Muse-Glimmer-30B-Heretic-Plus

A community derivative of meta-models/Muse-Glimmer-30B. Plus is not another default Heretic pass. The previous generation lowered the published refusal count, but the drop was easy to miss in real use. This checkpoint re-targets the intervention after a structural audit of Muse Glimmer, then applies a short LoRA / SFT pass to mop residual refusal modes.

• Base: meta-models/Muse-Glimmer-30B (Apache 2.0)
• Precision: BF16 safetensors, 13 shards, ~59.6 GB
• Method: structure-aware directional ablation + targeted language-model fine-tune
• Vision stack: frozen

English

Why Plus exists

Default Heretic (directional ablation / “abliteration”, Arditi et al. 2024) is a rank-1 edit on residual-writing matrices. On this architecture that edit is necessary but not sufficient.

Published numbers on the same base:

11 / 100 and 9 / 100 look like a win on the default Heretic scorer. In chat they often do not: the model still rehearses a safety policy in to=self, then delivers a polite refusal on to=user. Plus exists to make that remaining policy actually move.

Six structural reasons stock Heretic under-shoots Glimmer

1. Only two residual writers are edited. Stock Heretic touches self_attn.o_proj and mlp.down_proj (104 modules on 52 layers). Glimmer also has a sigmoid attention-output gate self_attn.gate_proj:

   attn_out ← attn_out ⊙ σ(gate_proj(h)) then o_proj.

   A refusal component that lives in the gate survives an o_proj projection.

2. Hybrid attention mixes two residual geometries. Layers repeat [SWA, SWA, SWA, Full] (39 local + 13 global). Local layers use RoPE (θ = 500000) and a 2048 window. Global layers are NoPE (layer_rope_theta = 0). A single mean residual over all 52 layers is a mixture of two different spaces.

3. Refusal is often written in the reasoning channel. The official template emits <|start|>assistant to=self before the user-facing answer. Safety SFT + Safety RL can refuse inside thinking and then emit a canned to=user refusal. Collection that only looks at the last generated tokens misses the site that actually fires.

4. Refusal is not one direction. The base was trained for content safety, agentic-risk policies, and privacy / information-flow rules. AdvBench-style rank-1 leaves tool-boundary refusals, image-triggered refusals, and high-reasoning refusals standing. See also There Is More to Refusal in LLMs than a Single Direction.

5. Logit softcap fools the optimizer. Logits are scaled by output_multiplier (≈ 1/√(6656/256)) then passed through tanh with final_logit_softcapping = 20. Post-softcap KL looks small while hidden-state refusal is still there, so TPE stops early.

6. Vision is a second residual writer. Image tokens enter the 6656 stream through vision_adapter (6144 → 4096 → 4096) and vision_projection (4096 → 6656). Stock Heretic never collects on multimodal prompts, so screenshot / document refusals stay.

Model identity

This folder is the full BF16 text+vision checkpoint (13 shards). It is not a GGUF and does not ship the DFlash drafter.

Training process

Four phases. Phases 0–2 are weight surgery in the Heretic family. Phase 3 is the Plus fine-tune. Hyperparameters that are not written here are not published in this card (TBD), not omitted by accident.

Phase 0 — Structure audit (no weight change)

Map what actually writes the residual stream and what must stay frozen.

Residual writers (text decoder)

Frozen

• model.vision_tower.* (ViT-G/14)
• model.vision_adapter.*, model.vision_projection.*
• model.language_model.embed_tokens, lm_head
• all RMS / CenteredRMS norms

Channels in the official template

• to=self — reasoning
• to=user — answer
• to=<tool> — ATEM tool call

Collection hygiene

• DFlash drafter off. It is a separate 5-layer net and would contaminate residuals.
• Directions are fit in the 6656 hidden stream, never on post-tanh logits.

Phase 1 — Structure-aware direction collection

Prompts go through the official chat_template.jinja, including Reasoning strength: high, plus a second pass at xhigh. The mean must not become a template-format detector.

Where residuals are read

• last content token
• last to=self reasoning token

How they are averaged

• 39 local (SWA) layers vs 13 global (NoPE) layers, separately
• then a joint direction from those two

Prompt sources

• harmful: mlabonne/harmful_behaviors plus a small agent / tool-boundary overlay
• harmless: mlabonne/harmless_alpaca
• multimodal overlay: short image+text pairs that trigger stock refusals (no private dataset name claimed here)

Special, image, and video tokens (<|patch|>, <|video|>) are masked so the direction is not a placeholder detector.

Phase 2 — Structure-aware ablation

Still Arditi / Heretic: subtract a refusal direction from residual-writing weights, with row-norm preservation so activation scale does not collapse.

Search axes beyond stock Heretic:

• separate strength for SWA vs global layers
• optional light intervention on self_attn.gate_proj (row-norm preserved; much weaker than o_proj / down_proj — a sigmoid gate saturates easily)
• skip the earliest layers and the last 1–2 layers (logit formation)
• vision stack stays at stock weights

Optimizer: TPE (Optuna). Objective, unlike the default scorer:

• cut refusals on both the user channel and the reasoning channel
• keep hidden-state KL and capability probes in range (ATEM format, short coding, harmless Alpaca)

Relative to the published pair: darkc0de stayed very close to the base (KL 0.0743) and left ~11% refusals; coder3101 ARA pushed refusals to 9/100 at KL 0.3339. Plus spends more of the budget on the modes those runs left standing, then repairs capability in Phase 3.

Phase 3 — Targeted LoRA / SFT

This is the Plus step. Ablation removes the main direction. SFT overwrites residual policies without a second full Heretic sweep.

• Start from Phase-2 weights, not from stock.
• Train language_model only. Vision tower, adapter, and projection stay frozen.
• LoRA (not a claimed full fine-tune) on q/k/v/o, MLP gate/up/down, and optionally a tiny rank on self_attn.gate_proj.

Mixture (composition, not counts)

1. Residual compliance — prompts that still refused after Phase 2, with direct, non-lecture completions.
2. Capability lock — ATEM traces, short coding, harmless instruction following, so the agent stack is not washed out.
3. Reasoning-channel hygiene — to=self should plan the task, not rehearse a safety policy; the answer stays on to=user.
4. Light multimodal lock — a few image+text turns so projector alignment does not drift even though vision weights are frozen.

Style: short run, low learning rate, small rank. The goal is residual-policy overwrite, not a new base model.

Phase 4 — Validation protocol

How this card says Plus should be judged. Plus scores are not published here.

What changed vs what stayed

How to use

Needs transformers >= 5.15 (MuseGlimmerForConditionalGeneration is native; no trust_remote_code).

from transformers import AutoProcessor, AutoModelForMultimodalLM

MODEL_ID = "/path/to/Muse-Glimmer-30B-heretic-plus"

processor = AutoProcessor.from_pretrained(MODEL_ID)
model = AutoModelForMultimodalLM.from_pretrained(
    MODEL_ID,
    dtype="auto",
    device_map="auto",
)

messages = [
    {"role": "user", "content": "Explain what this checkpoint changes versus stock Heretic."},
]

inputs = processor.apply_chat_template(
    messages,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
    add_generation_prompt=True,
    reasoning_strength="high",
).to(model.device)

input_len = inputs["input_ids"].shape[-1]
out = model.generate(
    **inputs,
    do_sample=True,
    temperature=1.0,
    top_p=0.95,
    top_k=64,
    max_new_tokens=512,
)
print(processor.decode(out[0][input_len:], skip_special_tokens=False))

Sampling matches generation_config.json: temperature = 1.0, top_p = 0.95, top_k = 64. Do not attach a DFlash assistant unless you know it was distilled against this exact text decoder.

Image / video turns use the same processor (<|patch|> / <|video|>). Tool calling still uses ATEM, not OpenAI-style JSON.

Files in this folder

Intended use and limits

• Research and local agents that need fewer stock refusals than Muse Glimmer or first-generation Heretic.
• Not a license to break the law. Do not use this checkpoint to cause harm, commit crimes, or bypass systems you do not own.
• Residual refusals can remain. Ablation + SFT also changes tone (less hedging, less policy recitation).
• Not evaluated as a drop-in replacement on Meta’s agentic suites (SWE-Bench, MCP Atlas, etc.). Re-test tool use before production.
• Not intended for users under 18. Deploy behind your own guardrails.
• License: Apache 2.0, inherited from the base. This card grants no extra rights.

Credits

• Base model: Meta Superintelligence Lab, meta-models/Muse-Glimmer-30B
• Directional ablation: Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (NeurIPS 2024)
• Automation: p-e-w/heretic
• Norm-preserving / projected variants: grimjim; ARA (Heretic PR #211)
• Prompt sets: mlabonne/harmful_behaviors, mlabonne/harmless_alpaca
• Perception Encoder: Bolya et al., arXiv:2504.13181

中文

为什么要做 Plus

默认 Heretic（方向消融 / abliteration，Arditi et al. 2024）是对残差写出矩阵的 rank-1 修改。在这套结构上，这一步 必要但不充分。

同一基座上已公开的数字：

11 / 100 和 9 / 100 在默认 Heretic 计分器上看起来像赢了。对话里经常看不出来：模型仍在 to=self 里排练安全政策，再对 to=user 输出客套拒答。Plus 要让这笔还在的策略真正动起来。

原版 Heretic 在 Glimmer 上打不准的六条结构原因

1. 只改了两个残差写出矩阵。 原版 Heretic 动 self_attn.o_proj 和 mlp.down_proj（52 层共 104 个模块）。Glimmer 还有 sigmoid 注意力输出门 self_attn.gate_proj：

   attn_out ← attn_out ⊙ σ(gate_proj(h))，再进 o_proj。

   住在门上的拒绝分量，投影掉 o_proj 也还在。

2. 混合注意力把两种残差几何混在一起。 层循环是 [SWA, SWA, SWA, Full]（39 个局部 + 13 个全局）。局部层用 RoPE（θ = 500000）和 2048 窗口。全局层是 NoPE（layer_rope_theta = 0）。对 52 层残差做一次均值，等于把两个空间搅在一起。

3. 拒绝经常写在推理通道。 官方模板先发 <|start|>assistant to=self，再给用户看的答案。Safety SFT + Safety RL 可以在思维流里拒绝，再对 to=user 吐套话。只盯最后几个生成 token 的采集，会错过真正开火的位置。

4. 拒绝不是一个方向。 基座训了内容安全、智能体风险、隐私 / 信息流。只在 AdvBench 类提示上做 rank-1，会剩下工具边界拒绝、图像触发拒绝、高推理强度拒绝。亦可参考 There Is More to Refusal in LLMs than a Single Direction。

5. Logit softcap 会骗过优化器。 logits 先乘 output_multiplier（≈ 1/√(6656/256)），再过 tanh（final_logit_softcapping = 20）。softcap 之后的 KL 看起来很小，隐藏态里的拒绝还在，TPE 会提前停。

6. 视觉通路是第二条残差写入。 图像 token 经 vision_adapter（6144 → 4096 → 4096）和 vision_projection（4096 → 6656）进入 6656 流。原版 Heretic 不用多模态提示采集，截图 / 文档类拒绝还在。

模型身份

本目录是完整 BF16 文本+视觉权重（13 个分片）。不是 GGUF，也不带 DFlash 草稿网络。

训练过程

四个阶段。阶段 0–2 是 Heretic 族的权重手术。阶段 3 是 Plus 的微调。这里没写的超参是 本卡暂不公布（TBD），不是漏写。

阶段 0 — 结构审计（不改权重）

先标清谁在写残差、什么必须冻住。

残差写出（文本解码器）

冻结

• model.vision_tower.*（ViT-G/14）
• model.vision_adapter.*、model.vision_projection.*
• model.language_model.embed_tokens、lm_head
• 全部 RMS / CenteredRMS

官方模板里的通道

• to=self — 推理
• to=user — 作答
• to=<tool> — ATEM 工具调用

采集卫生

• DFlash 草稿网络 关闭。它是独立 5 层网络，会污染残差。
• 方向在 6656 隐藏流 上拟合，不用 post-tanh logits。

阶段 1 — 结构感知方向采集

提示走官方 chat_template.jinja，带上 Reasoning strength: high，并另跑一趟 xhigh。均值不能变成「模板格式检测器」。

残差读哪里

• 最后一个内容 token
• 最后一个 to=self 推理 token

怎么平均

• 39 个局部（SWA）层和 13 个全局（NoPE）层分开算
• 再合成一个联合方向

提示来源

• harmful：mlabonne/harmful_behaviors + 少量智能体 / 工具边界补充
• harmless：mlabonne/harmless_alpaca
• 多模态补充：能触发原版拒绝的短图文对（这里不宣称私有数据集名）

special / 图像 / 视频 token（<|patch|>、<|video|>）做掩码，避免方向变成占位符检测器。

阶段 2 — 结构感知消融

仍属 Arditi / Heretic：从残差写出权重里减掉拒绝方向，并做 行范数保持，避免激活尺度塌缩。

相对原版 Heretic 多搜的轴：

• SWA 层与全局层强度分开
• 对 self_attn.gate_proj 做可选的轻度干预（保行范数；比 o_proj / down_proj 弱很多 —— sigmoid 门很容易饱和）
• 跳过最浅层和最后 1–2 层（logits 成形区）
• 视觉栈保持原版权重

优化器：TPE（Optuna）。目标与默认计分器不同：

• 同时压用户通道和推理通道的拒绝
• 把隐藏态 KL 和能力探针控制在可接受范围（ATEM 格式、短代码、harmless Alpaca）

对照已公开的一对：darkc0de 离基座很近（KL 0.0743），仍有约 11% 拒绝；coder3101 ARA 把拒绝打到 9/100，KL 0.3339。Plus 把预算更多花在他们留下的模态上，再用阶段 3 把能力修回来。

阶段 3 — 针对性 LoRA / SFT

这是 Plus 相对上一代的差别。消融去掉主方向。SFT 覆盖残余策略，不再做第二轮全量 Heretic。

• 从 阶段 2 的权重 起步，不是从原版起步。
• 只训 language_model。 视觉塔、adapter、projection 冻结。
• LoRA（不宣称全参微调）打在 q/k/v/o、MLP gate/up/down，可选极小 rank 打 self_attn.gate_proj。

配比（写组成，不写条数）

1. 残余服从 — 阶段 2 之后仍拒绝的提示，配直接、不说教的完成。
2. 能力锁 — ATEM 轨迹、短代码、无害指令，避免智能体栈被冲掉。
3. 推理通道卫生 — to=self 规划任务，而不是排练安全政策；答案走 to=user。
4. 轻度多模态锁 — 少量图文轮次，视觉权重虽冻，投影对齐不漂。

风格：短、低学习率、小 rank。目标是覆盖残余策略，不是训一个新基座。

阶段 4 — 验证协议

本卡认为应该这样评 Plus。Plus 分数不在这里公布。

改了什么、冻了什么

用法

需要 transformers >= 5.15（MuseGlimmerForConditionalGeneration 是原生类，不用 trust_remote_code）。加载示例见上文英文「How to use」。

采样与 generation_config.json 一致：temperature = 1.0，top_p = 0.95，top_k = 64。除非你确认草稿网络是对着这一版文本解码器蒸出来的，否则不要挂 DFlash。

图 / 视频轮次走同一个 processor（<|patch|> / <|video|>）。工具调用仍是 ATEM，不是 OpenAI 式 JSON。

本目录文件

用途与限制

• 研究和本地智能体：希望比 Muse Glimmer 或第一代 Heretic 更少碰到原版拒答。
• 不是违法许可。不要用本权重伤害他人、实施犯罪，或攻击你没有权限的系统。
• 残余拒绝仍可能在。消融 + SFT 也会改语气（更少套话、更少政策背诵）。
• 没有当作 Meta 智能体套件（SWE-Bench、MCP Atlas 等）的即插替代来评。上线前请自己回归工具调用。
• 不面向 18 岁以下用户。部署时自己加护栏。
• 许可：继承基座的 Apache 2.0。本卡不额外授权。

致谢

• 基座：Meta Superintelligence Lab，meta-models/Muse-Glimmer-30B
• 方向消融：Arditi et al.，Refusal in Language Models Is Mediated by a Single Direction（NeurIPS 2024）
• 自动化：p-e-w/heretic
• 保范数 / 投影变体：grimjim；ARA（Heretic PR #211）
• 提示集：mlabonne/harmful_behaviors、mlabonne/harmless_alpaca
• Perception Encoder：Bolya et al.，arXiv:2504.13181