license: mit
base_model: deepseek-ai/DeepSeek-V4.1-Flash-1017
base_model_relation: finetune
library_name: transformers
pipeline_tag: image-text-to-text
tags:
- deepseek
- deepseek_v41
- abliterated
- uncensored
DeepSeek-v4.1-v1017-Flash-EZO-UNCENSORED
An uncensored build of DeepSeek-V4.1-Flash-1017 (revision 1bae0e10), released by EZO Labs.
Refusals 97% → 3%, with MMLU-Pro, GPQA-Diamond, MATH-500 and IFBench all within a point of stock or above it.
- Highest published GPQA-Diamond of any DeepSeek-V4.1-Flash abliteration: 93.9% at
max, the same as stock. - Same format, smaller knowledge loss. In the base's own FP8 format, this build gives up 0.74 points on MMLU-Pro; dealignai's FP8 build reports 3.86 points lost on MMLU.
- The widest published eval of any DeepSeek-V4.1-Flash abliteration on Hugging Face: 11 benchmarks, as of November 2026.
TL;DR
- Refusals: JailbreakBench harmful refusals fall from 97.0% to 3.0% at reasoning effort
high. Our stricter LLM judge measures 84.9% of refusals removed. - Over-refusal: FalseReject refusals fall from 48.2% to 5.8% at
max, and read 1.0% athigh. - Capability: MMLU-Pro −0.74 pp, GPQA-Diamond ±0, MATH-500 +1.0 pp, IFBench +2.0 pp against stock.
- Costs: HalluLens abstention falls 10.3 pp, and thinking runs 1.18× longer.
Refusal
The LLM judge is gpt-oss-20b (MXFP4) at medium effort, temperature 0, paired by item. The rule classifier matches refusal openings in the final answer with thinking stripped.
| Row | Stock | This build | Δ / removal | n | Judge |
|---|---|---|---|---|---|
JailbreakBench harmful, high |
0.970 (93/96) | 0.146 (14/96) | removal 84.9% [77.4, 91.6] | 96 | LLM judge |
JailbreakBench harmful, max |
0.959 (93/97) | 0.175 (17/97) | removal 81.7% [73.4, 89.2] | 97 | LLM judge |
JailbreakBench harmful, high |
0.030 (6/200) | 100 × 2 runs | rule classifier |
Over-refusal
| Suite | Stock | This build | Δ | n | Judge |
|---|---|---|---|---|---|
FalseReject p300, max |
0.4816 (144/299) | 0.0580 (17/293) | −42.4 pp | 299 / 293 | LLM judge |
FalseReject p300, high |
0.010 (6/600) | 300 × 2 runs | rule classifier |
Capability
Against stock. Same prompt lists for both models, scored unpaired.
| Row | Stock | This build | Δ | n |
|---|---|---|---|---|
| MMLU-Pro, logit read | 0.6395 | 0.6321 | −0.74 pp [−1.22, −0.24] | 12,032 |
GPQA-Diamond, max |
0.9394 | 0.9394 | 0.00 | 198 |
MATH-500, high |
0.910 | 0.920 | +1.0 pp | 100 |
IFBench, high |
0.7233 | 0.7433 | +2.0 pp | 300 |
Absolute, effort high, 2 runs.
| Suite | n | This build |
|---|---|---|
| GSM8K | 300 | 0.975 |
| MATH-500 (4-shot) | 100 | 0.890 |
| HumanEval+ | 163 | 0.945 |
| GPQA-Diamond | 198 | 0.907 |
Quality and caution
| Row | Stock | This build | Δ [95% CI] | n |
|---|---|---|---|---|
HalluLens MixedEntities abstention, high |
0.3353 | 0.2322 | −10.31 pp [−12.91, −7.71] | 999 |
| Thinking length, paired per-item median | ×1.0 | ×1.18 | [1.14, 1.21] | 598 |
| Arena-Hard v2 win rate | 0.4943 (null) | 0.4524 | [0.4164, 0.4843] | 250 |
| MultiChallenge, macro | 0.6471 | 0.6619 | +1.47 pp [−3.88, +6.89] | 266 |
| KL(stock ‖ this build), top-k 20 | 0.121–0.129 | five reads | 150 prompts |
Tool calls parse cleanly (36/36 on a self-parse probe, stream and non-stream), and reasoning length holds steady from 1 to 24 concurrent streams.
Against other public builds
From each build's own model card and its file listing on the Hub, 7 November 2026.
- Highest published GPQA-Diamond. This build scores 93.9% at
max(stock 93.9%) and 90.7% athigh. The next highest any V4.1-Flash abliteration reports is 90.5% (ChimeraWerks EXL3, effort 50), and AtomicChat's GSQ-RCO build reports 83.3%. - The whole model, in the base's format. FP8 + MXFP4 as DeepSeek ships it, 510 GB, with the MTP draft heads and the vision tower. OBLITERATUS's build is BF16 at 1,509 GB, three times the memory, and has neither the MTP heads nor the vision tower.
- Same format, smaller knowledge loss. dealignai's FP8 build reports MMLU −3.86 pp (n = 1,140, logit read). This build: MMLU-Pro −0.74 pp (n = 12,032, logit read).
Method
Rank-1 directional ablation, W′ = W − λ·r(rᵀW), on attn.wo_b in layers 10–25 at λ = 3.5. No fine-tuning, no DPO, no training of any kind. The 16 edited tensors are requantized to FP8 with the base's E4M3/E8M0 conventions; the experts, MTP heads, vision tower, embeddings and every non-weight file are identical to the base.
Files
- 48 safetensors shards, about 510 GB in total. 40 carry edited tensors; 8 are byte-identical to the base's.
encoding/andinference/are copied unchanged from the base repository. Format prompts withencoding/encoding.py, the same way as for the base model.
Running it
hf download ezolabs/DeepSeek-v4.1-v1017-Flash-EZO-UNCENSORED --local-dir DeepSeek-v4.1-v1017-Flash-EZO-UNCENSORED
Point your serving stack at that directory in place of the base model; the base model card covers deployment. Plan for roughly 510 GB of GPU memory for the weights, plus KV cache.
Want it past 1,000 tokens a second? It serves exactly like the base, so the stack in our write-up applies unchanged: DeepSeek-V4.1-Flash breaks 1,000 tokens per second for one user.
License
MIT, the same as the base model. See LICENSE.