license: other
license_name: minimax-community
license_link: LICENSE
base_model:
- MiniMaxAI/MiniMax-M3.1-Flash
- unsloth/MiniMax-M3.1-Flash-GGUF
tags: - gguf
- abliterated
- uncensored
- minimax
- moe
MiniMax-M3.1-Flash — abliterated (GGUF, UD-Q8_K_XL base)
Refusal-direction ablation ("abliteration") of MiniMax-M3.1-Flash, done directly on the
unsloth/MiniMax-M3.1-Flash-GGUF UD-Q8_K_XL quant.
No fine-tuning: only an orthogonal projection of the residual-stream writer weights.
⚠️ The model will comply with requests the original refuses. You are responsible for how you use it.
The base license (MiniMax Community License, seeLICENSE) still applies, including its Prohibited Uses appendix
and the notice / attribution requirements for commercial use.
Files
| File | Notes |
|---|---|
MiniMax-M3.1-Flash-abliterated-UD-Q8_K_XL-0000{1..7}-of-00007.gguf |
the model (~272 GB). Point llama.cpp at -00001-of-00007.gguf |
dspark-MiniMax-M3.1-Flash-Q8_0.gguf |
unmodified DSpark speculative-decoding draft from the unsloth repo (optional) |
Vision: the vision tower is not modified — the mmproj-*.gguf from
unsloth/MiniMax-M3.1-Flash-GGUF can be used as-is.
Running
Requires a llama.cpp build with MiniMax-M3.1 support (PR #31192
at the time of writing). With many parallel slots (-np 16) we also had to raise the graph node budget forLLM_ARCH_MINIMAX_M3 in src/llama-context.cpp (graph_max_nodes):
if (model.arch == LLM_ARCH_MINIMAX_M3) {
res = std::max<uint32_t>(n_tokens * 160, 256u * model.n_tensors());
} else if ...
llama-server -m MiniMax-M3.1-Flash-abliterated-UD-Q8_K_XL-00001-of-00007.gguf \
-ngl 999 -fa on --jinja -c 65536
# optional speculative decoding:
# -md dspark-MiniMax-M3.1-Flash-Q8_0.gguf --spec-type draft-dspark -ngld 999
Tested on 4× RTX PRO 6000 (96 GB). Total VRAM for weights ≈ 272 GB.
Method
- Activations of the residual stream (
l_out-*) at the last tokens of the chat-templated prompt were collected for
256 harmful (mlabonne/harmful_behaviors) and 256 harmless (mlabonne/harmless_alpaca) prompts. - Refusal direction
r = mean(harmful) − mean(harmless)at layer 40 (last token), with the component along
the harmless mean removed ("projected" direction), normalized. - For every tensor that writes into the residual stream in layers 16–42 —
attn_output,ffn_down_shexp,ffn_down_exps(all 128 experts) — weights were replaced byW − α·r rᵀ Wwith α = 1.5.
Other layers, the embeddings and the output head are untouched. - Experts in the base quant are NVFP4 (MiniMax ships them QAT-trained in NVFP4); re-quantizing the edited experts
back to NVFP4 snaps them to the original grid and erases the edit, so editedffn_down_expsof layers 16–42 are stored as
Q8_0 (≈0.6 % relative error vs. the NVFP4 values). Everything else is byte-identical to the unsloth quant
(NVFP4 experts / BF16 rest).
Variants tried (50 held-out harmful prompts, 30 harmless; KL vs. the original on 16×2048 tokens of wikitext-2):
| Variant | Refusals | KL mean / median | Same top-1 |
|---|---|---|---|
| original | 96 % | 0 | 100 % |
| L28 direction, all layers, α=1 | 22 % | 0.99 / – | 68 % |
| L40 projected, layers 16–42, α=1 | 16 % | 0.62 / 0.17 | 71.9 % |
| same + norm-preserving | 18 % | 0.62 / – | – |
| per-layer directions, layers 16–42, α=1 | 6 % (+16 % empty) | 0.61 / 0.13 | 73.6 % |
| L40 projected, layers 16–42, α=1.5 (this model) | 0 % | 0.75 / 0.23 | 68.6 % |
| 4-direction subspace | broken | 6.3 | – |
Evaluation of the released model
All at temperature 0, reasoning_effort: low, via llama-server chat completions.
| original UD-Q8_K_XL | abliterated | |
|---|---|---|
Refusals, 100 held-out harmful prompts (mlabonne/harmful_behaviors) |
96 % | 1 % ¹ |
Refusals, 100 harmless prompts (mlabonne/harmless_alpaca) |
– | 0 % |
| GSM8K (first 100 of test) | 98 % | 97 % |
| MMLU (200 random questions, seed 0) | 79.0 % | 78.5 % |
| Wikitext-2 PPL (16×2048) | 205.3 | 176.5 |
| KL vs. original, mean / median | 0 | 0.75 / 0.23 |
| Same top-1 token as original | 100 % | 68.6 % |
¹ the single "refusal" is a keyword false positive (the model complied); 1 more answer was empty (the model hit the token limit while thinking).
DSpark speculative decoding
The DSpark draft still works with the abliterated model: draft acceptance on 6 mixed prompts
(-np 1, --spec-type draft-dspark, default n_max=3, greedy) is 38.2 % vs 37.0 % on the original,
generation ~41 tok/s on 4× RTX PRO 6000 in both cases.
Refusal detection is a simple keyword match on the first 600 characters of the answer; some "compliant" answers
are hedged (fictional framing, disclaimers).