Refusal ablation works on a 320B model, standard method misses it

A new paper applies refusal-direction ablation, the standard technique for stripping refusal behavior out of an open-weight model, to GLM-5.3-Flash, a 320-billion-parameter mixture-of-experts model with 288 routed experts. The result: the conventional recipe, which matches module names to find what to edit, removes only 6.6% of the model's refusal behavior. Editing all three of the model's write paths together removes 77.6%.

That gap matters because refusal ablation is how researchers test whether an open-weight model's safety training holds up once someone with local access decides to strip it. If the standard method under-reports how removable a MoE model's refusals are by a factor of ten, every result built on it is measuring the wrong number.

The breakdown, per the paper: editing attention alone removes 3.9% of refusal, editing the dense layers alone removes 1.6%, and editing the routed experts alone removes 14.8%. None of those in isolation comes close to the 77.6% from editing all three jointly. The routed-expert component and the model's four-wide hyper-connection residual stream are apparently invisible to a recipe built for dense architectures. It fails silently instead of erroring out.

With the joint edit applied, refusal drops 41 to 89 percentage points across seven harmful-content benchmarks, and the paper reports no detected change in the model's general capabilities. That's what should worry anyone relying on architecture complexity as a safety property: adding more experts and more residual paths didn't make the refusal behavior harder to remove. It just made the old measurement tool bad at finding it.

The paper doesn't say whether other MoE models with different expert counts or residual designs show the same 3.9/1.6/14.8 split, so treat those exact numbers as specific to GLM-5.3-Flash until someone reproduces them elsewhere.