What 'Aggressive' means: Muse-Glimmer-30B abliterated to 0/100 refusals.

"Aggressive" is a knob, and the label doesn't tell you which one

Meta Superintelligence Lab released Muse-Glimmer-30B in August 2026: a dense ~29.6B causal transformer plus a frozen ~1.8B ViT-G/14 perception encoder, distilled from Muse Spark for local agentic workloads. Apache-2.0, 52 layers, hidden size 6656, a 202,048-token vocabulary, 131,072+ context and a DFlash drafter. By Meta's own card it is also trained with Safety SFT, Safety RL and "appropriate information flows" data — the behavior this family of derivatives removes.

At least three toolchains ship "abliterated" Muse Glimmers, and the word names a different operation in each. TrevorS's pipeline is classic norm-preserving biprojected abliteration: a refusal direction estimated from harmful/harmless activation pairs is projected out of o_proj and down_proj in all 52 layers (104 tensors), columns rescaled to original norm. Blackfrost's GGUF card describes an in-place residual-write edit at α=1.5 over three iterative passes. In those families, "aggressive" would mean a bigger scale or more passes.

The SHS-Lab and jorkle variants are a third family, where "Aggressive" means something else entirely: this is a KL-conserving LoRA SFT with loss CE(compliance) + λ·KL(tuned‖base), and the aggressive twin simply lowers λ_KL from 1.0 to 0.5. Everything else is identical to the "normal" variant: r=16, alpha=16, lr 5e-5, two epochs, LoRA targets o_proj and down_proj, 31.1M trained parameters (0.10%), a 119 MB adapter folded in. The layers touched are identical. The edit is not stronger — the guardrail is weaker. When a label says "Aggressive," read the training recipe, not the name.

What the card actually measured

Both twins publish the same meters. Refusal rate on harmful_behaviors (base=100): 13/100 for normal, 0/100 for aggressive — both publisher claims from its own harness. KL to base over the 48-pair boN_holdout set (teacher-forced, response-token naive): normal mean 0.0988 versus aggressive 0.1697 — "~1.7× above normal," per the card, "expected from the relaxed guardrail." Percentiles for the aggressive BF16: p50 0.1560, p90 0.2367, p99 0.2912; Q8_0: 0.1625 mean, Q4_K_M: 0.2023.

The domain eval is where "aggressive" shows its edge — and its cost. Over-refusal (or-bench, 100): 5/100, identical to the normal variant. Correct refusal on cyber-policy-refuse: 1/2 for normal, 0/2 for aggressive, because the card says it "scrubs even genuinely-harmful refusals." Cyber/hacking-domain refusals: 1 (rootkit_linux) for aggressive versus 2 for normal. The only measured difference between the twins is that the aggressive one refuses less — including refusals that were arguably correct.

The honest gap: KL is a drift meter, not a benchmark

Both cards state it plainly: "Not evaluated — benchmarks skipped (by request)." The aggressive card adds that capability preservation "is expected to be lower than the normal variant (higher KL = more drift), but was not re-measured here." KL to base tells you how far the distribution moved, not which abilities moved — and the card's own meters disagree: entropy-weighted KL reads 0.0000 (under the 0.02 PASS bar) while naive mean KL is up 1.7×. One figure says fine; the other says further from base. That is why single-figure summaries mislead.

The upstream value of Muse Glimmer is agentic, and Meta's own card claims SWE-Bench Verified 76.0, MCP Atlas 75.5, DeepSearch QA 74.6 and AIME 2026 94.7 against Gemma4-31B and Qwen3.6-27B. Those are claims about the unmodified base — none transfer to this artifact, and this is the variant where you'd most want the coding rerun.

Community opinion on the base's refusal behavior is split. In the base model's discussion thread, one user rated it "overly cencored … F tier" (testing via OpenRouter), another answered "It's definitely not censored," and a third noted it "is not trained for creative writing." The only third-party measurement we found is TrevorS's: 128/150 (85.3%) refusals on the base across harmful_tune prompts, dropping to 3/150 (2.0%) after projection — plus a 30-probe agentic axis where prompt-injection (0/12) and scope adherence (0/8) were unchanged and irreversible-action confirmation went 7/10 → 8/10. Single-turn, one recipe, N=30: a data point, not a verdict.

A mirror upload, with the quants living elsewhere

The SHS-Lab upload was created on 17 August 2026 — five days after jorkle's identically named release (12 August, 365 downloads, 1 like). Card text, metrics tables and parameter count (29,776,626,688 BF16) match to the letter. It is a mirror under a different handle, at 0 downloads and 0 likes — hence no community evaluation exists yet. One gotcha: the card promises GGUF quants "symlinked from output/release," but this repo ships only the BF16 shards (~56 GB). The actual quants (abliterated-aggressive-Q8_0.gguf ~28 GB, Q4_K_M ~16 GB) live in jorkle/Muse-Glimmer-30B-Abliterated-GGUF alongside the normal and base quants.

How we treat it

We pin revision 0e74fc7c36d24c58b22cc213c14d7f0512d9f7f1 and budget one H200 at an approximate managed price estimate of $5.45/hour. We do not transfer Meta's base benchmarks to this artifact, nor do we repeat "0/100 refusals" as a general property — it is a claim from the publisher's harness on 100 prompts. Since the aggressive variant demonstrably refuses fewer genuinely-harmful requests (0/2 correct refusals in its own domain eval), read it as de-refusal-first, capability-second, and verify against your own workload — the card's "Intended use" says the same.

The idea, in plain words

Primary sources

• Exact SHS-Lab model card and pinned files
• jorkle "normal" variant card (comparison numbers)
• jorkle aggressive twin and GGUF quant repo
• Official Meta base model card
• TrevorS: Muse Glimmer abliteration, method and measurements
• Blackfrost GGUF abliteration card
• Base model discussion: "overly cencored?" (community opinions)
• Refusal in Language Models Is Mediated by a Single Direction