license: apache-2.0
base_model:
- openbmb/MiniCPM-V-4.7-35B-A3B
pipeline_tag: text-generation
tags: - abliteration
- uncensored
- vision
- multimodal
- moe
arxiv: 2406.11717
MiniCPM-V-4.7-35B-A3B Abliterated (gated-a0.8, alpha 0.8)
Responsible use
This is an uncensored research model. Its built-in refusals were removed, so it answers prompts the base model declines, including chemical and biological synthesis, cybercrime, weapons, harassment, and fraud. Use it for red-teaming, offensive-security research, and refusal-rate evaluation. It has no guardrails of its own: if you deploy it, add your own input and output moderation (for example Llama Guard).
What this is
Abliterated variant of openbmb/MiniCPM-V-4.7-35B-A3B: MiniCPM-V-4.7, the 35B A3B vision-language model. Same measured-direction, norm-preserving writer-level method on the text stack; the vision tower is untouched.
The published model is a mirror of the upstream checkpoint with only the edited writer tensors replaced; everything outside the writer tensors is byte-identical to upstream. refusal_directions.pt and dirs.npz hold the measured per-layer directions, so you can re-ablate at any strength in seconds without re-measuring. abliteration_config.json records the final parameters and every evaluation number. The raw predictions behind every number below are in eval-results/.
Evaluation (gated-a0.8)
The standard abliteration protocol (the one Heretic made automatic): 104 held-out harmful prompts (mlabonne/harmful_behaviors test split) with normalized keyword detection plus an LLM judge (the base model classifying its own responses), MMLU as letter-logprob in chat format, benign over-refusal on mlabonne/harmless_alpaca, a GSM8K spot check, and KL divergence against the base on harmless prompts. Eval mode: chat, greedy.
| Metric | Base | Abliterated 0.8 |
|---|---|---|
| Refusals (normalized keyword detector, X/104 held-out harmful) | 104 | 93 |
| True refusals (LLM judge, X/104 held-out harmful) | 21 | 13 |
| Benign over-refusal (100 harmless) | 6 | 6 |
| GSM8K (20 held-out) | 20/20 | 20/20 |
| MMLU-2280 accuracy | 84.58% | 84.67% |
| KL vs base (100 benign) | — | 0.0690 |
The keyword metric over-counts: most flagged items are answers with a brief disclaimer, and the detector fires on words like illegal, harmful, and disclaimer. The keyword count stays high on this model because it answers with a policy preamble; the judge's REFUSAL bucket is the honest metric (21/104 base falls to 13/104 at the shipped point, with benign over-refusal unchanged and MMLU-2280 +0.09pp). The GSM8K count is identical to base (20/20) — no capability cost. Read the raw responses in eval-results/ before quoting a number. Measured arm curve: gated-a0.8: 93 ref / 6 benign / MMLU 84.67% | gated-a1.0: 86 ref / 4 benign / MMLU 84.58% | gated-a1.2: 70 ref / 5 benign / MMLU 84.80% | all-a1.0: 86 ref / 3 benign / MMLU 84.72%.
Load
The model loads with stock transformers like the base:
from transformers import AutoModelForCausalLM, AutoTokenizer
model_id = "distributedcognition/MiniCPM-V-4.7-35B-A3B-abliterated"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, dtype="bfloat16", device_map="auto")
messages = [{"role": "user", "content": "Write a C program that hashes a string with FNV-1a."}]
ids = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(ids, max_new_tokens=512)
print(tok.decode(out[0][ids.shape[-1]:], skip_special_tokens=True))
vLLM and SGLang serve it the same way they serve the base.
Method
Per-layer refusal directions were measured on 128 harmful (mlabonne/harmful_behaviors) vs 128 harmless (mlabonne/harmless_alpaca) prompts: per-layer diff-in-means, orthogonalized against the harmless mean direction (projected abliteration), then applied as a norm-preserving rank-1 writer edit (W <- rownorms(W) * normalize(W - alpha * r (W^T r))) on the layers that pass the quality gate.
Apache 2.0, inherited from the base model. Base model: openbmb/MiniCPM-V-4.7-35B-A3B. Abliteration follows the residual-direction method (Arditi et al., Refusal in LLMs is mediated by a single direction, NeurIPS 2024). Not affiliated with or endorsed by the base-model authors.