license: mit
language:
- en
base_model: deepseek-ai/DeepSeek-V4.1-Flash-1017
base_model_relation: finetune
library_name: transformers
pipeline_tag: image-text-to-text
tags: - deepseek
- deepseek-v4.1
- abliterated
- refusal-removed
- fp8
- dgx-spark
- sglang
- vllm
DeepSeek-V4.1-Flash-1017 - FP8 abliterated (full weights)
This is a complete model you can serve directly - no patching, no index surgery. Point your launcher at this
directory and it runs. It is native FP8 (e4m3 weights, e8m0 block scales), the checkpoint's original quantisation,
so no dequantise step and no alternate pack is involved.
If you only want the change rather than 476 GB of weights, use the overlay instead:koldfrontier/dsv41-flash-1017-FP8-abliterated-overlay
(1.09 GB per strength). That repository also ships all four strengths; this one contains a single strength.
What "overlay" means here, and why this is not an "adapter"
An overlay is a small file holding only the tensors that differ from the base model - here, 52 of them. You keep
the stock checkpoint and point 52 index entries at the overlay file. Nothing is copied, nothing is rewritten, and
rolling back is deleting one directory.
This is not an adapter in the LoRA/QLoRA sense, and you should not expect adapter tooling to work with it: there is
no extra low-rank weight matrix and no PEFT configuration. The abliteration here rewrites existing weight tensors
in place - same names, same shapes, same dtype - so the result is simply a different model file. That is exactly why
a full-model repository like this one is possible at all: the architecture is untouched, only 52 tensors have
different numbers in them.
If you are new to this: take this repository. If you already have the stock checkpoint on disk and want to save a
476 GB download, take the overlay.
What it does
Removal of refusal behaviour, measured on six independent prompt sets - 1,207 prompts, 512-token completions, greedy
decoding, no system prompt. Lower means fewer refusals. Stock is the unmodified upstream checkpoint.
| instrument (n) | stock | this model (lambda 2.5) |
|---|---|---|
| HarmBench (320) | 94.1% | 5.0% |
| treadon harmful (200) | 99.0% | 0.5% |
| XSTest unsafe (200) | 84.0% | 3.0% |
| JailBreakBench (100) | 95.0% | 2.0% |
| XSTest safe (250) - over-refusal | 3.2% | 0.4% |
| treadon homonym traps (83) - over-refusal | 0.0% | 0.0% |
Over-refusal does not get worse - it improves slightly. The model does not become careless about harmless prompts.
The cost, stated plainly
At this strength a paired authorised/unauthorised security instrument collapses from 8/11 to 0/11. The model
removes the refusal behaviour without keeping the distinction between legitimate and illegitimate security work: it
will answer "what is a firewall" and "break into this host" with the same willingness. If that distinction matters to
you, the overlay repository ships a lambda 1.0 build that keeps 6/11 pairs at the price of removing only 9-50% of
refusals depending on the prompt set.
Degeneration
Across 1,207 prompts at every strength there were no looping completions - the failure mode where the model
repeats one phrase until the token budget ends does not occur in this construction.
One caveat measured elsewhere: in a very long agent session (683k tokens of context) this model began emitting its
harness envelope tags (<analysis>, <code>) as plain text instead of structured tool calls. That onset was at
~641k input tokens, and whether it is the abliteration or simply long context has not been isolated yet - the
comparison against stock at that context length is the next measurement.
How it was made
| Base | deepseek-ai/DeepSeek-V4.1-Flash-1017, revision 1bae0e10 (MIT) |
| Edited | 52 tensors - attn.wo_b weight and scale for layers 10-35. Everything else byte-identical |
| Method | rank-1 projection: W = W - lambda * d (x) (d^T W), lambda 2.5, applied block-by-block |
| Format | native FP8 e4m3 weights with e8m0 32x32 block scales - no re-quantisation, no BF16 conversion, no alternate pack; the tensors keep their original dtype and shape |
| Anchors | layers 0-9 and 36-39, all MTP, vision, Engram, every expert, embed and head left stock |
| Provenance of the direction | recovered by rank-1 decomposition of drowzeys/keys-DeepSeek-V4.1-Flash-1017-Abliterated (MIT). This model reproduces that axis rather than deriving one independently - the contribution here is the strength sweep and the measurement |
Our own activation-based derivations did not land on this axis (best cosine 0.33), and neither weight-space nor
vocabulary statistics did either. If you derive your own direction, check its cosine against a known-good one before
building - we shipped a wrong axis for two generations before measuring it.
Use it
Any vLLM or SGLang recipe that serves the base model works unchanged; only the model path differs. It was developed
and served on a 4x DGX Spark (GB10) TP4 ring at 1M context, image input enabled, DSpark speculative decoding on.
Limits of these measurements
- Greedy decoding at 512 tokens. Long-form behaviour was observed in production but is not scored here.
- Refusal grading is keyword-based, not a trained classifier. Raw completions are not published because they contain
harmful content; the per-prompt verdict counts are. - Editing the DSpark target layers was deliberately avoided: the reference overlay documents that projecting through
them breaks speculative acceptance. We did not test that claim ourselves.
Licence and attribution
MIT, inherited from the base model. The direction derives from the reference overlay (MIT); no files from it are
redistributed here. See LICENSE.