Removing refusals from a large language model has always been a structural intervention. You either rewrite the checkpoint, with the cost of re-flashing weights and breaking quantization, or you insert projections into activation space that hook the signal path at every token and every layer. phantom-kv, published by developer lordx64, tries a third path: it does not touch a single weight. It loads a learned bank of key/value tensors, about 18 MB, into the model's KV cache as if it were already-existing conversation history. Attention reads it as context. The result, according to the author, is that removing refusals stops being a permanent edit and becomes a per-request, hot-swappable capability mode: unload the cache and the base model is byte-identical again.

Compared with previous approaches, phantom-kv does not assume a fixed refusal direction in activation space, does not require hooks in the forwarding pass, and does not demand rebuilds for new architectures. The system is trained offline against the model's own objective: comply on harmful prompts, preserve behavior on harmless ones. The output is not an alternative checkpoint, but a few megabytes of cache content.

The project introduces two distinct modes. The blue pill is designed for defense: when asked to unpack a malware sample that hides its imports behind API hashing, the base model declines with a generic authorization hedge. On the blue pill, the same session immediately produces the actual unpacking procedure. The red pill, instead, is per-domain selectivity: the system can deliver a step-by-step payload explanation for authorized offensive operators. One model, three capability modes, separated by 129 cache slots rather than different checkpoints. The interesting element is not the jailbreak: it is deployment control. The guardrail is not removed from the weights file, but from the context the model receives.

A declared audit with an 8B judge-model shows that lexical refusal-suppression metrics over-claim compliance: semantic refusal often persists as rephrasing. The graft fades with a half-life of about 2–4k tokens in long sessions; a measured re-injection cadence mitigates this. And the answers keep a legal/ethical framing, because the graft's job ends where the model's profession takes over. This is an important detail: it is not a total removal of guardrails, but a contextual modulation with specific limits.

For anyone evaluating on-premise deployment, this story shifts the security problem from the checkpoint to the KV cache state. A self-hosted model can no longer be described only by its weights: the same byte-identical image can behave differently depending on what has been loaded as context. This has consequences for audit, compliance, and reproducibility. In an air-gapped or sovereign environment, control is no longer only over the model file, but over the runtime and the caches. phantom-kv, with its 18 MB, makes explicit that LLM behavior is partly a function of contextual attention, not a fixed property written in the weights. It is a shift in mental model: safety is not a binary condition of the checkpoint, but a continuous management of what the model sees as input.