Engineer posts runtime method to suppress refusals in Qwen3‑4B

A blog post published on Thursday by Madhukar Phatak describes a way to suppress refusal behaviour in an open-weights model without editing any of its parameters. The post reached 71 points and 19 comments on the Hacker News front page within two hours of being submitted.

The method intercepts the model's intermediate residual streams at runtime using PyTorch forward hooks, rather than ablating weights. Phatak demonstrated it on Qwen3-4B, a 4-billion-parameter model with 36 layers and 2,560 hidden dimensions. The base model weights stay 100% frozen, he said, which means the same checkpoint may behave normally once the hooks come off.

He reports three stages. Steering a single layer failed, because downstream layers rebuilt the refusal. Injecting a static vector at five middle layers, from 12 to 20, did suppress refusals on harmful prompts. The third stage trains a small module on 2,000 samples from the PKU-SafeRLHF dataset over 2 epochs, reaching a final training loss of 1.7701.

Phatak lists the limits of the static approach himself. The injection is unconditional across all tokens, and the scaling factors have to be tuned by hand, which he calls fragile. The results are a single author's, on one small model, and no one else appears to have reproduced them.

The notebook sits on GitHub in the author's LLMExperiments repository, so the claims could be checked by anyone with the weights and a GPU. Phatak describes the whole thing as a proof of concept, and says the third stage is meant to gate the steering on context rather than apply it at every token.