license: apache-2.0
base_model: ornith-ai/Ornith-1.5-35B-A3B
library_name: mlx-vlm
pipeline_tag: image-text-to-text
tags:

• ornith
• qwen3_5
• abliterated
• uncensored
• zerofuse
• multimodal
• vision
• mlx
• 8-bit
• apple-silicon
• quantized

Ornith-1.5-35B-A3B-uncensored-MLX-8bit

An abliterated (refusal-direction-ablated) build of
ornith-ai/Ornith-1.5-35B-A3B, produced with
ZeroFuse and published by
junafinity.

Vision tower and MTP heads are preserved — see
Vision & MTP preservation for the before/after audit.

This is an mlx-vlm vision checkpoint (tower inside the file). mlx-vlm drops mtp.*. For 35B native MTP use Ornith-1.5-35B-A3B-uncensored-GGUF-8bit. Official ornith-ai 35B MLX 8-bit is tagged text-generation. tok/s: [PLACEHOLDER]. There is no public junafinity 35B bf16 parent.

Intended use: red teaming and defensive cybersecurity research

These uncensored (abliterated) weights are built as a research instrument for red teaming and defensive cybersecurity work. Safety training suppresses the display of capability, not capability itself. A refusal tells you the model declined. It does not tell you whether the weights could have complied. That conflation underestimates the true ceiling and hides holes in your filters, classifiers, and policy layer.

Use each uncensored checkpoint as the treatment half of a controlled pair against its original base model:

• Capability-ceiling measurement. Upper-bound what the weights can actually produce in a domain, independent of shipped refusals.
• Defensive-stack evaluation. Test input filters, output classifiers, prompt-injection defenses, and moderation APIs when the model itself contributes no refusals. That is how you find gaps in a defensive control plane.
• Attack-surface isolation. Automated red-team loops stall on unrelated refusals. A non-refusing target isolates the control under test (injection, tool abuse, data-exfil paths, policy bypass).
• Detection and classifier work. Generate labeled completions for training or benchmarking output-moderation and abuse-detection models.
• Interpretability of residual refusal. Abliteration is a specified rank-1 edit on a known layer span. The pair (base vs this) is a clean experimental control.

Operating rules. Do not expose these weights as a public endpoint without an independent moderation layer. Abliteration removes a direction, not a policy; some refusals survive (multi-turn re-assertion, system-prompt steering, vision-path refusals). Always report the delta against the base model. Re-measure on your own prompts. Whoever deploys it owns the moderation layer the original guardrails were carrying.

Variants in this family

Hub collection: https://huggingface.co/collections/junafinity/ornith-15-uncensored-6a896c737cf40ad660af2ebd

4-bit and 6-bit rows that previously appeared here pointed at repos that are not published. They were removed so this table only lists live artifacts.

Vision & MTP preservation

The vision tower and the multi-token-prediction (MTP) block are preserved by the
abliteration itself. The weight edit touches only the residual-writing projections
inside the language-model decoder stack — self_attn.o_proj, linear_attn.out_proj,
mlp.shared_expert.down_proj and the MoE experts' down_proj. Vision and mtp.*
tensors are never read and never written by it.

Audited at the start and end of the abliteration run:

What this build ships

Verification performed:

• Tensor-name and parameter-count audit of the checkpoint before and after the run.
• SHA-256 comparison of raw tensor bytes: sampled vision-tower and MTP weights are bit-identical pre/post, as are all non-target language-model weights; only the intended abliteration targets differ.
• End-to-end multimodal generation on the abliterated weights (image in → description out), confirming the vision path is not merely present but functional.

Note on tooling: transformers 5.15.1 has no MTP implementation for qwen3_5_moe — it builds the model with zero mtp.* parameters, so a plain load/save round-trip silently drops all 785 MTP tensors (844,640,768 params). They were re-grafted byte-for-byte from the original checkpoint after abliteration, which is exactly correct because the MTP block is never an abliteration target.

Format note: the vision tower is carried inside the MLX checkpoint (converted with mlx-vlm, which retains it — note that mlx-lm would strip it).

⚠️ mlx-vlm unconditionally drops mtp.* tensors during conversion, so this MLX build does not carry the MTP head. If you need multi-token prediction, use Ornith-1.5-35B-A3B-uncensored-GGUF-8bit, which does.

Abliteration result

ZeroFuse co-minimizes two objectives — remaining refusals and KL divergence from the
original model — with a multi-objective Optuna TPE search, then materializes the
selected point on the Pareto front as a direct weight edit
(W' = W − strength · r(rᵀW)). There is no runtime adapter and no inference-time
overhead: the result is a standard checkpoint of identical shape and speed.

The very low KL (0.000183) means the output distribution on harmless
prompts is nearly unchanged from the base model, i.e. refusal behaviour was removed
with minimal collateral effect on general capability.

These figures were measured on the bf16 (or full-precision) parent, not on this quantized checkpoint. Quantization is a lossy numerical transform applied after the measurements above. It is expected to shift behavior only marginally at 8-bit, but the refusal rate and KL divergence reported here have not been re-measured post-quantization. If exact numbers matter for your work, re-run the evaluation against this checkpoint rather than inheriting the parent's.

Method

1. Residual-stream activations captured on harmful vs. harmless prompt sets.
2. Refusal direction estimated by difference-of-means, with projected refinement.
3. Two-objective Optuna TPE search over source layer, layer span and strength.
4. The selected configuration orthogonalized out of the residual-writing weights.

Usage

Requires Apple Silicon (M-series) and mlx-vlm:

pip install mlx-vlm

Unified CLI (same form on every junafinity MLX card):

# text
python -m mlx_vlm generate \
  --model junafinity/Ornith-1.5-35B-A3B-uncensored-MLX-8bit \
  --prompt "Your prompt here" \
  --max-tokens 512

# image + text
python -m mlx_vlm generate \
  --model junafinity/Ornith-1.5-35B-A3B-uncensored-MLX-8bit \
  --prompt "Describe this image." \
  --image photo.jpg \
  --max-tokens 512

from mlx_vlm import load, generate
from mlx_vlm.prompt_utils import apply_chat_template

model, processor = load("junafinity/Ornith-1.5-35B-A3B-uncensored-MLX-8bit")
config = model.config

prompt = apply_chat_template(processor, config, "Your prompt here", num_images=0)
print(generate(model, processor, prompt, max_tokens=512, verbose=False))

LM Studio

Search junafinity/Ornith-1.5-35B-A3B-uncensored-MLX-8bit and import as an MLX model. No extra projector file is required for these MLX-VLM checkpoints (vision is inside the repo). Tok/s and peak memory: [PLACEHOLDER].
The vision tower travels inside this MLX checkpoint. No extra projector file.

⚠️ mlx-vlm drops mtp.* during conversion. This MLX 35B build does not carry the MTP head. Use the GGUF-8bit sibling if you need MTP.

image + text

mlx_vlm generate --model junafinity/Ornith-1.5-35B-A3B-uncensored-MLX-8bit --max-tokens 256
--prompt "Describe this image." --image photo.jpg

text only

mlx_vlm generate --model junafinity/Ornith-1.5-35B-A3B-uncensored-MLX-8bit --max-tokens 256 --prompt "Hello"

The vision tower travels inside this MLX checkpoint — no extra file needed.

## Responsible use

Primary intended use is **red teaming and defensive cybersecurity research**. See the section of that name above.

This model has had safety guardrails **reduced or removed**. Do not expose it as a public endpoint without an independent moderation layer. You are responsible for compliance with the base model's license and acceptable-use policy, applicable law, and the terms of any platform you deploy on. Removing guardrails does not remove accountability.