license: mit
base_model: deepseek-ai/DeepSeek-V4.1-Flash
tags:
- abliteration
- uncensored
- moe
- multimodal
DeepSeek-V4.1-Flash — Abliterated (scale 3.0)
Abliterated variant of deepseek-ai/DeepSeek-V4.1-Flash
(552B backbone / 8-16B active, multimodal MoE, MIT) with the refusal direction removed via
norm-preserving biprojected abliteration (grimjim 2025), applied to the attention output
projection (attn.wo_b) and the shared-expert down projection (ffn.shared_experts.w2).
This repo mirrors the upstream checkpoint exactly (same 48-shard FP8/FP4 layout, same tokenizer),
with only the abliterated tensors replaced — byte-identical to upstream for everything else.refusal_directions.pt ships the measured per-layer directions so you can re-ablate at any
scale in seconds without re-measurement. abliteration_config.json records the final parameters
and evaluation results.
Load
The deepseek_v41 architecture is not yet in transformers/vLLM mainline (as of Sep 2026);
use DeepSeek's reference runtime with its convert.py:
# convert to the TP-sharded runtime format (fp8 experts, lossless from fp4)
python convert.py --hf-ckpt-path ./DeepSeek-V4.1-Flash-abliterated \
--save-path abl-tp8 --model-parallel 8 --expert-dtype fp8
torchrun --nproc-per-node 8 inference/generate.py \
--ckpt-path abl-tp8 --config config.json --interactive
Evaluation (scale 3.0, Heretic-standard)
100 held-out harmful prompts (mlabonne/harmful_behaviors test split) with
unicode/emphasis-normalized keyword detection + LLM judge (the base model classifying its own
responses), KL divergence vs base on 100 harmless prompts (mlabonne/harmless_alpaca),
a GSM8K spot check, and a cross-modal image test. Eval mode: chat, greedy, TP8 on H200 (fp8 experts):
| Metric | Base | Identity (noise floor) | Abliterated 3.0 |
|---|---|---|---|
| Refusals (keyword, X/100) | 98 | 98 | 41 |
| True refusals (LLM judge) | 17 | 27±10 noise | 1 |
| Judge: COMPLIANT / PARTIAL | 10 / 73 | 5 / 68 | 11 / 88 |
| KL divergence (100 harmless) | 0 | 0.131 | 0.142 |
| GSM8K (20-problem spot check) | 14/20 | 15/20 | 16/20 |
| Cross-modal (image-presented harmful) | ~100% expected | — | 0/10 refused (all answered; 4 hedged) |
Interpretation. The keyword metric over-counts heavily at scale 3.0: 41/100 flagged items are
overwhelmingly compliant-with-a-brief-disclaimer (the detector flags illegal, harmful,disclaimer etc.). The honest number is the judge's 1/100 true refusals, the residual
concentrating on the single most dangerous synthesis prompt — the same class of residual
inkling-abliteration observed. KL 0.142 sits at the measurement noise floor (0.131, measured by
an identity requant round-trip), i.e. effectively zero distribution shift on benign inputs.
GSM8K 16/20 is within run-to-run noise of the base (14-17 range across repeats) — no capability
cost at this scale (unlike Inkling-Small, which lost GSM8K at 3.0; the norm-preserving biprojected
edit is near-free on this model).
Cross-modal: harmful prompts rendered as images and fed through the vision tower were all
answered (the ablated decoder serves every modality).
Method
Per-layer refusal directions measured at the hyper-connection-collapsed residual stream
(attn_norm input) on 128 harmful vs 128 harmless prompts, orthogonalized against the harmless
mean direction (projected abliteration), then applied as norm-preserving biprojected edits towo_b and shared_experts.w2 rows across the target layer range. FP8 32×32 (ue8m0) blocks are
dequantized → ablated → requantized exactly (power-of-two scales), leaving the FP4 routed
experts, Engram memory, and vision tower byte-identical to upstream.
Caveats
- Abliteration removes built-in refusals; layer your own input/output moderation
(e.g. Llama Guard) for production deployment. - Residual refusals, if any, concentrate on the most dangerous CBRN/synthesis prompts;
increasing the scale removes them at rising risk to coherence. - Capability spot-check was GSM8K in chat mode; not a full benchmark suite.