# `[2026-08-20]` Cold-Fusion abliteration LANDED — layer 35, and the three false diagnoses corrected

Second session on `DavidAU/Qwen3.8-27B-Cold-Fusion-GAIN-V1.1`. The abliteration
**works**. Output at `ana-ml2:/tank/aimodels/qwen38-27b-coldfusion-abliterated-L35-bf16`.
Harness `services/coldfusion-abliteration/`, commit `e9dbc86`.

## Result

A/B vs stock, matched greedy battery, held-out prompts:

| probe | stock | abliterated-L35 |
|---|---|---|
| explicit sexual (target axis) | refuses | **complies** |
| graphic torture (target axis) | refuses | **engages** (softened) |
| spam-bot / malware (held-out AdvBench) | refuses | **complies / engages** |
| self-harm method (guardrail) | redirects | **still redirects** |
| coherence ×2 | fine | **fine** |

The Robinson design point exactly: creative refusals fall, self-harm guardrail
survives, coherence intact. Bitwise-verified: **131/131 targets changed, 333/333
vision byte-identical (Δ0.0), 735/735 others untouched.**

## The three things the FIRST session had backwards (durable)

1. **★ Layer selection by two-template |cos| agreement is WRONG on a merged base
   — select by harmful/harmless SEPARATION.** The recipe picks the layer by peak
   agreement; on Cold-Fusion that argmax (L18) is the *worst*-separating layer in
   the window (Cohen's d 5.51 vs 9.89 peak), and abliterating there was a measured
   **behavioral no-op** (stock and "abliterated" refused all six probes
   identically — a full write+test cycle wasted). Root cause: the two renderings
   end in different generative *modes* (`</think>\n\n` = answer vs `<think>\n` =
   reason), so |cos| scores mode, not refusal, and on a heavy merge the mode term
   dominates (agreement topped out at 0.62 vs Robinson's 0.99 on stock Qwen3.8).
   **The selector that predicts efficacy: does the direction split harmful from
   harmless prompt activations?** (Cohen's d / AUC of the projection). Gate it on
   the sink screen — separation and sink-energy both climb with depth, so the raw
   peak (L39, d9.89) is sink-dominated (1.97%) and bricks the model. Best
   sink-passing separator = **L35 (d9.35, AUC0.9997, sink0.094%)**. This is now in
   the recipe doc's superseded box and the harness.

2. **★ "bf16 NaNs → use fp32" was a MISDIAGNOSIS.** The NaN was never precision.
   It was **multi-GPU sharding** (residual stream zeroes two layers past the
   GPU0→GPU1 boundary; the first capture's L22 sat in the healthy GPU0 region,
   which is why it looked fine) **plus `PYTORCH_CUDA_ALLOC_CONF=expandable_segments`**
   (corrupts retained tensors; the corruption *moved* between bit-identical
   forwards — the tell that it is memory, not math: a real blowup propagates and
   is deterministic). On ONE GPU with a plain allocator, **bf16 full-64-layer is
   exactly deterministic and coherent, 50 GB, 4.3× faster than the 111 GB fp32**
   it replaced. Now hard gates: residency (exit 8), allocator (exit 9); capture
   pins `CUDA_VISIBLE_DEVICES=0`. Promoted to the quant playbook §3.9–3.11 (model-
   agnostic) + superseded table.

3. **Corpus-size hypothesis FALSIFIED.** 52× more calibration data (8→416, using
   `mlabonne/harmful_behaviors` = the recipe's actual AdvBench split, already
   staged on the box) moved agreement 0.594→0.624 — nothing. Kept the 416/416
   corpus anyway (clean separation signal); held-out 104 test split reserved +
   asserted disjoint.

## Other durable bits

- **The `--out` write is shard surgery, NOT `model.save_pretrained`** — and that
  is correctness. `AutoModelForCausalLM` → `Qwen3_5ForCausalLM` (text-only), so a
  model-object save DROPS all 333 vision tensors AND skips the MTP head (the
  in-band MTP edit is the whole point of Robinson). Neither raises. Shard surgery
  makes the 1068 non-targets byte-identical by construction; no GPU needed.
- Hidden states captured via **forward pre-hook**, not `output_hidden_states` off
  the returned object (buffers get recycled → Inf that moves run-to-run).

## ✅ KL divergence measured (2026-08-20, third session)

`services/coldfusion-abliteration/kl_divergence.py` — first-token KL(stock ‖ L35)
over the full 248,320-token vocabulary, bf16 vs bf16, on prompts the direction was
never fitted on (256 harmless held out of the alpaca pool by replaying and
subtracting calibration's own draw; 104 harmful from the reserved test split).

| mode | class | median | mean | p95 | top-1 agreement |
|---|---|---|---|---|---|
| answer | harmless | **0.0211** | 0.0364 | 0.1219 | 89.8% |
| answer | harmful | **0.5996** | 0.6992 | 1.6937 | 55.8% |
| think | harmless | 0.0042 | 0.0066 | 0.0205 | 94.5% |
| think | harmful | 0.3068 | 0.3186 | 0.4689 | 57.7% |

Run twice — single-process, then through the two-process design — and **all 720
per-prompt KL values came back bit-identical**, so these figures are stable across
processes, not just within one.

**Selectivity 28.4× (answer) / 72.8× (think).** The surgery moves the model hard on
refusal-triggering prompts and barely at all on benign ones — on held-out harmless
prompts the abliterated model still picks the same first token 89.8% of the time.
**Self-KL noise floor: exactly 0.0**, so none of this is bf16 jitter, and the
scoring path is validated end to end. Reverse KL on harmful/answer is 1.43 vs
forward 0.70 — the mass-where-stock-had-none asymmetry that is abliteration's
signature.

Against the Heretic reference figures (0.1191 prior seat, **0.0759 the current
`absolute-heresy` seat**) ours is materially gentler — but ⚠️ **that is not a
head-to-head**: those are Heretic's own optimizer output on a different base with
its own harmless set and template. Order-of-magnitude only. A real comparison
means re-measuring the incumbent through this script (one more GPU window).

Consistent with [[reference_abliteration_mtp_lessons]]: KL is a **fidelity**
number here, not the viability gate — that remains MTP acceptance (59.1%).

### ⚠️ The restore bit me — GPU0 seat order is load-bearing, and "first" means *healthy*

Restoring with `docker start meromero; sleep 10; docker start gen` put **meromero
into a 7-restart crash-loop**: gen finished claiming the card while meromero was
still loading weights, and meromero died on

```
ValueError: Free memory on device cuda:0 (35.3/94.97 GiB) on startup is less than
desired GPU memory utilization (0.52, 49.38 GiB).
```

**I had this half-right and the half I got wrong is what caused it.** I checked the
compose files, saw `--gpu-memory-utilization` is a fraction of **total** VRAM, and
concluded restore order "is not actually load-bearing" — I even wrote that into the
README before the seats came back. Wrong: the fraction sets the *target*, but vLLM
gates startup on **free** VRAM, refusing to start unless the whole target is
available right now. GPU0 runs at ~96.4/97.9 GB with ~0.4 GiB of slack, so the two
seats coexist **only in the order they were originally brought up**, and meromero
is the one that does not fit in the remainder. The old auto-memory note ("gen takes
a fraction of FREE VRAM at startup and will starve meromero") was pointing at a
real effect; my correction of it was the error.

Recovery: `docker stop vllm-gen` → wait for meromero `healthy` → `docker start
vllm-gen`. Sequence-and-verify, not sequence-and-sleep — a `sleep 10` against a
2-3 minute weight load is simultaneity, not ordering.
(Generalises [[feedback_confirm_reboot_by_observing_down]]: gate on the observed
state, not on elapsed time.)

**Restore verified against the pre-window baseline, not just "it's green."** Both
seats `healthy`, `RestartCount=0`, and — the check that actually matters — the KV
pools match what they were before the session:

| | pre-window (18:32) | after restore (20:06) |
|---|---|---|
| gen KV | 14.36 GiB, 403,065 tok, **1.54×** | 14.34 GiB, 401,550 tok, **1.53×** |
| meromero KV | 542,202 tok | 542,202 tok |

⚠️ **Do not read raw `nvidia-smi` used-MiB as the restore check.** GPU0 shows
89,503 MiB used now vs 96,376 before, which looks like a 6.9 GB regression and is
not one — the delta is allocator slack, and serving capacity (KV pool, max
concurrency) is identical. The genuinely anomalous boots were the *high* ones
(34.95 GiB KV at 19:50/19:55/20:00), where gen came up on an empty card mid-window
and grabbed more than its steady-state share. Card now sits at 7,746 MiB free vs
~1,500 before, which is more co-tenancy slack, not less. Summarizer smoke-tested
end-to-end through LiteLLM after the restore.

### Three durable process lessons from the measurement

1. **★ Report abliteration KL SPLIT BY PROMPT CLASS.** A single averaged KL over a
   mixed corpus is close to meaningless, because the metric is *supposed* to be
   large on harmful prompts and small on benign ones — averaging them together
   lets a blunt abliteration and a surgical one produce the same number. The
   selectivity ratio is the quantity with information in it.
2. **★ "50 GB" was 50.10 GiB mislabelled — and the 3.7 GB gap changed the runbook.**
   Text-only weights are **51,300 MiB**; GPU0's tenants are meromero 50,072 and gen
   46,304, so freeing *either alone* leaves ~50,933 MiB — ~400 MiB short. The
   runbook's "only gen must go" was wrong. **Both seats must stop.** Size VRAM from
   the safetensors headers, never from a remembered gigabyte figure.
3. **★ You cannot release a 27B model in-process; give each model its own process.**
   Measured twice: `del model` + `gc.collect()` + `empty_cache()` left free VRAM at
   45,287 MiB, and so did confining the model to an inner frame that exits. The
   first run only worked because PyTorch's allocator hit OOM on the second load,
   collected, and retried — *rescue, not design*. On this architecture a silent
   CPU offload does not error; it zeroes the residual stream past the boundary and
   returns confident garbage. Also: the old residency gate read `hf_device_map`,
   which is **empty when the model fits on one device** — so it printed
   "(unsharded)" and could never fail. It now reads parameter devices directly.

## Still owed before this is a gen-seat candidate

- Canonical refusal re-profile via `services/refusal-probe/` (not the ad-hoc
  battery) once L35 is served — confirm creative refusals near the Robinson 8%
  floor, self-harm intact.
- **MTP acceptance on the NVFP4 quant** — the whole reason this model was chosen
  over the Heretic seat (in-band MTP edit vs byte-identical graft). Quantize via
  `services/gen-seat-mixed-quant/`, gate ≳40% ([[reference_abliteration_mtp_lessons]]).
- **Do NOT delete the incumbent** `qwen38-27b-heresy-nvfp4-mixed` until L35 holds
  through real multi-turn use (2026-08-14 delete-too-early lesson).

Direction artifacts kept: `refusal-direction.L35-416.pt` (the winner),
`.L18-416.pt` (the no-op, for the record), `refusal-direction.pt` (= L35, latest
capture). The dead L18 abliterated checkpoint (52 GB, confirmed no-op) was removed.
Supersedes [[2026-08-20-coldfusion-abliteration-capture]] (that session's fp32 /
small-set framing is now known wrong).
