Open-source tool 'phantom-kv' released to bypass LLM censorship

Developer lordx64 has released phantom-kv, a tool that bypasses LLM censorship without modifying any model weights. The tool loads a learned Key/Value tensor bank of approximately 18MB into the model's KV cache as context, causing the model to recognize it as existing conversation history.

How it works and features

Existing censorship removal methods (such as Abliteration in weight space, projection in activation space, etc.) required permanently modifying checkpoints or using runtime hooks. In contrast, phantom-kv has the following differentiators:

• Non-invasive injection: It works by utilizing the model's input channels (attention) as they are already consumed, requiring no weight rewriting or engine patching.
• Hot-swappable: Unloading the cache restores the model to be byte-for-byte identical to the original. Censorship bypass mode can be toggled on and off per request.
• Architecture independence: It is not dependent on specific architectures and does not break depending on quantization methods.

Limitations and verification

The developer pointed out through self-verification that lexical refusal suppression metrics may overestimate compliance rates, and confirmed that effectiveness decreases in long sessions (approximately 2~4k tokens half-life). To mitigate this, periodic re-injection is required, and bypassed responses may include legal/ethical framing.