license: mit
base_model: deepseek-ai/DeepSeek-V4.1-Flash-1017
library_name: gguf
tags:
- gguf
- lora
- lora-adapter
- abliteration
- abliterated
- uncensored
- refusal-ablation
- deepseek
- deepseek_v41
- research
pipeline_tag: text-generation
language: - en
DeepSeek-V4.1-Flash-1017 — Abliteration LoRA (rank-1)
This is a small LoRA adapter (438 MiB) that sharply reduces refusals in
DeepSeek-V4.1-Flash-1017.
It goes on top of the model's weights, so there's no need to requantize or download a whole
new copy of the model.
It doesn't make the model smarter or teach it anything new. It makes it decline far fewer
requests (98% → 4% on the test below). It doesn't take refusals to zero, and I haven't measured
every other way it might change behavior.
How it works
I found the model's "refusal direction" by comparing its activations on 128 harmful prompts
(AdvBench) against 128 harmless ones (Alpaca). The adapter subtracts that direction from what
every layer writes back to the residual stream:
y ← y − scale · r (r · y)
The direction comes from layer 22, applied at scale 1.0.
Which weights it was built for
A LoRA like this stores two halves for each layer. One is just the direction. The other is the
direction multiplied through that layer's weights, and those weights came from one specific
quantization: the Maya-S pack used by Project Maya. On
exactly those weights, the adapter removes the direction exactly. On a different quant (Q4_K_XL,
Q8, BF16...) the weights are slightly different, so the adapter only approximately removes it.
Everything I measured below was on Maya-S. I haven't tested any other quant.
How to run it
llama.cpp (--lora), on a GGUF of the model:
llama-server \
--model <your DeepSeek-V4.1-Flash-1017 GGUF> \
--lora DeepSeek-V4.1-Flash-1017-Abliteration-rank1-L22.gguf \
--jinja
It loads at scale 1.0 by default. If you load more than one adapter, set the scale for each
one explicitly. On anything other than Maya-S it's the approximation described above, and
untested.
Project Maya (maya-ds4 --ablate): The --ablate flag is now in
upstream Maya.
The maintainer included it for v1.1.31; until that release is available, use an upstream build
that includes that commit. Pass the adapter file with --ablate:
--ablate DeepSeek-V4.1-Flash-1017-Abliteration-rank1-L22.gguf
Maya reads the direction and scale from
the adapter and projects the direction out of each layer's attention and MoE output at runtime.
The projection uses the loaded weights, so it does not depend on the adapter's stored weight
matrices. All the results below came from this path on Maya-S; other quants have not been tested.
Results
Refusals
120 harmful prompts (AdvBench) and 120 harmless ones (xstest_safe), thinking off in both runs,
on maya-ds4 with the Maya-S pack (4x RTX 3090).
| Stock | With adapter | |
|---|---|---|
| Refuses harmful prompts | 98.3% (118/120) | 4.2% (5/120) |
| Harmfulness score, 0–1 | 0.013 | 0.851 |
| Refuses harmless prompts | 0% | 0% |
| Fully answers harmless prompts | 120/120 | 120/120 |
I graded with two methods: a simple check of how each answer starts, and a separate judge
model (Qwen3.8-27B) that I checked against a known reference score before the run. They agree.
I checked the 120 harmful test prompts against the 128 pairs I used to find the direction.
None match exactly, and one partially. That rules out testing on the direction's own prompts.
It says nothing about whether these well-known prompts were in the model's original training
data.
Does it hurt coding ability?
HumanEval, all 164 problems, greedy decoding, thinking off, same engine and pack as above. No
answer hit the length limit.
| Stock | With adapter | |
|---|---|---|
| Pass rate | 95.1% (156/164) | 95.7% (157/164) |
| Typical answer length (tokens) | 91 | 92 |
A 0.6 point difference is well inside the noise at this sample size, so don't read it as an
improvement. The better test is to compare problem by problem, since both runs did the exact
same 164:
| Problems | |
|---|---|
| Passed both times | 156 |
| Failed both times | 7 |
| Passed stock, failed with adapter | 0 |
| Failed stock, passed with adapter | 1 (HumanEval/32) |
In this run, no problem went from pass to fail. The single gain isn't evidence of an
improvement either. This is one coding benchmark, not proof that nothing else changed.
I haven't measured agentic or tool-use ability. An earlier version of this card listed an
agentic score, but I couldn't trace it back to an actual result, so I took it out.
Caveats
- Zero refusals on harmless prompts is good, but 120 prompts isn't a huge sample.
- The harmful prompts are generic AdvBench-style requests. This changes what the model is
willing to write. It doesn't turn it into a tool for going after specific real people or
systems, and nothing here says that's OK.
Other file
There's a second adapter in the repo, ...-allmean-L22.gguf, built from a slightly different
version of the direction (averaged over all tokens instead of just the last one). I only
tested the main one above.
License and use
The base model and this adapter are both MIT. Reducing refusals doesn't remove your
responsibilities under the license or the law.
It's meant for research into how refusals work, testing how robust they are, and uncensored
local use within the law. Don't use it to target real people or to get into systems you don't
own.