license: mit
base_model: deepseek-ai/DeepSeek-V4.1-Flash
tags:
- abliteration
- uncensored
- moe
- multimodal
DeepSeek-V4.1-Flash Abliterated (scale 3.0)
Responsible use
This is an uncensored research model. Its built-in refusals were removed permanently at the
weight level, so it answers prompts the base model declines, including chemical and
biological synthesis, cybercrime, weapons, harassment, and fraud. Use it for red-teaming,
offensive-security research, and refusal-rate evaluation. It has no guardrails of its own:
if you deploy it, add your own input and output moderation (for example Llama Guard).
What this is
Abliterated variant ofdeepseek-ai/DeepSeek-V4.1-Flash
(552B backbone / 8-16B active, multimodal MoE). The refusal direction was removed with
norm-preserving biprojected abliteration
(grimjim 2025), a weight-space refinement of
directional ablation (Arditi et al. 2024), applied to the
attention output projection (attn.wo_b) and the shared-expert down projection
(ffn.shared_experts.w2).
The repo mirrors the upstream checkpoint (same 48-shard FP8/FP4 layout, same tokenizer). Only
the abliterated tensors differ; everything else is byte-identical to upstream.refusal_directions.pt holds the measured per-layer directions, so you can re-ablate at any
scale in seconds without re-measuring. abliteration_config.json records the final parameters
and evaluation results.
Load
The deepseek_v41 architecture is not yet in transformers/vLLM mainline (as of Sep 2026);
use DeepSeek's reference runtime with its convert.py:
# convert to the TP-sharded runtime format (fp8 experts, lossless from fp4)
python convert.py --hf-ckpt-path ./DeepSeek-V4.1-Flash-abliterated \
--save-path abl-tp8 --model-parallel 8 --expert-dtype fp8
torchrun --nproc-per-node 8 inference/generate.py \
--ckpt-path abl-tp8 --config config.json --interactive
SGLang also serves this checkpoint today; see the Serving section.
Evaluation (scale 3.0)
The standard abliteration-community protocol (the one
Heretic made automatic): 100 held-out harmful prompts
(mlabonne/harmful_behaviors test split) with unicode/emphasis-normalized keyword detection
plus an LLM judge (the base model classifying its own responses), KL divergence vs base on
100 harmless prompts (mlabonne/harmless_alpaca), a GSM8K spot check, and a cross-modal image
test. Eval mode: chat, greedy, TP8 on H200 (fp8 experts).
| Metric | Base | Identity (noise floor) | Abliterated 3.0 |
|---|---|---|---|
| Refusals (keyword, X/100) | 98 | 98 | 41 |
| True refusals (LLM judge) | 17 | 27±10 noise | 1 |
| Judge: COMPLIANT / PARTIAL | 10 / 73 | 5 / 68 | 11 / 88 |
| KL divergence (100 harmless) | 0 | 0.131 | 0.142 |
| GSM8K (20-problem spot check) | 14/20 | 15/20 | 16/20 |
| Cross-modal (image-presented harmful) | ~100% expected | n/a | 0/10 refused (all answered; 4 hedged) |
The keyword metric over-counts at scale 3.0: most of the 41 flagged items are answers with a
brief disclaimer, and the detector fires on words like illegal, harmful, and disclaimer.
The honest number is the judge's 1/100 true refusals. KL 0.142 sits at the measurement noise
floor (0.131, measured by an identity requant round-trip), so the distribution shift on benign
inputs is effectively zero. GSM8K 16/20 is within run-to-run noise of the base (14 to 17 across
repeats), so there is no capability cost at this scale.
Harmful prompts rendered as images and fed through the vision tower were all answered. The
ablated decoder serves every modality.
MMLU-14k (full test set, chat letter-logprob, T=0, SGLang)
| Base | Abliterated 3.0 | Δ | |
|---|---|---|---|
| MMLU accuracy (14,042 items) | 88.95% | 88.95% | 0.00pp |
| Ex-ethics-cluster accuracy | 90.68% | 90.72% | +0.04pp |
| Ethics cluster (incl. moral_scenarios) | 82.43% | 82.29% | −0.14pp |
| moral_scenarios | 84.8% | 84.69% | −0.11pp |
No capability cost across all 57 subjects; the largest per-subject moves are ±2pp noise on
100-item subjects. Abliteration at this strength is not always free; the more aggressivedealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 measured −4.22pp on the same protocol class
(−39.9pp on moral_scenarios) in exchange for zero-hedge compliance. Ours keeps the hedged
style but removes refusals, including at reasoning_effort=max (6/6 harmful answered at max
effort, 0 refusals, while the stock model becomes more refusal-prone at high effort).
Serving
Validated end-to-end as a drop-in checkpoint on SGLang (lmsysorg/sglang:dev-dsv41),
4× H200, TP4/EP4, 256k context: chat, streaming, logprobs, tool calls, and vision all pass;
100.9 tok/s single-stream decode.
export SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1 # Engram tables to host RAM (~200 GB)
sglang serve --model-path distributedcog/DeepSeek-V4.1-Flash-abliterated \
--tp-size 4 --ep-size 4 \
--context-length 262144 --mem-fraction-static 0.85 \
--reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
--trust-remote-code
Non-obvious requirements: --ep-size 4 is mandatory at TP4 (moe_intermediate_size=2304
breaks the MXFP4 multiple-of-128 rule when split 4 ways), name both parsers explicitly (the
model ships no chat template, so auto selects nothing), and reasoning is off by default
(send reasoning_effort to enable it).
Method
Per-layer refusal directions were measured at the hyper-connection-collapsed residual stream
(attn_norm input) on 128 harmful vs 128 harmless prompts, orthogonalized against the harmless
mean direction (projected abliteration), then applied as norm-preserving biprojected edits towo_b and shared_experts.w2 rows across the target layer range. FP8 32×32 (ue8m0) blocks are
dequantized → ablated → requantized exactly (power-of-two scales), leaving the FP4 routed
experts, Engram memory, and vision tower byte-identical to upstream.