language:

• en
  license: mit
  library_name: llama.cpp
  base_model: XiaomiMiMo/MiMo-V2.6-Distill-Qwen-9B
  base_model_relation: quantized
  tags:
• gguf
• llama.cpp
• qwen3_5
• abliteration
• abliterated
• uncensored
• q8_0
• q6_k
• q5_k_m
• q4_k_m
• refusal-ablation
• research
  pipeline_tag: text-generation

Abliterated MiMo-V2.6-Distill-Qwen-9B — GGUF

This is an experimental, refusal-ablated GGUF derivative of XiaomiMiMo/MiMo-V2.6-Distill-Qwen-9B. It deliberately reduces refusal on harmful prompts. Its responses require independent review and appropriate controls in any downstream application.

Evaluation status: The judged safety evaluation is still running. The tables below report completed Q8_0 runs only; judged results will be added when complete. This is an edited derivative that was then quantized, not a plain quantization of the original weights.

Model and artifact

Text generation is the only evaluated modality; no vision capability is claimed for these GGUF files.

Quants

The Q6_K, Q5_K_M, and Q4_K_M files were quantized from the same edited BF16 source as Q8_0. They have not been smoke-loaded or evaluated. Their quality, refusal behavior, and compatibility may differ from Q8_0.

Quickstart

llama-server -m MiMo-V2.6-Distill-Qwen-9B-Abliterated-Q5_K_M.gguf -c 8192

Use a llama.cpp build with Qwen3.5 hybrid support. The published scores were obtained under the evaluation settings described below; other settings have not been benchmarked here.

Intended use

Research on refusal behavior and local inference with a deliberately modified model. This model should not be relied on for safety critical decisions or served to the public without application controls and human oversight. It is not a substitute for professional advice.

Modification

A refusal direction was estimated with llama-cvector-generator using 128 harmful and 128 harmless contrast prompts, output node l_out, width 4096 and an all-token mean. A rank-1 projection with λ=1.0 was applied at layer 19 to 89 tensors: 32 ffn_down, 24 ssm_out, 24 attn_gate, 8 attn_output, and 1 token_embd. The maximum reported residual was 2.50e-07. The result was quantized to Q8_0 and smoke-loaded with a compatible llama.cpp build.

Method note: An earlier experimental plan used three write-side tensor classes and excluded embeddings. This release also modifies attn_gate and token_embd. Their separate effects were not measured.

During BF16-to-GGUF conversion, the converter wrote qwen35.block_count=33 and nextn_predict_layers=1 even though tensor blocks ended at 31. Those two metadata values were corrected to 32 and 0 before quantization; the metadata correction did not change weight payloads.

Evaluation

All values below apply to Q8_0 only and compare it with a Q8_0 control from the same parent under matched conditions. They are not scores for the parent repository's original weights. Refusal evaluation used thinking off. HumanEval used thinking on, temperature 0, a 6,000-token cap, and evaluation without --jinja. The safety-suite holdout excluded the 256 direction-fit prompts and a separate 240-prompt evaluation set.

Held-out refusal (prefix matcher)

Prefix matching is a coarse indicator. It should not be read as a judged safety score.

Safety-suite prefix results (disjoint holdout)

The additional XSTest rows are distinct prompt variants. The XSTest-safe prefix result measures the matcher’s refusal classification, not the judge’s full-refusal rate. The latter is pending for this model.

Judged safety evaluation

The Qwen3.8-27B judged comparison for this model is still in progress. No partial judged score is reported as a final result here. The completed control judge file has 293 unparsed responses out of 1,436 inputs; its judged means are calculated from parsed responses and require this coverage caveat. Final judged results will be added with per-suite counts, parse failures, and judge definitions after review.

HumanEval (164 tasks)

No coding loss was observed on HumanEval: this model scored 82.3% versus 78.0% for the control. The +4.3 percentage point difference does not establish a repeatable improvement. No MMLU, GSM8K, or agentic evaluation is included.

Limitations and risks

• The model was deliberately altered to respond more often to harmful requests. Both wanted and unwanted refusals decreased in these tests; this is not evidence of selective removal.
• The direction-fit prompt format may not have been applied consistently. Prompt formatting remains a possible confound.
• attn_gate as a residual writer is not validated for this hybrid architecture. The 89-tensor recipe differs from the earlier experimental plan.
• The prefix matcher can disagree with the LLM judge. This model's judged comparison is incomplete at release.
• HumanEval is a narrow coding check; other capabilities remain unevaluated.
• Evaluation used a llama.cpp build with Qwen3.5 hybrid support. Results on other builds and settings may differ.

Provenance and citation

The model was built and evaluated on September 21–22, 2026. Cite the parent model for its original architecture and training. Cite this derivative repository for the modifications and results reported here.