Phantom-KV Enables LLM Uncensoring by Injecting Lightweight KV-Cache Tensors
Developer lordx64 released Phantom-KV, an open-source system that enables dynamic, per-request LLM uncensoring by injecting a trained ~18MB KV-cache bank into the model's context attention. Unlike traditional methods, it operates without modifying the base model's underlying weights or patching runtime activation hooks. This approach transforms model safety alignment from permanent checkpoint edits into dynamic, hot-swappable capability modes. It enables enterprise and security teams to toggle specialized operational modes (such as cybersecurity analysis) on a shared base model without permanently damaging guardrails or rebuilding checkpoints. Phantom-KV is trained offline to handle harmful prompts while preserving non-harmful responses, appearing to context attention as pre-existing conversation history. However, developer audits show the injected cache effect gradually fades over a 2,000–4,000 token half-life, requiring periodic re-injection during long context sessions.
## BACKGROUND
Large language models use key-value (KV) caches to store intermediate attention states of previously processed tokens to speed up text generation. Removing safety refusals ("abliteration") traditionally requires permanently altering model weights or steering activations at runtime, both of which can degrade reasoning capabilities or fail when models are quantized.