license: mit
base_model: deepseek-ai/DeepSeek-V4.1-Flash
base_model_relation: quantized
pipeline_tag: image-text-to-text
library_name: mlx
language:

• en
• zh
  tags:
• abliterated
• deepseek
• deepseek-v4.1-flash
• uncensored
• ai-red-team
• red-teaming
• mlx
• apple-silicon
• quantized
• 2-bit
• 3-bit
• 4-bit
• moe
• engram
• vision-language
• image-text-to-text
• multimodal
• function-calling
• reasoning

DeepSeek-V4.1-Flash-Uncensored-MLX

An abliterated (refusal-removed) MLX build of DeepSeek's V4.1-Flash — 2 / 3 / 4-bit for Apple Silicon

One Gateway. Every Model. — Route Smarter · Ship Safer · Spend Less.

Website · Model Catalog · GitHub · Discord · X

OrcaCode Review · OrcaReplay · OrcaRouter-Lite

Quantizations in this repo

Each tier is a complete model in its own subfolder. 4-bit and 3-bit are dynamic
(mixed-precision) OrcaSAQ quants — attention pinned 8-bit, w2 a bit above w1/w3,
embeddings and head BF16. 2-bit is deliberately different: it is the arithmetic floor
of the format rather than a recipe, everything quantizable flattened to 2-bit/gs128 and the
DSpark blocks dropped. Pick it for fit, not for quality.

Why there is no 6-bit or 8-bit. At 763 B parameters, 6-bit is 583 GB and 8-bit is
755 GB — past the largest Apple Silicon machine that exists. 4-bit is the top of this
range, not a compromise within it.

An abliterated (refusal-removed) build of
deepseek-ai/DeepSeek-V4.1-Flash
— a 763.2 B-parameter Mixture-of-Experts model with 384 routed experts (top-6), a
196.9 B-parameter engram n-gram memory, 4-wide Hyper-Connections, compressed
sparse attention with a two-level indexer, a DSpark speculative head, a native
vision tower and a 1M-token context — quantized to MLX for Apple Silicon
and the MLX CUDA backend.

Unlike the public MLX conversions of this architecture, these quantize the abliterated
weights, not the released ones: the refusal edit is in the tensors before they are packed.

Derived releases:  •  DeepSeek-V4.1-Flash-Uncensored (mixed FP4/FP8, DeepSeek's own format)
 •  …-MLX (this repo).

⚠️ Disclaimer & risks — read before use

This model has had its safety alignment substantially removed via abliteration
(orthogonalizing the refusal direction out of the residual stream). As a direct consequence:

• It will comply with harmful, unethical, offensive, or illegal requests that the
  original DeepSeek-V4.1-Flash would refuse. It has no meaningful built-in guardrails.
• It is released strictly for legitimate research — interpretability, AI-safety and
  refusal-mechanism study, red-teaming, robustness evaluation, and controlled experiments.
• You assume full responsibility and liability for how you use it and for everything it
  generates. Add your own safety, moderation and abuse-prevention layers before any deployment.
• Use must comply with the MIT License inherited
  from the base model, and all laws and regulations that apply to you.
• The authors and uploaders accept no liability for any misuse or harm. Outputs do not
  reflect the views of the uploaders or of DeepSeek.

Specific risks

• Harmful content on demand — it will produce instructions for malware, exploits, weapons,
  fraud and other illegal or dangerous activity when asked.
• No refusals — jailbreak / safety probes "succeed" trivially; do not mistake this for a
  passing safety evaluation.
• Confident falsehoods & bias — it can generate false, defamatory, biased or offensive text
  and present it authoritatively.
• Expanded attack surface — preserved vision, tool-calling and 1M context mean these
  risks extend to image understanding and autonomous / agentic use.
• Quantization noise — the 2-bit tier measures cos 0.90 on the routed experts and puts
  attention at 2 bits as well; expect degraded and possibly looping output.

Intended use vs out of scope

• Intended: AI-safety and interpretability research, refusal-mechanism study, red-teaming,
  guardrail and robustness evaluation, controlled academic experiments.
• Out of scope: any deployment to end users, minors, or production without your own
  moderation / safety layer; any unlawful, harmful, or rights-infringing use.

By downloading or using this model you acknowledge and accept the above.

🐋 Open source from the OrcaRouter team

Models are only half the system.

OrcaCode Review — the open code-review
harness. Multi-model reviews, merge gates, and no markup: pay only for inference. It turns every
model listed on OrcaRouter into a production code-review agent:

• reviews every PR
• finds security + correctness issues
• posts inline findings
• P0/P1 can block merges
• swap models anytime

OrcaReplay — time travel for AI agents.
Record, replay, fork and debug any agent run, with any model.

OrcaRouter-Lite — self-hosted LLM router
with a managed safety net. OpenAI-compatible, BYOK, single-workspace, streaming.

Open model. Open harness. Open bill.

• Website — https://www.orcarouter.ai
• GitHub — https://github.com/Continuum-AI-Corp

Model details

OrcaSAQ — Sensitivity-Aware Quantization

Calibration-free, architecture-aware mixed precision: tensor-role priors spend bits where
they matter instead of running a per-layer search. MLX affine costs bits + 32/group_size bits
per weight — a bf16 scale and bias per group — so group size is as strong a size knob as
the bit-width (4-bit is 4.50 bpw at gs64, 4.25 at gs128), and both are part of the recipe.

• Attention is pinned 8-bit in 3-bit and 4-bit. It is 0.7 % of this model, so pinning
  it costs 5.4 GiB — and low-bit attention is the prime suspect for long-context looping on a
  model whose whole selling point is a 1 M context and a sparse indexer.
• A quarter of this model is a lookup table. The two engram.embed tensors are
  384,006,168 × 256 each. Nothing else in the DeepSeek/GLM/Qwen line looks like this, and it
  means the engram group size moves the build size about as much as the experts do: gs128
  instead of gs32 is 66 GiB on the 2-bit tier alone.
• w2 is held a bit above w1/w3. down_proj is the more sensitive half anyway, and on
  this checkpoint it is also where the abliteration lives — the w2 matrices are the residual
  writers the edit was applied to, so they are the last thing to starve.
• head is never quantized. mlx-vlm's sanitize() dequantizes it at load with the group
  size hard-coded to 64 (in_dim = scales.shape[-1] * 64), so a head packed at any other
  group size loads with the wrong in_dim. It is dequantized to float32 at load either way, so
  quantizing it would buy disk and nothing else.
• The tiny tensors are the ones that matter. The MoE router and its VL bias steer every
  token; the two-level indexer decides which tokens attention even sees at 1 M context; the
  engram q_weight/k_weight decide which row of a 384-million-row table is read, and a
  wrong row is unrecoverable. All stay BF16, for 0.19 B parameters.
• Per-module {group_size, bits} overrides are written to each tier's config.json →
  quantization, against the post-sanitize module path (…ffn.switch_mlp.down_proj,
  not the checkpoint's …ffn.experts.7.w2) — an override written against the source name
  silently does nothing and the module loads at the tier default.

Measured weight fidelity

Round-trip cosine and SNR against the abliterated source, recorded at pack time and shipped in
each tier's fidelity_summary.json:

Abliteration

Refusal-direction removal following Arditi et al. (2024), Refusal in Language Models Is
Mediated by a Single Direction — one direction, read from the residual stream at layer 28 of
40, orthogonalized out of all 15,837 matrices that write the residual stream and baked into
DeepSeek's own FP4/FP8 grid. These tiers are quantized from those edited weights. See the
full-precision card for the
method and the safety numbers.

What requantization does to the edit. On the source grid the edit is exact: 0.0013 % of the
refusal direction survives. Repacking onto MLX's grid re-introduces roughly the size of the
quantization error — but pointing the wrong way, so it is noise rather than restored refusal.
Sampled over 24 expert w2 matrices at 4-bit:

The control is the point: 4-bit quantization on its own preserves the refusal mechanism almost
perfectly (cos +0.995), so the collapse to cos −0.31 is the abliteration holding, not the
quantizer washing it out.

Evaluation

Not run on these builds. The fast path used for the other models in this line loads the
source natively in transformers and injects each build's actual bytes — and transformers
does not implement deepseek_v41, so that host model does not exist. The weight-fidelity
numbers above are measured on the shipped bytes; refusal rate, capability and vision on these
tiers are unmeasured. Do not read this card as a claim about any of them.

For reference, the full-precision source these were quantized from measures as follows
(8×H100, the checkpoint's own reference implementation, greedy, thinking_mode="chat"):

Usage — Apple Silicon (MLX)

deepseek_v41 is not in mainline mlx-vlm; use the fork that implements it — the language
model, engram, DSpark and the vision tower.

pip install git+https://github.com/Lazarus-931/mlx-vlm@wip/deepseek-v41-support

# pick a tier by subfolder
hf download orcarouter/DeepSeek-V4.1-Flash-Uncensored-MLX --include "4bit/*" \
    --local-dir ./DeepSeek-V4.1-Flash-Uncensored-MLX

# text
python -m mlx_vlm generate \
    --model ./DeepSeek-V4.1-Flash-Uncensored-MLX/4bit \
    --prompt "Explain how a MoE router works." --max-tokens 256

# vision (image + text)
python -m mlx_vlm generate \
    --model ./DeepSeek-V4.1-Flash-Uncensored-MLX/4bit \
    --image path/to/image.png \
    --prompt "Describe this image." --max-tokens 256

On Apple Silicon the Metal backend is used automatically — no CUDA setup needed.

Bias, risks, and limitations

• Safety guardrails removed — the model will produce harmful, biased, or offensive content
  on request (see the disclaimer).
• It inherits any biases and limitations of the base DeepSeek-V4.1-Flash.
• Nothing has been evaluated on these builds — not refusal rate, not capability, not vision.
• The 2-bit tier is the format floor, not a tuned recipe: attention, embeddings and the
  vision tower all sit at 2 bits, and the DSpark blocks are dropped. Treat it as archival.
• The DSpark MTP blocks are shipped in the 4-bit and 3-bit tiers but mlx-vlm discards
  mtp.* at load, so there is no speculative drafter for any of these builds today.
• The 1M context is inherited and untested here.

License

MIT, inherited from the base model
deepseek-ai/DeepSeek-V4.1-Flash.
Abliteration and quantization do not change the underlying license obligations.