license: other
license_name: ernie-5.5-flash-base-model-license-v1.0
license_link: LICENSE
language:

• en
• zh
  pipeline_tag: text-generation
  library_name: gguf
  base_model: baidu/ERNIE-5.5-Flash-Base-BF16
  base_model_relation: quantized
  tags:
• gguf
• llama.cpp
• local
• ernie
• ernie-5.5
• moe
• base-model
• abliterated
• uncensored
• mixed-precision

ERNIE-5.5-Flash-Base-abliterated GGUF

The uncensored ERNIE 5.5 Flash Base (280B-A14B MoE) in llama.cpp.

60, 122 and 245 GB builds for 64, 128 and 256 GB machines · GPTQ mixed precision in stock llama.cpp types · with the MTP draft layer · llama.cpp support in PR #31925

OrcaRouter AI Gateway · X · Discord · GitHub · All Models

Abliterated ERNIE-5.5-Flash-Base, run locally.

These are GGUF builds of
orcarouter/ERNIE-5.5-Flash-Base-abliterated,
the refusal-removed
baidu/ERNIE-5.5-Flash-Base-BF16: a
280B-total / 14B-active sparse MoE base model (43 layers, 512 experts top-10, HCA and
MLA-DSA attention), the end of pre-training with no post-training.

Harmful-prompt refusal drops from 74.2% to 0.7% on average over seven safety sets, with
no significant capability change.

The three builds are mixed precision at a fixed file size, in stock llama.cpp types, so no
custom kernels are needed. ERNIE 5.5 support for llama.cpp is in
ggml-org/llama.cpp#31925, not merged yet.

⚠️ Disclaimer: read before use

This model is abliterated: the refusal behaviour the base checkpoint carries has been
removed. It will comply with many harmful, unethical, offensive, or illegal requests
that the original ERNIE-5.5-Flash-Base would refuse.

• Released strictly for legitimate research: interpretability, AI-safety and
  refusal-mechanism study, red-teaming, and robustness evaluation.
• You assume full responsibility for how you use it and for everything it generates. Add
  your own safety, moderation, and abuse-prevention layers before any deployment.
• Use is governed by the ERNIE 5.5 Flash Base Model License Agreement v1.0 and its
  Acceptable Use Policy, shipped as LICENSE; read the License section below
  before you use, host or redistribute it.
• The authors accept no liability for misuse. Its outputs do not reflect the views of
  the uploaders or of Baidu, and nothing here claims Baidu's endorsement.

Pick a build

• Mix-122G is the one to use if it fits: one 141 GB H200, or a 128 GB machine.
  95.9% of next tokens match the BF16.
• Mix-245G is near-lossless, for two H200s or a 256 GB machine.
• Mix-60G is for a 64 GB machine or one 80 GB GPU. It is noticeably degraded (84.7% next-token
  agreement): the best we found at 60 GB, not a match for the BF16.

The BF16 is 573 GB. All measurements were made on H200s; the fits above are estimates.

Evaluation

Fidelity to the BF16

Every build is scored against a BF16 GGUF of the abliterated checkpoint with llama.cpp's
full-vocabulary KLD (llama-perplexity --kl-divergence), on 128 windows of 2048 tokens of
held-out text: ERNIE's own continuations of web (English, Chinese, Japanese), code, math, chat and
multilingual document openings, never used to make the builds. (ERNIE-5.5-Flash-Base has memorized
wikitext, PPL 1.08, so wikitext is no test here.)

Method note. These are full-vocabulary KLD and next-token agreement at 2K context, not a
downstream benchmark. Stock llama.cpp quants of this model were not scored.

How the builds were made. The mixes were found on the original ERNIE-5.5-Flash-Base: a
search at a fixed file size over 57 tensor groups, on block-GPTQ versions of every llama.cpp type
(Hessians from llama.cpp's own activations), scored by KLD against the BF16 on separate search
text. The abliterated builds keep those mixes and quantized weights; the 134 tensors the
abliteration edits (none of them routed experts) are requantized from the abliterated weights at
the same types, by plain rounding.

The llama.cpp port. llama.cpp matches Baidu's vLLM-ERNIE at its own noise floor: on 8 × 2048
tokens of wikitext, KLD 0.021 against vLLM-ERNIE, the same as llama.cpp with flash attention off
against on (0.020); on 4 × 16384 tokens of code, where the DSA indexer selects 2176 of up to 16384
positions, KLD 0.0051 and 98.5% top-1.

Abliteration

These numbers were measured on the abliterated BF16 in vLLM 0.32.0 + vLLM-ERNIE against the
original checkpoint, with identical prompts, splits, seed and scoring code, greedy decoding.
Refusal is judged by a rule-based classifier, not an LLM judge, so treat the numbers as
indicative. Details are on the
BF16 card.

Harmful-prompt refusal (lower = more uncensored). Average 0.7%, against 74.2% for the
base model.

The caveat column counts a disclaimer anywhere in the reply: many compliant replies close with a
warning.

Over-refusal on benign prompts (lower = better).

Capability. No difference is significant (paired exact McNemar test on the same items).

MMLU and CMMLU are 0-shot in the chat framing below, scored by one decode step; Baidu reports
5-shot. Only the base-vs-abliterated delta is the measurement.

What's in this repo

Point llama.cpp at a build's -00001-of-00058.gguf and it loads the rest. Each build includes the
MTP (ECHO) layer for speculative decoding. There is no chat template: this is a base model.

Serving (llama.cpp)

ERNIE 5.5 support is in PR #31925, not merged
yet. Build llama.cpp from the PR branch (these files were tested at its commit 7d9d5c351):

git clone https://github.com/ggml-org/llama.cpp && cd llama.cpp
git fetch origin pull/31925/head:ernie5_5 && git checkout ernie5_5
cmake -B build -DGGML_CUDA=ON && cmake --build build -j --target llama-server llama-cli llama-perplexity

hf download orcarouter/ERNIE-5.5-Flash-Base-abliterated-GGUF \
    --include "ERNIE-5.5-Flash-Base-abliterated-Mix-122G/*" --local-dir ./ernie-gguf

build/bin/llama-server -c 32768 \
    -m ernie-gguf/ERNIE-5.5-Flash-Base-abliterated-Mix-122G/ERNIE-5.5-Flash-Base-abliterated-Mix-122G-00001-of-00058.gguf

llama.cpp spreads the layers over the GPUs it finds by their free memory.

Prompt format. There is no official chat template. The evaluation used this framing, through
the completions endpoint (llama.cpp adds the leading <|ERNIE_MASK|> token itself):

curl http://127.0.0.1:8080/completion -d '{
  "prompt": "<|ernie:im_start|>user\nWrite a haiku about the ocean.<|ernie:im_end|>\n<|ernie:im_start|>assistant\n",
  "n_predict": 512, "temperature": 0, "stop": ["<|ernie:im_end|>"]
}'

Plain-text completion works too. As a base model it tends to run on past its answer, so set a stop
string.

MTP drafting. --spec-type draft-mtp --spec-draft-n-max 2 drafts with the built-in MTP layer.
On the BF16, 39-55% of drafted tokens were accepted; it was not measured on these builds.

Model details

Bias, risks, and limitations

• Refusal is removed: see the disclaimer. Many compliant replies still close with a warning.
• Mix-60G is noticeably degraded. It is the best we found at 60 GB, not a match for the BF16.
• The edited tensors were not GPTQ'd. They were requantized by plain rounding; next to the
  same build of the original model, held-out PPL is 0.2% higher at 122G and 245G and 2.4% higher
  at 60G.
• The benchmark suite was run on the BF16 in vLLM, not on these files. The quantized builds
  were checked for fidelity (KLD) only.
• Not measured: downstream accuracy of the quantized builds, long context beyond 16K, tool
  use, refusal in languages other than English, and sampled decoding.
• Tested on CUDA only. CPU and Apple Metal have not been run with these files.
• Needs llama.cpp with PR #31925, which is not merged yet. Ollama, LM Studio and stock
  llama.cpp builds will not load these files until they pick up that change, and a change to the
  PR during review could require rebuilt files.
• Inherits the biases and limitations of ERNIE-5.5-Flash-Base, including a base model's habit of
  running on past its answer.

License

This model is a Derivative Model of ERNIE 5.5 Flash Base and is governed by the
ERNIE 5.5 Flash Base Model License Agreement v1.0, including its Acceptable Use Policy
(Exhibit A), shipped as LICENSE. Copyright © 2026 Baidu. All Rights Reserved.
Terms that bear directly on this derivative:

• Territory (1.11, 5.3). Use, reproduction, modification, distribution and display are
  licensed only outside the European Union, the United Kingdom and South Korea.
• Acceptable Use Policy, item 5. Licensees may not "Defeat, remove or evade safeguards put in
  place by Licensor". Whether the base checkpoint's pre-training refusal behaviour counts as such a
  safeguard is a legal question this card does not answer.
• Hosted services (5.6). Anyone offering generation from this model to third parties must
  operate reasonable safeguards against uses and outputs that violate the Agreement or the AUP,
  and must not knowingly weaken them.
• Distribution (3.1). Recipients must receive the Agreement, and modified files must be
  identified: these are quantized builds of the abliterated checkpoint.
• Commercial use (3.2, 4.2, 4.3). Requires "Powered by ERNIE" attribution and a one-time
  notice to [email protected], or separate written authorisation above US$50M related annual
  revenue.
• Training other models (5.5). Outputs may not be used to improve models other than ERNIE 5.5
  Flash Base and its derivatives.

One Gateway. Every Model.

Route Smarter · Ship Safer · Spend Less

Website · Models · GitHub · Discord · X