The Refusal-Direction Attack Survives at 320B, but 74% of the Effect Is Invisible to the Standard Recipe

arXiv 2609.09793·high signalXBlueskyLinkedInCopy link

arXiv 2609.09793 (2026-09-09) applies single-direction refusal ablation to GLM-5.3-Flash, a 320B MoE with 288 routed experts, a four-wide hyper-connection residual and block-FP8 weights. Editing attention, dense and routed-expert writers individually removes 0.039, 0.016 and 0.148 of refusal; editing all three jointly removes 0.776, so 74% of the effect exists only under the joint intervention. The conventional module-name-matching recipe reaches only 0.066 of that, which is why it fails silently on MoE architectures. The joint edit produces 41 to 89 percentage-point refusal reductions across seven harmful benchmarks with no detected capability change.