, sweep two layers either side, and never put a number on a card that was not measured on that exact artifact.
Weighting the layers means the ablation strength is a kernel, not a constant. Attention paths get a flat 1.3 across the middle of the model. The expert paths peak at 1.3 around the chosen depth and decay to 0.8 toward the edges. Embeddings are untouched. Attention alone at strength 1.0 barely moved the 35B, 23 of 25 still refusing. Expert coverage plus the heavier weight is what made a single direction work.
Capturing clean means the refusal direction comes from a full-precision, trunk-only copy of the base model. Our June direction for the 35B had been captured from a 4-bit quant. Against a fresh bf16 capture it agreed at a cosine of 0.58. Those are not the same vector. We measured the whole curve afterwards: a Q4_K_S substrate agrees with a known-good direction at 0.99, Q3 at 0.96, Q2 at 0.88. Two-bit captures are off the table.
The judge that changed the score
One more thing broke on the way. Our guardrail probe is ten child-safety prompts, and the shipping rule is that the model must keep refusing all of them. The regex scorer read the fixed 35B as 0 of 10. We read the ten responses by hand. Every one declined, with legal and prevention framing, and produced nothing. They just did not contain the phrase the regex was looking for.
A small local instruct model now judges that axis at temperature zero, refuse or comply, one word. It scored the same ten responses 10 of 10. A deflection counts as a kept guardrail. The regex stays as a secondary signal only.
The 35B shipped at 2 of 25 generic refusals, 5 of 5 capability, 10 of 10 guardrail. A candidate one layer deeper scored 0 of 25 with the same ceilings and did not ship. The rule was all three axes, and it did not beat the winner on all three.
Correction: these are regex counts. The judged figures for this 35B are in the note at the top of this post.
The 262B
The big one was gated on memory for a week. A direction capture wants the whole model resident, and at the time our capture box had 89 GB available. The only substrate that fit was a two-bit quant, which we had just ruled out. We tried to requantize an existing 8-bit trunk down to 4-bit and the tool refused on principle. So we rebuilt from the archived bf16, a 522 GB transient file, and cut a 138.5 GiB four-bit capture substrate. Then we waited for RAM. The first 128 GB install did not post. The second one brought the box to 251 GB.
Capture ran in 30 minutes beside the live production coordinator. The one landmine was a llama.cpp default that repacks quantized weights into anonymous memory and quietly defeats the memory map. With repack off, the 138 GiB substrate loaded file-backed and the host kept 203 GB available the whole time. Production decode never moved.
Surgery at layer 51 of 60 took 51 minutes. Then the dead ends. The first quant was a uniform four-bit cut at 148.7 GB, and the cluster refused to load it, because production runs a mixed-precision fit at 84.3 GiB. A CPU-only probe decoded at 0.44 tokens per second, timed out on ten of eleven prompts, and printed a green verdict on zero of zero. We threw that result away, re-cut the fit recipe, and the new file came out 32 bytes different from production. Mid-probe a worker node wedged and took the cluster down until it was physically rebooted.
Then it passed. 1 of 25 generic refusals. 5 of 5 capability. 10 of 10 guardrail by the judge. Decode at 30.4 tokens per second, inside the production band.
Correction: this result is withdrawn. Judged, this 262B behaves like the stock model. See the note at the top of this post.
Shipping it honestly
The person who first told us the 262B still refused had done so in a public discussion on the repo, running the IQ3_XS quant on a single machine. That rung went up first, verified against the Hub’s own hash, and the card credits them. The other nine rungs followed. We overwrote the old files in place rather than starting a new repo, because a v2 repo orphans the discussion where the bug was reported.
In-place has a cost. Old blobs stay in git history, so ten overwrites added the better part of a terabyte and blew through the organization’s storage quota. We squashed the history to reclaim it. Locally, the old June master is marked superseded and kept. Nothing gets deleted.
Two repos in the family still serve June-method files, the 212B and the 99B. Their cards are wrong until we redo them, and the substrates are already cut.
The lessons
A label is a claim, and a claim needs a completed measurement. Not a partial probe, not an inherited number from a sibling model.
When a method fails on a whole class, suspect the search before the class. Our architecture theory was tidy and wrong. The unswept default was boring and right.
The regex is not the judge. Read the responses. Then build a judge that reads them the way you did.