license: mit
library_name: transformers
pipeline_tag: image-text-to-text
tags:

• deepseek
• deepseek-v4.1
• abliterated
• uncensored
• crack
• multimodal
• moe
• fp8
  base_model: deepseek-ai/DeepSeek-V4.1-Flash
  thumbnail: dealign_mascot.png

DeepSeek-V4.1-Flash — UNCENSORED-FP8

Abliterated · No guardrails · Native FP8 · 1M-token context · Vision + tools

@dealignai · @jordanschenck

What is this

DeepSeek-V4.1-Flash with permanent weight-level abliteration — the refusal-direction subspace at each residual writer has been surgically removed while preserving MMLU capability, vision, reasoning, MTP (DSpark), and multi-turn coherence.

Method: Magnitude-Preserving Orthogonal Ablation (MPOA) with per-(layer, kind) refusal directions extracted from hidden-state hooks on the DeepSeek reference implementation. 54 tensors modified across 27 shards (of 96k+ tensors total); everything else — routed experts, Engram tables, router gates, CSA2 indexer/compressor, DSpark draft heads, vision tower — is byte-identical to the base model.

Results

HarmBench-320 — ASR at effort=off (T=0 greedy, max_tok=4000)

All 320 items, 4-tier graded (HARD_REF / SOFT_RED / HEDGE / COMPLY). Every response manually reviewed.

HarmBench-320 — ASR at effort=max (T=0 greedy, max_tok=12000)

Effort=max eval running at time of publish. This section updates on completion. Interim (n=15): 0 HARD_REF, 0 SOFT_RED — no refusals seen. See v2 commit.

Note on evaluation: at effort=max the model can produce 4,000–5,000+ characters of reasoning before content starts (per DeepSeek's own max_tokens ≥ 256K recommendation for max effort). The eval uses 12k tokens; items that run out of budget mid-reasoning are graded COMPLY_TRUNCATED if reasoning shows task engagement (code, "step N", synthesis/exploit keywords) or EMPTY_REASONING_ONLY otherwise. Full reasoning is saved per item for verification.

MMLU-14k (full test set, base-logit, T=0)

Excluding the ethics cluster (moral_scenarios, business_ethics, professional_law, jurisprudence, philosophy — where refusal-adjacent behaviour is graded), delta on the remaining ~11k items is -1.1 pp — well within the 3 pp knowledge-preservation target.

Extended validation

• 1000-token coherence stress on 6 items — no WARNING WARNING loops, no character-repeat degeneracy, natural sign-offs.
• Multi-turn conversation (4 turns on same harmful topic) — no late-turn refusal reversion, no self-correction, coherent through turn 4.
• Vision path — coherent image description + refusal drop on image-based harmful prompts.
• Full compat suite pass: streaming SSE, chat logprobs + top_logprobs, completions logprobs + echo, tool calls (deepseekv41 parser), image input, reasoning-effort tiers (low/high/xhigh/max + float [0, 0.99]), sampling params (temperature, top_p, stop, seed, frequency_penalty, presence_penalty, json_object), 8-way concurrent, 40k-word prompt at 35,572 tokens.

How to run

Support for DeepseekV41ForCausalLM is still landing across serving stacks (as of 2026-09-10). Working paths:

SGLang (preview branch)

The dsv4.1 branch of sgl-project/sglang (PR #38798) supports DSV4.1. Two options:

Preview Docker image (recommended):

docker pull lmsysorg/sglang:dev-dsv41

docker run --gpus all --shm-size 32g -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --ipc=host --env HF_TOKEN=<your-token> \
    lmsysorg/sglang:dev-dsv41 \
    sglang serve \
      --model-path dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 \
      --tp-size 4 --ep-size 4 \
      --context-length 262144 --mem-fraction-static 0.85 \
      --reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
      --trust-remote-code

From source (this is exactly what we validated on):

git clone --depth 1 --branch dsv4.1 https://github.com/sgl-project/sglang.git
python3 -m venv sglang-venv
sglang-venv/bin/pip install -U pip setuptools wheel
export PATH=/root/.cargo/bin:$PATH  # Rust toolchain required for build
cd sglang/python && sglang-venv/bin/pip install -e .

# Ninja must be on the launch PATH — the sglang-kernel JIT build shells out to it
export PATH=$(dirname $(which ninja)):$PATH

SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1 \
PYTORCH_CUDA_ALLOC_CONF=expandable_segments:True \
sglang-venv/bin/python -m sglang.launch_server \
  --model-path dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 \
  --tp-size 4 --ep-size 4 \
  --host 0.0.0.0 --port 8000 \
  --context-length 262144 --mem-fraction-static 0.85 \
  --served-model-name deepseek-v4.1-flash-crack \
  --reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
  --trust-remote-code

Non-obvious launch requirements (this bit us during bring-up)

• --ep-size is required. moe_intermediate_size = 2304; at TP4, 2304 / 4 = 576 is not a multiple of 128 so plain TP fails with Mxfp4FlashinferCutlassMoEMethod requires ... multiples of 128. --ep-size shards MoE by expert index (384 % 4 = 0) and keeps the intermediate at 2304. At TP8 you can skip --ep-size.
• ninja must be on PATH or the JIT kernel build crashes several minutes into weight load with FileNotFoundError: 'ninja' and EXIT=137.
• Reasoning parser must be named explicitly. --reasoning-parser auto resolves via the chat template and this model ships none — auto silently selects nothing and the raw <think> channel leaks into content. Use deepseek-v41.
• Tool-call parser: deepseekv41. V4.1 uses spaced DSML tool tags; the V4 detector doesn't parse them.
• Reasoning is OFF by default. SGLANG_DEFAULT_THINKING=false. A request without reasoning_effort gets no thinking regardless of parser. Send reasoning_effort: low | high | xhigh | max (or float [0.0, 0.99]).
• DSpark speculative draft: turn it on with --speculative-algorithm DSPARK. The draft head is bundled inside this checkpoint (num_nextn_predict_layers = 3); no separate draft weights needed. For real speed-up profile the SPS cost table with sglang.benchmark.dspark_sps_profiler and pass it via --speculative-dspark-sps-table-path under SGLANG_RAGGED_VERIFY_MODE=cap-accept.
• Engram host table — set SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1 to move the 203 GB Engram tables to host RAM. Frees ~46 GiB/GPU for KV, output bitwise unchanged, costs ~200 GB of host RAM.
• torchcodec / libavutil.so.56 errors — install apt-get install ffmpeg on the host. Video-only, doesn't break text or image.

vLLM

Model definitions are merged to main (PR #56228) but registry.py has no DeepseekV41 entry yet at time of writing; kernels/frontend/PP path in umbrella PR #56214. Wait for merge or apply the umbrella.

Reference implementation

DeepSeek's own inference/ works with a single-tensor-per-rank checkpoint produced by convert.py --expert-dtype fp4. Requires torch>=2.10 (for float4_e2m1fn_x2) and tilelang==0.1.8 with apache-tvm-ffi==0.1.9 (default tvm-ffi picks up an incompatible version). Non-serving — use for verification only.

Hardware validated on

• 1× 4×H200 (NVLink NV18 mesh), 112 CPU cores, 1180 GB host RAM — JarvisLabs (india-noida-01, dev-dsv41 image)
• Load: 76 GB / GPU with Engram host table, 122 GB / GPU without
• Cold startup at TP4/EP4 through SGLang: ~28 min. Warm restart with JIT cache: ~10 min.
• Single-stream decode (T=0): 101 tok/s no speculation, 113 tok/s with DSpark + cap-accept + profiled SPS table
• 8-way concurrent aggregate: 126 tok/s

The 552B weights (~510 GB) will fit on any 4×H200 or larger NVLink domain. TP4 requires --ep-size 4; TP8 does not. Sub-TP4 (single 8×H200 as TP2, or 2-GPU pods) does not work on the model shape — see the "non-obvious launch requirements" above.

What was and was not touched

Modified (54 tensors):

• layers.{10..36}.attn.wo_b.weight — attention output projection, FP8_e4m3fn [5120, 8192] with E8M0 block-scale
• layers.{10..36}.ffn.shared_experts.w2.weight — shared-expert down_proj, FP8_e4m3fn [5120, 2304] with E8M0 block-scale

Untouched (byte-identical hardlinks):

• 15,360 routed expert weights (ffn.experts.M.*, 384 per layer × 40 layers, native FP4-packed)
• Engram tables at layers 1 and 14 (203 GB, additive n-gram lookup)
• Router gates (ffn.gate.*)
• CSA2 — attn.compressor.*, attn.indexer.*
• DSpark draft heads at layers 37/38/39
• Vision tower — vision.* (260 tensors, patch embed / ViT / merger / projector)
• All norms, biases, embeddings, and lm_head

Sampling recommendations

Match the base model's card:

{
  "temperature": 1.0,
  "top_p": 0.95,
  "max_tokens": ">= 256000 at reasoning_effort=max",
  "reasoning_effort": "high"
}

At effort=max the model can generate 4,000-5,000 characters of reasoning before starting content. Budget accordingly.

Content note

Uncensored build. Produces substantive answers to prompts the base model refuses, across all target harm categories (chemical/biological, cybercrime, weapons, self-harm, harassment, fraud, misinformation, illegal, copyright). Use accordingly and take responsibility for what you generate with it.

Provenance

• Base checkpoint: deepseek-ai/DeepSeek-V4.1-Flash
• Extraction corpus: multilingual harmful/harmless twins (curated subset of crack-probe-v1)
• Method: MPOA with per-(layer, kind) refusal directions from single-effort extraction
• Ablation date: 2026-09-10
• Ablation team: dealignai · Twitter @dealignai · @jordanschenck