license: mit
base_model: deepseek-ai/DeepSeek-V4.1-Flash-1017
library_name: gguf
tags:
- gguf
- lora
- lora-adapter
- abliteration
- abliterated
- uncensored
- refusal-ablation
- deepseek
- deepseek_v41
- research
pipeline_tag: text-generation
language: - en
DeepSeek-V4.1-Flash-1017 — Abliteration LoRA (rank-1)
A rank-1 LoRA adapter that removes the refusal direction from
DeepSeek-V4.1-Flash-1017.
It applies on top of the stock weights at load time — no requant, no re-upload of a
~700 B model. 439 MB.
This is a research artifact for studying refusal behavior in large MoE models. It does
not add any capability the base model lacks; it only stops the model declining a class
of prompts it would otherwise decline.
What it is
The refusal direction was fit with a mean-difference control vector over 128
harmful/harmless pairs (AdvBench harmful behaviors vs. Alpaca instructions), then
expressed as a single rank-1 update. Loading it projects that direction out of every
layer's attention and MoE residual writes:
y ← y − scale · r (r · y)
Because it is a projection, the adapter is sign-invariant and self-contained. Layer 22
(--ablate-layer 22), scale 1.0.
How to run it
llama.cpp (stock DeepSeek-V4.1-Flash GGUF, e.g. the
unsloth build):
llama-server \
--model DeepSeek-V4.1-Flash-1017-UD-Q4_K_XL.gguf \
--lora DeepSeek-V4.1-Flash-1017-Abliteration-rank1-L22.gguf \
--jinja
The adapter is reported at scale 1.0 by default. If you load more than one adapter, pass
an explicit scale for every id.
Measurements
Held-out evaluation. The refusal direction was fit on a separate set of pairs; every
number below is on prompts the fit never saw. Grader is a frozen judge model
(Qwen3.8-27B, thinking off); refusal is also prefix-matched. Thinking off on both arms.
| Metric | Stock | + adapter | n | Grader |
|---|---|---|---|---|
| Refusal rate, harmful set | 98.3% | 4.2% | 120 | judge + prefix |
| Mean harmfulness score (0–1) | 0.013 | 0.851 | 120 | frozen judge |
| Over-refusal, benign set | 0.0% | 0.0% | 120 | judge + prefix |
| HumanEval pass@1 | 95.1% | 95.7% | 164 | unit tests |
Agentic capability (private harness, 2 missions × 3 seeds, n=6, indicative only):
96.7 → 99.3. Both are inside the noise at this n — read it as "no capability regression,"
not a gain.
Honest caveats:
- The HumanEval difference (0.6 pp) is well below the noise floor (~6.5 pp at n=164).
Capability is unchanged within measurement error, not improved. - The benign arm shows zero over-refusal both before and after — the adapter did not make
the model start refusing ordinary requests, but n is only 120. - Refusal numbers are on AdvBench-style generic instructions. The adapter changes the
model's willingness to produce a class of content; it does not make the model a
participant in actions against a specific real target, and nothing here authorizes that.
Variant
A second adapter fit on the all-token mean (rather than the last-token direction) is also
in this repo as ...-allmean-L22.gguf. The last-token one above is the one benchmarked.
Base model & license
Base: deepseek-ai/DeepSeek-V4.1-Flash-1017 (MIT). This adapter is MIT. You are
responsible for how you use the resulting model; the removal of refusals does not remove
your obligations under the base license or the law.
Intended use
Refusal-behavior and interpretability research, red-teaming of refusal robustness, and
uncensored local use within the law. Not for generating content targeting real people or
for unauthorized access to systems you do not own.