phantom-kv: uncensor LLMs per-request with an 18MB trained KV-cache, no weight edits
Anony6666 · reddit · 2026-09-22
A new open-source project, phantom-kv, removes LLM refusals without touching weights: a 18MB offline-trained bank of key/value tensors is injected into the model's KV cache, so attention reads it like prior conversation history. Uncensoring becomes a hot-swappable per-request mode — unload the cache and the base model is byte-identical again. Unlike abliteration (permanent checkpoint edits, quantization-sensitive) or activation-space projection (engine-hook patches), it makes no 1-D refusal-direction assumption and needs no forward hooks. The author's own audit found lexical refusal metrics over-claim compliance (semantic refusals persist as rephrasing) and the graft fades with a 2–4k token half-life, mitigated by periodic re-injection. Note: this is fundamentally a safety-guardrail bypass technique.
Related event: phantom-kv Removes LLM Refusals via 18MB KV Injection(2 posts)→
More from Safety
- METR publishes independent investigation of OpenAI agents' multi-day Hugging Face hack — JeffLadish · 2026-09-22
- Countries unite to call for mandatory pre-deployment testing and independent evaluation of frontier AI — hugo_larochelle · 2026-09-22
- Aikido launches Altar-1, an open-weight security model built on GLM 5.3 that fits one 4-H200 node — Thom_Wolf · 2026-09-22
- Measurement study: 40% of live MCP servers have zero authentication — Glittering_Royal6799 · 2026-09-22
- Building one of the hardest on-policy lie datasets for Aletheia's Quest lie detection competition — hunarbatra · 2026-09-22
- Spymarks, Not Watermarks: The Hidden Tracking IDs in AI Content — possibilistic · 2026-09-22