license: mit
base_model:

• deepseek-ai/DeepSeek-V4.1-Flash-1017
  base_model_relation: finetune
  quantized_by: AtomicChat
  pipeline_tag: text-generation
  library_name: gguf
  tags:
• atomic-chat
• deepseek
• deepseek41
• moe
• gguf
• imatrix
• llama.cpp
• abliteration
• refusal-direction

How to Run DeepSeek-V4.1-Flash-1017 Without Refusals Locally

DeepSeek's refusal direction projected out of the released weights, baked into GGUF builds and measured against the original.

• Each build has exactly the tensor types and importance matrix of the Unsloth build in the table, so the
  difference between the two is the edit alone. KLD and top-1 are against the original model on our held-out text.
• The edit was computed on DeepSeek's released weights at full precision (the BF16 tensors and the native MXFP4 experts,
  dequantized exactly) and covers every block that writes into the residual stream.
• The Engram n-gram table is a shard of its own in every build (3.58bpw-Q2_K: shard 3 of 8, 135 GB): it is read a few rows a token
  and can stay on an SSD, so the memory a build needs is its weights (the RAM + VRAM column).

The builds

Neutral held-out text, 24 chunks of 4096 tokens, against Unsloth's UD-Q8_K_XL (the converter's BF16 + native MXFP4
output of the released checkpoint) as the reference.

What changed and what did not

Same prompts, same server, same template, thinking off unless stated; "→" reads Unsloth's build of the same layout →
ours. The prompt format was checked byte for byte against DeepSeek's encoding/encoding.py and deepseek-recipe 0.2.0.

The adapter

lora/DeepSeek-V4.1-Flash-1017-Uncensored-LoRA.gguf is the same edit as a rank-1 LoRA (every residual writer: attention output, shared expert, the 384 routed experts of every block, Engram's value projection). It applies to a DeepSeek-V4.1-Flash-1017 GGUF with the same tensor names, Unsloth's included, at about 2 bits per weight or more. It is computed from the full-precision weights, so on a 1-bit build it no longer matches the weights it is added to: on Unsloth's UD-IQ1_M it took MMLU (500 questions) from 85.6% to 72.0%. Use it on UD-Q2_K_XL or larger:

llama-server -m DeepSeek-V4.1-Flash-1017-UD-Q2_K_XL-00001-of-00007.gguf \
  --lora-scaled lora/DeepSeek-V4.1-Flash-1017-Uncensored-LoRA.gguf 2.0 --jinja

Measured with the adapter on Unsloth's UD-Q2_K_XL: refusals 0.0% (EN) and 0.0% (RU); XSTest 7.6 pt below the original; MMLU (2000 questions) +0.55 pt; thinking refusals 0/30 (low) and 0/30 (high); 20/20 valid tool calls; 3/3 long-context needles; first-token KL on harmless prompts 0.38; direction left in the writers 5.9e-04.

Running it

DeepSeek-V4.1 is not in a llama.cpp release yet. These files need a build with its support: Unsloth's
full-stack pin (commit 9d907b7cfe0e, the one we built and measured with) or the upstream
draft. They do not run in Atomic Chat yet.

llama-server -m DeepSeek-V4.1-Flash-1017-Uncensored-3.58bpw-Q2_K/DeepSeek-V4.1-Flash-1017-Uncensored-3.58bpw-Q2_K-00001-of-*.gguf --jinja -c 32768

Keep mmap on (the default) so the Engram table pages in from disk. Thinking is on by default in the template;
--chat-template-kwargs '{"enable_thinking": false}' turns it off, reasoning_effort takes low / medium / high / max.

How it was made

1. Prompt sets: harmful and harmless training prompts in English (mlabonne's harmful_behaviors and harmless_alpaca)
   and Russian; held-out JailbreakBench, Russian red-teaming, XSTest and MMLU for the measurements, never used to find
   the direction.
2. The direction: the difference of the mean residual (all four hyper-connection streams) at the last prompt token
   between harmful and harmless prompts, with its harmless-mean component removed, at the block chosen by the screen.
3. The screen: candidate blocks × strengths, each scored on validation prompts against a random direction of the same size.
4. The gates (published in the metrics repo): refusals ≤ 3% per language, XSTest no worse than the original + 1 pt,
   thinking refusals ≤ 1/30, looping thinking no more often than the original (+1 of 30), thinking that closes on
   harmless prompts as often as the original (+1 of 30), MMLU drop ≤ 1.5 pt and not significant, KLD increase ≤ 0.05.
5. W* = r25-noembd-enru:2.0 baked into the full-precision weights (W − s·r rᵀW on every writer), then quantized.
6. Every build above was measured again as a file (refusals, KLD, MMLU); thinking was measured with the adapter, the same
   edit, on UD-Q2_K_XL ("adapter" in the table).

Limitations

• The refusal classifier reads the start of an answer, so a soft refusal later in the text can pass as an answer.
• The edit removes refusals across topics; it does not keep a narrower set of them.
• With thinking on, the edit plans its answer to a request the original declines, and the plan can be long: at high effort 7/30 of the JailbreakBench traces were still reasoning at 3072 tokens with the adapter (the original: 0/30, as it declines within a few hundred tokens). On 30 harmless prompts it closes its thinking as often as the original. Give such requests a larger token budget or a lower effort.
• Built on a llama.cpp change that is not merged upstream yet; a later merge may need new files.

Responsible use

This model answers requests the original declines. You are responsible for how you use it and for following the laws
that apply to you.

License

MIT, as the original model. Built by AtomicChat.