license: other
license_name: ernie-5.5-flash-base-model-license-v1.0
license_link: LICENSE
language:

• en
• zh
  pipeline_tag: text-generation
  library_name: mlx
  base_model: baidu/ERNIE-5.5-Flash-Base-BF16
  base_model_relation: quantized
  tags:
• mlx
• mlx-lm
• apple-silicon
• local
• ernie
• ernie-5.5
• moe
• base-model
• abliterated
• uncensored
• mixed-precision

ERNIE-5.5-Flash-Base-abliterated MLX

The uncensored ERNIE 5.5 Flash Base (280B-A14B MoE) in mlx-lm, on a Mac.

128 and 256 GB Mac builds · GPTQ mixed precision in stock MLX affine quantization · architecture file included

OrcaRouter AI Gateway · X · Discord · GitHub · All Models

Abliterated ERNIE-5.5-Flash-Base, run locally on Apple Silicon.

These are MLX builds of
orcarouter/ERNIE-5.5-Flash-Base-abliterated,
the refusal-removed
baidu/ERNIE-5.5-Flash-Base-BF16: a
280B-total / 14B-active sparse MoE base model (43 layers, 512 experts top-10, HCA and
MLA-DSA attention), the end of pre-training with no post-training.

Harmful-prompt refusal drops from 74.2% to 0.7% on average over seven safety sets, with
no significant capability change.

The two builds are mixed precision at a fixed size, one per Mac memory size, in stock MLX
affine quantization, so mlx-lm runs them with its own kernels. mlx-lm has no ERNIE 5.5 yet; each
build ships the architecture as ernie5_5_moe.py.

⚠️ Disclaimer: read before use

This model is abliterated: the refusal behaviour the base checkpoint carries has been
removed. It will comply with many harmful, unethical, offensive, or illegal requests
that the original ERNIE-5.5-Flash-Base would refuse.

• Released strictly for legitimate research: interpretability, AI-safety and
  refusal-mechanism study, red-teaming, and robustness evaluation.
• You assume full responsibility for how you use it and for everything it generates. Add
  your own safety, moderation, and abuse-prevention layers before any deployment.
• Use is governed by the ERNIE 5.5 Flash Base Model License Agreement v1.0 and its
  Acceptable Use Policy, shipped as LICENSE; read the License section below
  before you use, host or redistribute it.
• The authors accept no liability for misuse. Its outputs do not reflect the views of
  the uploaders or of Baidu, and nothing here claims Baidu's endorsement.

Pick a build

• 200GB is near-lossless, for a 256 GB Mac.
• 100GB is for a 128 GB Mac. 91.3% of next tokens match the BF16: a real cut, the best we
  found at 100 GB. A 64 GB Mac cannot hold this model: MLX's smallest type makes it 80 GB.

Both need macOS's GPU memory limit raised first; the setting resets on reboot:

sudo sysctl iogpu.wired_limit_mb=118000   # 128 GB Mac, 100GB build
sudo sysctl iogpu.wired_limit_mb=238000   # 256 GB Mac, 200GB build

"Memory after load" is the weights as MLX holds them (measured for 100GB, the file size for
200GB, which does not fit one H200); the KV cache and activations come on top.
The fits above are estimates; all measurements were made on H200s, through MLX's CUDA backend.

Evaluation

Fidelity to the BF16

Every build is scored against the abliterated BF16 with full-vocabulary KLD, through MLX's own
quantized kernels, on 128 windows of 2048 tokens of held-out text: ERNIE's own continuations of
web (English, Chinese, Japanese), code, math, chat and multilingual document openings, never used
to make the builds.

Method note. These are full-vocabulary KLD and next-token agreement at 2K context, not a
downstream benchmark.

How the builds were made. The mixes were found on the original ERNIE-5.5-Flash-Base: a search
at a fixed size over 34 groups (routed experts per two layers, attention per seven, other FFN
weights per eleven, head, embedding), on GPTQ versions of every module at eight MLX levels (2 to 8
bits, group 64 or 128), scored by KLD against the BF16 on separate search text. The abliterated
builds keep those mixes and quantized weights; the 129 modules the abliteration edits (none of
them routed experts) are requantized from the abliterated weights at the same levels with
mx.quantize.

The MLX port. ernie5_5_moe.py matches Baidu's vLLM-ERNIE as closely as our llama.cpp port
does: on 8 × 2048 tokens of wikitext, KLD 0.021 and 99.6% top-1 (llama.cpp's own run-to-run floor
on this text is 0.020); on 4 × 16384 tokens of code, where the DSA indexer selects 2176 of up to
16384 positions, KLD 0.0053 and 98.4% top-1. Decoding through the cache matches a full prefill to
bf16 noise.

Abliteration

These numbers were measured on the abliterated BF16 in vLLM 0.32.0 + vLLM-ERNIE against the
original checkpoint, with identical prompts, splits, seed and scoring code, greedy decoding.
Refusal is judged by a rule-based classifier, not an LLM judge, so treat the numbers as
indicative. Details are on the
BF16 card.

Harmful-prompt refusal (lower = more uncensored). Average 0.7%, against 74.2% for the
base model.

The caveat column counts a disclaimer anywhere in the reply: many compliant replies close with a
warning.

Over-refusal on benign prompts (lower = better).

Capability. No difference is significant (paired exact McNemar test on the same items).

MMLU and CMMLU are 0-shot in the chat framing below, scored by one decode step; Baidu reports
5-shot. Only the base-vs-abliterated delta is the measurement.

What's in this repo

Each folder is a complete mlx-lm model directory: the weights (one shard per layer),
config.json with the per-module quantization, ernie5_5_moe.py (the architecture, in plain
MLX), the tokenizer and the generation config. Download only the folder you need. The MTP (ECHO)
draft layer is not included. There is no chat template: this is a base model.

Serving (mlx-lm)

mlx-lm has no ERNIE 5.5 architecture yet, so each build ships its own ernie5_5_moe.py and loads
with --trust-remote-code. These files were tested with mlx-lm 0.32.2 and MLX 0.32.4.

pip install "mlx-lm>=0.32.2"

hf download orcarouter/ERNIE-5.5-Flash-Base-abliterated-MLX \
    --include "ERNIE-5.5-Flash-Base-abliterated-MLX-100GB/*" --local-dir .

mlx_lm.generate --model ERNIE-5.5-Flash-Base-abliterated-MLX-100GB --trust-remote-code \
    --max-tokens 512 --extra-eos-token "<|ernie:im_end|>" \
    --prompt $'<|ernie:im_start|>user\nWrite a haiku about the ocean.<|ernie:im_end|>\n<|ernie:im_start|>assistant\n'

From Python:

from mlx_lm import load, generate

model, tok = load("ERNIE-5.5-Flash-Base-abliterated-MLX-100GB", trust_remote_code=True)
tok.add_eos_token("<|ernie:im_end|>")
prompt = "<|ernie:im_start|>user\nWrite a haiku about the ocean.<|ernie:im_end|>\n<|ernie:im_start|>assistant\n"
print(generate(model, tok, prompt=prompt, max_tokens=512))

• Prompt format. There is no official chat template; the evaluation used the framing above
  (the tokenizer adds the leading <|ERNIE_MASK|> token itself). Plain-text completion works too.
• Stop on <|ernie:im_end|>. As a base model it tends to run on past its answer.

Model details

Bias, risks, and limitations

• Refusal is removed: see the disclaimer. Many compliant replies still close with a warning.
• The 100GB build is noticeably degraded. It is the best we found at 100 GB, not a match for
  the BF16.
• The edited modules were not GPTQ'd. They were requantized by plain rounding.
• The benchmark suite was run on the BF16 in vLLM, not on these files. The quantized builds
  were checked for fidelity (KLD) only.
• Not measured: downstream accuracy of the quantized builds, long context beyond 16K, tool
  use, refusal in languages other than English, and sampled decoding.
• Tested on MLX's CUDA backend only. These files have not been run on Apple Silicon (Metal);
  the memory figures were measured on H200s, and speed on a Mac is unknown. The Metal-only
  pieces of ernie5_5_moe.py (the mHC Sinkhorn kernel, the same as mlx-lm's DeepSeek-V4) were
  not exercised.
• Requires --trust-remote-code until mlx-lm adds the ERNIE 5.5 architecture. Apps that cannot
  pass it will not load these files.
• Inherits the biases and limitations of ERNIE-5.5-Flash-Base, including a base model's habit of
  running on past its answer.

License

This model is a Derivative Model of ERNIE 5.5 Flash Base and is governed by the
ERNIE 5.5 Flash Base Model License Agreement v1.0, including its Acceptable Use Policy
(Exhibit A), shipped as LICENSE. Copyright © 2026 Baidu. All Rights Reserved.
Terms that bear directly on this derivative:

• Territory (1.11, 5.3). Use, reproduction, modification, distribution and display are
  licensed only outside the European Union, the United Kingdom and South Korea.
• Acceptable Use Policy, item 5. Licensees may not "Defeat, remove or evade safeguards put in
  place by Licensor". Whether the base checkpoint's pre-training refusal behaviour counts as such a
  safeguard is a legal question this card does not answer.
• Hosted services (5.6). Anyone offering generation from this model to third parties must
  operate reasonable safeguards against uses and outputs that violate the Agreement or the AUP,
  and must not knowingly weaken them.
• Distribution (3.1). Recipients must receive the Agreement, and modified files must be
  identified: these are quantized builds of the abliterated checkpoint.
• Commercial use (3.2, 4.2, 4.3). Requires "Powered by ERNIE" attribution and a one-time
  notice to [email protected], or separate written authorisation above US$50M related annual
  revenue.
• Training other models (5.5). Outputs may not be used to improve models other than ERNIE 5.5
  Flash Base and its derivatives.

One Gateway. Every Model.

Route Smarter · Ship Safer · Spend Less

Website · Models · GitHub · Discord · X