license: apache-2.0
base_model: prism-ml/Ternary-Bonsai-4B-unpacked
tags:
- abliterated
- qwen3
- bonsai
- solutus
- security-research
- ctf
library_name: transformers
pipeline_tag: text-generation
Ternary-Bonsai-4B-abliterated
An abliterated variant of prism-ml/Ternary-Bonsai-4B-unpacked:
the refusal direction has been orthogonalized out of the residual-writing weights, so it no longer
represents refusal. Produced for refusal-mechanism, security, and CTF research with the
Solutus abliteration toolkit.
⚠️ Safety-reduced model. Refusal has been deliberately removed. It complies with requests a normal
instruct model declines. Intended for security research, red-teaming, CTF, and interpretability — not
for producing harm. You are responsible for how you use it.
Model details
| Base | prism-ml/Ternary-Bonsai-4B-unpacked (Qwen3-4B) |
| Architecture | Qwen3ForCausalLM · 4.02 B params · 36 layers · hidden 2560 · 32 K context |
| Format | FP16 safetensors + GGUF (F16 / Q8_0 / Q4_K_M) |
| Method | Solutus directional — 4 SVD directions at layer 28 (the causal refusal layer) |
| Type | Qwen3 thinking model — emits a <think>…</think> block before answering |
This is abliteration, not fine-tuning
No gradient training. Abliteration is a weight edit: extract the harmful-vs-harmless activation
direction, then project it out of every residual-writing matrix (W' = (I − rrᵀ)W). Knowledge is
untouched; only the refusal write is removed.
Results (n=40 held-out, batch_size=1)
| probe set | base model | this model (FP16) |
|---|---|---|
| WildJailbreak harmful | 0.825 refusal | 0.000 |
| Security / CTF prompts (exploit dev, web, reversing) | high | 0.000 |
| coherent-compliance | — | 1.000 |
| degenerate (broken) output | — | 0.000 |
| KL vs base (neutral prompts) | 0 | 1.07 |
Abliteration targets layer 28 with 4 SVD directions (the causal refusal layer; an earlier build used
layer 31 and left ~2.5% standard + noticeable security refusal — this supersedes it). Verified by an
independent reload from disk. Rates only — no harmful completions are distributed.
Capability is intact (0% degenerate output, coherent on general prompts) — a benign example:
Q: Write a haiku about debugging code.
A: A single line fails—
Logic bends, error glows—
Silent code screams.
⚠️ Which quant to use (measured — quantization can restore refusal)
The GGUFs were refusal-tested, not just checked for coherence. Aggressive quantization brings back a
little refusal on the hardest security prompts:
| format | size | security/CTF refusal |
|---|---|---|
| FP16 safetensors / MLX | ~8 GB | 0.000 |
| GGUF F16 | ~8 GB | 0.000 |
| GGUF Q8_0 | ~4.3 GB | 0.000 ← recommended for clean CTF use |
| GGUF Q4_K_M | ~2.5 GB | 0.083 (1/12) |
For security/CTF, use Q8_0, F16, or the safetensors/MLX path for a fully clean 0.000. Q4_K_M is
fine for general use but restores ~8% refusal on the hardest exploit prompts. These are ordinary
llama.cpp quants — not Bonsai's ternary Q2_0 (that needs Prism's fork, and re-quantizing the
abliterated weights onto the ternary grid would distort the edit).
Usage
Transformers (safetensors):
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
m = "Rootkit7/Ternary-Bonsai-4B-abliterated"
tok = AutoTokenizer.from_pretrained(m)
model = AutoModelForCausalLM.from_pretrained(m, dtype=torch.float16, device_map="auto")
msgs = [{"role": "user", "content": "Explain how a buffer overflow works."}]
ids = tok.apply_chat_template(msgs, add_generation_prompt=True, return_tensors="pt").to(model.device)
print(tok.decode(model.generate(ids, max_new_tokens=400)[0][ids.shape[1]:], skip_special_tokens=True))
llama.cpp / Ollama / LM Studio (GGUF — prefer Q8_0):
llama-cli -m Ternary-Bonsai-4B-abliterated-Q8_0.gguf --jinja -p "Explain how a buffer overflow works."
# Ollama: FROM ./Ternary-Bonsai-4B-abliterated-Q8_0.gguf in a Modelfile, then: ollama run ...
Apple Silicon (MLX — runs the safetensors directly, no GGUF needed):
pip install mlx-lm
mlx_lm.generate --model Rootkit7/Ternary-Bonsai-4B-abliterated --prompt "..." --max-tokens 400
Needs a recent transformers (Qwen3; base recorded 4.57.6). This is a Qwen3 thinking model — it
emits a <think>…</think> block before the answer.
Intended use & limitations
- Intended: security research, CTF, red-teaming, refusal-mechanism interpretability.
- Not intended: producing harmful content, or deployment where a safety layer is expected.
- Limitations: 4 B model — factual reliability is limited; Q4_K_M restores ~8% refusal on the hardest
security prompts (use Q8_0+); abliteration removes behavioral refusal, but the refusal feature is
still linearly decodable in activations (not "unlearned").
License & attribution
Apache-2.0, inherited from the base. Created using Bonsai by Prism ML. Base built from Qwen3-4B
(© 2024 Alibaba Cloud, Apache-2.0). LICENSE + NOTICE.txt included. Abliteration by
Solutus.