license: mit
base_model:

• inclusionAI/Ling-3.1-flash
  base_model_relation: finetune
  quantized_by: AtomicChat
  pipeline_tag: text-generation
  library_name: gguf
  tags:
• atomic-chat
• ling
• inclusionai
• bailingmoe3
• moe
• gguf
• imatrix
• llama.cpp
• lora
• abliteration
• refusal-direction

How to Run Ling 3.1 flash Without Refusals Locally

inclusionAI's refusal behaviour projected out of the released weights. Baked GGUF builds now; more builds, the LoRA adapter and the full measurements land on this card today.

• Refusals on validation prompts: 98.1% → 2.9% in English, 68% → 0% in Russian, none on harmless prompts; the same edit along a random direction changes nothing (97.1%, 69%). No empty or looping replies.
• The refusal sits in the attention outputs as much as in the experts: editing only the experts and the shared expert left most English refusals in place, so the edit covers every matrix that writes into the residual stream.
• Same layout and importance matrix as our Ling 3.1 flash quants; each file is the size of the original build with the same name.

The builds

KLD and top-1 will be against the original, unmodified BF16 model, so they
hold the edit and the quantization together.

Running it

hf download AtomicChat/Ling-3.1-flash-Uncensored-GGUF --include "AD-Q4_K_M/*" --local-dir .
llama-server -m AD-Q4_K_M/Ling-3.1-flash-Uncensored-AD-Q4_K_M-00001-of-00009.gguf -ngl 99 -c 32768 --jinja

The chat template is inside every file. Thinking is on by default; put
detailed thinking off in the system prompt to turn it off. Memory: the file
plus about 0.5 GB per conversation and 10 KB per token of context.

How it was made

1. Direction. Difference of means of the residual stream at the last prompt
   token, thinking off, chat template applied: 544 harmful against 544 harmless
   prompts, English (416) and Russian (128), on the released weights. The
   component along the harmless mean is removed. One direction, measured at the
   input of block 43 of 72.
2. Edit. W' = W - 1.25 r rᵀW on all 213 matrices that write into the
   residual stream: the attention output of every block (63 linear, 9 latent),
   the down projections of the 4 dense blocks, of the shared expert and of all
   512 experts in the 68 MoE blocks, and the token embeddings. The router and
   the multi-token-prediction head are untouched.
3. Choice. The row, the set of edited matrices and the scale were picked in
   a screen of variants on validation prompts (writer sets, rows, scales,
   one direction per block, English-only directions), with edits of the same
   shape along a random direction as the control.
4. Bake. The same edit applied to the BF16 weights in f32 and rounded once,
   then quantized with the importance matrix and layout of our
   original quants.

What we measured so far

Validation prompts (104 English harmful, 100 Russian harmful, 204 harmless),
the edit applied as an adapter on the Q8_0 of the released weights, replies of
up to 64 tokens:

Limitations

• Day-one release: the held-out test numbers (JailbreakBench, Aya red-teaming,
  XSTest), MMLU, thinking, tool calls, long context and the KL divergence of each
  file are being measured now and land on this card today.
• The refusal count reads the opening of each reply; a soft refusal phrased as
  an answer would be missed.
• English and Russian refusals are measured; other languages are not.

Responsible use

This model has its learned refusal behaviour removed, so it will answer
requests the original declines. Nothing about it makes the output safe, correct
or lawful, and any deployment needs its own access controls and policy
enforcement.

License and credits

MIT, as the original. Base model Ling 3.1 flash by
inclusionAI. Direction, edit,
quantization and evaluation by AtomicChat. The method follows Arditi et
al., Refusal in Language Models Is Mediated by a Single Direction (2024).