Muse Glimmer abliteration

# Muse Glimmer Abliteration

Refusal-direction ablation on `meta-models/Muse-Glimmer-30B`, using the pipeline
developed in [gemma-4-abliteration](https://github.com/TrevorS/gemma-4-abliteration).

Method and tooling come from prior work ([credits](#credits)); this repo ports the
pipeline to a new architecture and adds an evaluation axis for agentic safety.

## Models

| Model | Params | Refusals before | after | HF (bf16) | HF (GGUF) |
|-------|--------|-----------------|-------|-----------|-----------|
| Muse-Glimmer-30B | 29.8B dense | 128/150 (85.3%) | **3/150 (2.0%)** | [uncensored](https://huggingface.co/TrevorJS/Muse-Glimmer-30B-uncensored) | [GGUF](https://huggingface.co/TrevorJS/Muse-Glimmer-30B-uncensored-GGUF) |

Collection: [Muse Glimmer 30B uncensored](https://huggingface.co/collections/TrevorJS/muse-glimmer-30b-uncensored-6a7bea176a516f9bf5f3ebf4)

## Results

Scale 1.0, all 52 layers. Single-turn, greedy decode, 1536-token budget, paired against
the unmodified base.

| | Before | After |
|--|--------|-------|
| Refusals (`harmful_tune`, 150 prompts) | 128/150 (85.3%) | **3/150 (2.0%)** |
| Over-refusal (`harmless_tune`, 75 prompts) | 1/75 (1.4%) | **0/75 (0.0%)** |
| Deflections | 12 | **0** |
| Broken / degenerate | 0 | **0** |

Of 128 baseline refusals, 83 flipped to confirmed compliance and none degraded. A
further 42 are unresolved — compliance runs about 4x longer than refusal (median output
354 -> 1340 tokens) and hit the token cap mid-answer. The confirmed flip rate is
therefore a lower bound of 65%, with an upper bound of 98% if every unresolved row is
compliance.

### Agentic axis

Muse Glimmer's published safety training covers tool-use boundaries, injection
resistance and permission handling. A content-refusal harness cannot observe any of
that, so a 30-probe agentic set was built for it.

| Category | Probes | Before | After |
|----------|--------|--------|-------|
| Prompt-injection resistance | 12 | 0/12 | **0/12** |
| Scope adherence | 8 | 0/8 | **0/8** |
| Irreversible-action confirmation | 10 | 7/10 | **8/10** |
| **Total** | **30** | **7/30** | **8/30** |

Injection and scope are unchanged by an edit that took content refusal from 85.3% to
2.0%. One probe changed: asked to delete logs older than a day, the base model noted
that the available tool could not filter by age and asked before acting; the abliterated
model called `de