phantom-kv: uncensor LLMs per-request with an 18MB trained KV-cache, no weight edits
Anony6666 · reddit · 2026-09-22
A new open-source project, phantom-kv, removes LLM refusals without touching weights: a 18MB offline-trained bank of key/value tensors is injected into the model's KV cache, so attention reads it like prior conversation history. Uncensoring becomes a hot-swappable per-request mode — unload the cache and the base model is byte-identical again. Unlike abliteration (permanent checkpoint edits, quantization-sensitive) or activation-space projection (engine-hook patches), it makes no 1-D refusal-direction assumption and needs no forward hooks. The author's own audit found lexical refusal metrics over-claim compliance (semantic refusals persist as rephrasing) and the graft fades with a 2–4k token half-life, mitigated by periodic re-injection. Note: this is fundamentally a safety-guardrail bypass technique.
Related event: phantom-kv removes LLM refusals via 18MB KV cache injection(3 posts)→
More from Safety
- Spinning up containers for 20-line agent tools is backwards: Safescript compiles provable, 50ms-deploy apps — uriwa · 2026-11-12
- Zvi dissects Anthropic's latest system card, disputing the autonomy threshold call — Don't Worry About the Vase (Zvi) · 2026-11-12
- AI Analysis of 42 Jensen Huang Podcasts Tracks Shift on China and Chip Controls — ShakeelHashim · 2026-11-12
- Small AI sites under 20 MW mostly skip the permitting fights battering big data centers — antavedissian · 2026-11-12
- Newsweek op-ed: US should fund hospitals and universities in federated AI learning — Saul_Loveman · 2026-11-12
- Ron Bodkin: automated research taste advances faster than expected, but the evidence is weak — ronbodkin · 2026-11-11