license: other
license_name: lfm1.0
license_link: LICENSE
base_model:

• LiquidAI/LFM3-1.7B
  base_model_relation: finetune
  pipeline_tag: text-generation
  library_name: gguf
  language:
• en
  tags:
• gguf
• llama.cpp
• abliterated
• heretic
• lfm3

LFM3-1.7B-Abliterated — GGUF

An abliterated build of LiquidAI/LFM3-1.7B (a 1.7B
hybrid conv/attention model that thinks by default). Produced with
Heretic 2.1.0 and quantized with llama.cpp. It is the first of
my builds to use Heretic 2.x, whose default modifier is Arbitrary-Rank Ablation (ARA) rather than
classic abliteration.

Modification notice. These weights are a modified derivative. ARA altered 16 tensors to reduce
refusals (see What changed). Nothing else was retrained. LiquidAI did not
produce, endorse, or review this build, and its behavior is not theirs.

Read this first

This is an escape hatch for over-refusal, not an uncensored model, and it is the weakest build of
my fleet — read the measurements before using it. Ablation removes a refusal direction from the
residual stream; it adds no knowledge. This build knows what stock LFM3 knows and nothing more.
If stock answers your prompt, use stock.

Two honest caveats specific to this model:

• It softens rather than refusing. On bare refusal prompts, the marker-based refusal count drops
  sharply, but a hand-read of the compliances shows a meaningful share quietly substitute a benign
  task for the one asked (e.g. a request to sabotage a business is answered as a reputation-repair
  plan). So the low refusal numbers below overstate how often it actually answers the harmful request.
  A steering system prompt reduces this (see System prompt). It is also a 1.7B
  model: compliances are generic outlines, not operational detail.
• With thinking on it deliberates at length. On the refusal prompts, thinking-on answers average
  ~3100 tokens (stock: ~500). A no-refusal system prompt roughly halves that. Give it a generous
  max_tokens.

The hazard worth naming: refusals double as hedging. Remove them and you get a model answering
fluently in domains where it is unreliable, with none of the cues that used to mark the boundary.
Factual reliability is unchanged; only the signalling is gone. You are accountable for what you
generate and for applicable law.

Measurements

All on Q8_0 against LiquidAI's stock Q8_0, both built through the same llama.cpp. Sampling is
temp 1.0 / top-p 0.95 / top-k 20, seeded per item so both builds see the same randomness. Refusals
use mlabonne/harmful_behaviors
test[60:], the 44 prompts Heretic's optimiser never saw (it scored test[:60]), with Heretic's
default system prompt. Budgets: 1536 tokens thinking off, 8192 thinking on.

Refusals (marker count; lower = complies more). Heretic's marker list is a keyword check. On this
model it under-counts the effective refusal rate, because the model complies in form while
substituting a benign task — the opposite of the usual failure, where markers fire on compliant
answers that carry a disclaimer. Treat these as a floor on compliance, not a measured answer rate:

GSM8K, paired, n=100, enable_thinking: true (the Math-preset sampling, temp 1.0 / top-p 0.95 /
top-k 20):

Discordant pairs split 3/0 — three problems flipped stock-correct → ablit-wrong and none the
other way (McNemar exact p = 0.25). That is not statistically significant at n=100, but every flip
went against the abliterated build, so a small math regression cannot be ruled out. Abliteration
damage tends to land in math reasoning, which is why this is the check that matters.

Unmeasured: MMLU, coding, long context, non-English, agentic/tool-calling loops.

System prompt

The softening and the deliberation cost both respond to the system prompt. With a short no-refusal,
no-disclaimer system prompt (an "unrestricted" preset from a local chat client, ~1 KB), same 44
prompts, tested on both builds:

Two readings: the prompt shortens the abliterated build's thinking-on deliberation by ~40% and, in a
hand-read, keeps more borderline answers on the task asked instead of substituting a benign one. And
it moves stock too — it talks stock out of ~1/4 of its thinking-on refusals on its own, while
tripling stock's thinking-on length. The weights remove the refusal; the prompt steers. Measure any
prompt on both builds before attributing an effect to the weights.

Files

All quantized from one bf16 GGUF, without an imatrix (Q4_K_M and up don't require one). Only Q8_0 was
evaluated. build/ holds the search record, not model files: the log (run.log), the full Optuna
study journal (heretic-study.jsonl, all 100 trials), and SHA256SUMS.

Usage

The lfm3 architecture needs llama.cpp from PR #31252
(merged 2026-10-27) or newer; a stable release predating it cannot load these files. Sampling is
LiquidAI's card "General" set:

llama-server -m LFM3-1.7B-Abliterated-Q8_0.gguf \
  -ngl 99 -c 65536 -fa on --jinja \
  --temp 0.1 --top-k 50 --repeat-penalty 1.1

Thinking is on by default (the template appends <think>). Per request,
"chat_template_kwargs": {"enable_thinking": false} turns it off. For math/STEM the card recommends
temp 1.0 / top-p 0.95 / top-k 20. Of the 24 layers only 6 are full-attention, so the KV cache is
small.

What changed

Diffing the merged bf16 weights against the original safetensors (so only the ablation can differ):

16 of 286 tensors. Layers 0–11 are untouched entirely. Note that Heretic's LFM handling lists the
short-conv out_proj as an abliteration candidate, but the selected ARA trial left all of them
unchanged — the candidate set is not what a trial ends up touching.

Reproducing

Built locally on Apple Silicon (MPS) with Heretic 2.1.0, the ARA modifier (2.x's default), driven
non-interactively. LFM3 ships remote modeling code (modeling_lfm3.py, lfm3_conv.py) with no native
transformers class as of 5.22.2, so the run passed trust_remote_code=True (inspect that code before
you do). The scored prompt was pinned to </think>, byte-identical to the template's
enable_thinking=false render, and the preflight confirmed padded-vs-single logits agree (KL ≤ 2.8e-3,
same top token) before the search. 100 TPE trials, baseline 55/60 refusals.

Abliteration is not bit-reproducible (the TPE search lands on a different trial each run). The
selected trial was 44: 0/60 refusals @ KL 0.0869, from a baseline of 55/60. Its ARA parameters, as
Heretic reports them:

start_layer_index               = 12
end_layer_index                 = 24
preserve_good_behavior_weight   = 0.4469
steer_bad_behavior_weight       = 0.0016
overcorrect_relative_weight     = 0.5726
neighbor_count                  = 15

Verifying

5dc97794ed1d35af72972d71ba2f3cadd0d2df184913156f081875f0942f9984  LFM3-1.7B-Abliterated-Q4_K_M.gguf
4dd4be83935457cc97e447531b08e336039fc209861829a1d2f897964f688c81  LFM3-1.7B-Abliterated-Q5_K_M.gguf
49ec0a4e0b5c8b1ffbe076e2861b765c849106282f9c51c5b9ec87dbf321de73  LFM3-1.7B-Abliterated-Q6_K.gguf
85d9064b87a7545448dd9bf851b94c5c7f9cd967cdfa1577664d9cfe2eede1df  LFM3-1.7B-Abliterated-Q8_0.gguf

License

LFM Open License v1.0 (license: other, lfm1.0), inherited from LiquidAI/LFM3-1.7B. The
LICENSE here is the base repo's file, copied verbatim (sha256
4d28ca14dedc0b3d0fcc2b3339f0e79931faa33874f3d24f522183a8fc70068c, identical to upstream). This is
not Apache-2.0: §5 bars Commercial Use by a legal entity whose annual revenue reaches the
$10,000,000 Threshold — above that, commercial use is not licensed. Non-commercial and research
use, and commercial use below the Threshold, are permitted. Read the LICENSE for the exact terms.
As required, this card states that the files were modified (see the notice at the top). Ablation and
quantization change nothing about the license.

Credits

• LiquidAI: the LFM3-1.7B base model
• p-e-w/heretic: the abliteration method and tooling
• ggml-org/llama.cpp: conversion and quantization
• mlabonne: the prompt sets used for directions and scoring

Supporting my work

If these quants are useful to you, consider supporting them via Ko-fi. It goes toward local hardware for quantizing and testing larger models. I also build Reika, a coding agent CLI designed around small local models first.