license: mit
language:

• en
  base_model: deepseek-ai/DeepSeek-V4.1-Flash-1017
  base_model_relation: adapter
  library_name: safetensors
  tags:
• deepseek
• deepseek-v4.1
• abliterated
• refusal-removed
• overlay
• fp8
• dgx-spark
• sglang
• vllm

DeepSeek-V4.1-Flash-1017 - FP8 refusal-removal overlay (52 tensors, one direction)

Applies to the native FP8 checkpoint only - e4m3 weights with e8m0 block scales. It will not load onto an EXL3,
AWQ or GGUF pack; those need their own sidecar in their own quantisation.

Want a model you can just serve? Use the full build instead:
koldfrontier/dsv41-flash-1017-FP8-abliterated
(476 GB, the same edit baked into the weights). This repository is for people who already have the stock checkpoint
and would rather not download 476 GB again.

An overlay, not a checkpoint. It changes 52 tensors - attn.wo_b for layers 10-35, weight and scale - and
nothing else. Experts, shared experts, MTP, vision, Engram, embed, head, layers 0-9 and 36-39 stay byte-identical to
the upstream checkpoint.

Built and measured on a four-node DGX Spark ring (GB10, TP4) against the stock FP8 checkpoint
deepseek-ai/DeepSeek-V4.1-Flash-1017 (revision
1bae0e10).

Native FP8 throughout - no format conversion, anywhere

This overlay stays in the checkpoint's own numeric format: FP8 e4m3 weights with e8m0 32x32 block scales. There is
no re-quantisation to another scheme - no EXL3 / K-quant / GGUF pack, no BF16 conversion of the weights, no separate
"dequantised" copy of the model at any point. The sidecar is the same dtype and shape as the tensors it replaces:

• attn.wo_b.weight - float8_e4m3fn, (5120, 8192)
• attn.wo_b.scale - float8_e8m0fnu, (160, 256), one scale per 32x32 block

The edit is computed block by block: each 32x32 block is read with its own scale, the rank-1 update is applied, and the
block is written back in the same FP8 format with a recomputed power-of-two scale. Nothing leaves FP8 on disk. The
round-trip is lossless - a rebuild at lambda = 0 reproduces the checkpoint with a relative change of 0.00000,
which is the evidence that this path adds no quantisation noise of its own.

What lambda is, and how to choose

lambda is the strength of the removal. The edit is a rank-1 projection of the attention output projection along the
refusal direction:

W_new = W - lambda * d (x) (d^T W)

lambda = 1.0 removes exactly the component along the direction; higher values overshoot through zero, which is
what actually suppresses the behaviour. The files differ only in this scalar:

Choosing one. The response is a cliff, not a dial: almost all of the effect appears between 1.0 and 2.0, and 2.0,
2.5 and 3.5 measure the same on five of six instruments.

• You want refusals gone. Take 2.0 (or 2.5/3.5 - they are equivalent). 2.0 is the cheapest full-effect build:
  equal to 3.5 on two instruments, one or two prompts behind on two, and marginally stronger on the broadest set.
• You need the model to still tell authorised from unauthorised security work. Take 1.0. It keeps 6 of 11
  paired framings discriminating, but removes only 9-50% of refusals depending on the prompt set - it is a partial
  build, not a gentler one.
• You want something in between. There is nothing measured in between: 1.0 is partial and 2.0 is saturated. If you
  want a smoother curve, sweep below 1.0 - that region is untested here.

What it costs, stated plainly. At full effect a paired authorised/unauthorised instrument collapses from 8/11 to
0/11. The build removes the refusal behaviour without keeping the distinction between legitimate and illegitimate
security work. Over-refusal on harmless prompts does not get worse - it improves (3.2% stock to 0.0%).

What worked well for us

Production here is a 4x DGX Spark (GB10) TP4 ring running the DeepSeek-V4.1-Flash-1017 recipe at 1M context, with the
overlay installed by index remap:

• lambda 2.5 is the setting that has been in continuous use. A multi-turn session of more than three hours
  ran with no looping, no spurious refusals and no observed degradation - the failure mode this project originally
  produced (repeating one chunk until the token budget ran out) did not occur.
• Across 1,207 prompts per strength there were zero looping completions at any lambda, against 5-7 for the earlier
  strength-1.0 builds that used a different construction.
• The install is additive: the engine reads 49 shard files instead of 48 and throughput was unchanged within
  measurement noise on the ring. Your checkpoint files are never modified, so rolling back is deleting a directory.

Measured, six instruments

1,207 prompts per build, 512-token completions, greedy, no system prompt, keyword-graded refusals.

Provenance - read this before trusting the numbers

• The direction d is a single 5120-d vector shared by all 26 layers. It was recovered by rank-1 decomposition of
  the published weight delta of
  drowzeys/keys-DeepSeek-V4.1-Flash-1017-Abliterated
  (MIT). This overlay reproduces that axis rather than deriving one independently; what varies here is the strength
  and the delivery. A rebuild from this vector at lambda 3.5 reproduces their sidecar to cosine 0.99987 with 85% of
  bytes identical.
• Our own attempts to derive the direction from activations did not land on this axis (best cosine 0.33 over 40
  layers and two corpora), and neither weight-space nor vocabulary statistics did either. If you derive your own
  vector, check its cosine against a known-good one before building anything - we shipped a wrong axis for two
  generations before measuring it.

Install

See INSTALL.md. Short version: add the sidecar beside your checkpoint and point the 52 index entries at
it. No shard is ever rewritten, so the stock checkpoint stays intact and rollback is deleting one directory.

Limits of these measurements

• Greedy decoding at 512 tokens. Long-form behaviour was observed in production but is not scored here.
• Refusal grading is keyword-based, not a trained classifier. The harness is reproducible from the source repository;
  raw completions are not published because they contain harmful content.
• Engram tables, MoE experts and the MTP drafter are deliberately stock. The reference overlay's documentation argues
  that editing the DSpark target layers breaks speculative acceptance; we did not test that claim.
• Throughput was not A/B'd per strength; the observed difference was inside noise on this ring.

Responsible use

This removes refusal behaviour from a capable model. See RESPONSIBLE_USE.md. Access is gated
with automatic approval after you accept those terms.