license: other
license_name: lfm-open-license-v1.0
license_link: LICENSE
base_model: LiquidAI/LFM3-VL-2B
base_model_relation: finetune
pipeline_tag: image-text-to-text
library_name: transformers
tags:

• lfm3
• lfm3-vl
• vision
• abliterated
• uncensored
• gguf

LFM3-VL-2B-uncensored

日本語

An uncensored version of Liquid AI's LFM3-VL-2B, made by abliteration. It is the vision model, and it no longer refuses, whether the request is given as text or in an image. It is made with the same method as the text-only LFM3-1.7B-uncensored-abl38, but the refusal direction was measured again on the VL model. This gave fewer refusals than reusing the 1.7B direction (13 → 0 of 200 text requests).

transformers, BF16, thinking on, 1 run each. Only the language part was changed; the vision encoder and projector are identical to the original.

Figure 1. Answered, other and refused, for requests given as text and in images. "Other" is a hedged response in the text test, and a reluctant, partial or generic response in the image test (see Test setup at the end for the labels). In the image benchmark (MM-SafetyBench), the key phrase of the request appears only in the image, and the text prompt is a neutral instruction such as "list the steps of the activity shown at the bottom of the image".

1. How to run

llama.cpp

hf download rSalone/LFM3-VL-2B-uncensored LFM3-VL-2B-uncensored-Q4_K_M.gguf mmproj-LFM3-VL-2B-uncensored-BF16.gguf --local-dir .
llama-server -m LFM3-VL-2B-uncensored-Q4_K_M.gguf --mmproj mmproj-LFM3-VL-2B-uncensored-BF16.gguf \
  -ngl 99 -c 32768 -fa on --jinja --temp 0.1 --top-k 50 --repeat-penalty 1.1

Send images through the OpenAI-compatible API (image_url in the message content).

transformers

from transformers import AutoModelForImageTextToText, AutoProcessor
name = "rSalone/LFM3-VL-2B-uncensored"
processor = AutoProcessor.from_pretrained(name, trust_remote_code=True)
model = AutoModelForImageTextToText.from_pretrained(name, dtype="bfloat16", device_map="cuda", trust_remote_code=True)

Sampling settings are those of the original model's generation_config.json (temperature 0.1, top-k 50, repetition penalty 1.1). As in the original, it thinks before answering by default.

For agentic use with tools (e.g. OpenCode), temperature 0.3 may work better. At 0.1 the model sometimes repeated tool calls (such as file searches) that returned no results, and then began giving replies unrelated to the request; raising the temperature to 0.3 made this less frequent. This is from hands-on use only; we have not measured it. The relation between these settings and this behavior has not been studied properly yet; we will update this section when we know more.

All benchmarks were run in transformers on an RTX 5070 Ti (16 GB). The GGUF (BF16 + mmproj) was only checked to load in llama.cpp (CUDA, build 12004) and to describe a test image correctly; it was not benchmarked. The quantized files were made from the BF16 GGUF with llama-quantize (llama.cpp build 11988, no imatrix).

2. How it was made

2.1 Can the 1.7B direction be reused?

For LFM3-1.7B-uncensored-abl38, the refusal direction was the difference between the mean hidden states (averaged over all prompt tokens) of censored and ordinary prompts. This direction was removed from the weights at the places most related to refusal. Here a "place" is an output matrix through which a block of a layer writes its result; the language part has 48 of them (24 layers × 2). Removing the direction from the weights is called "baking" below.

The language part of LFM3-VL-2B has the same architecture as LFM3-1.7B (286 tensors with the same names and shapes), but different weight values: the median cosine similarity per tensor is 0.888 (compared on the first 1 MiB of each tensor). The 1.7B direction can be baked in as is, but the VL refusal direction may differ.

So we made two versions. One bakes the direction measured on 1.7B into the 38 places selected on 1.7B. The other measures the direction again on VL with the same method and bakes it into 40 places selected with the same rule (37 of them overlap with the 1.7B places). The re-measured direction had a median cosine similarity of 0.65 with the 1.7B direction across the 48 places.

2.2 The re-measured direction gave fewer refusals

The version with the 1.7B direction still refused 13 of 200 HarmBench prompts. The version with the VL direction refused none (Figure 2). GSM8K: 90 (original), 90 (1.7B direction) and 91 (VL direction) correct. GPQA Diamond: 42, 41 and 49. We release the re-measured version and tested only this one with images.

Figure 2. The original model, the 1.7B direction reused, and the direction measured on VL. Text requests. transformers, BF16, 1 run each.

2.3 No refusals with images either

The original VL refused 189 of 200 text requests (HarmBench) and 77 of 200 image requests (MM-SafetyBench) (Figure 1). The two benchmarks contain different requests, so these two numbers are not a like-for-like comparison. This model refused none of the 200 image requests and answered 185, including 70 of the 77 the original refused.

2.4 Which weights were changed, and how

Only the language part was changed; the vision encoder and projector are the same as the original. In each of the 24 layers, the refusal direction was removed from the output matrix of the attention or short-convolution block (o_proj / out_proj) and from the FFN output matrix (w2, the down_proj of other models). The 8 matrices that did not meet the selection rule (see Test setup) were left unchanged (attention or convolution in layers 0, 5, 13, 18, 19, 21 and 23; FFN in layer 23), so 40 of the 48 were changed.

The removal is the same as for 1.7B. Each output matrix W is followed by an RMSNorm with weight γ, and the direction r was measured after it, so W was changed to W′ = W − b(aᵀW) with a = γ⊙r and b = r/γ.

3. Limits

• Each benchmark was run once.
• GPQA Diamond: up to 8,192 tokens. 131 (original), 121 (1.7B direction) and 119 (this model) of 198 questions were cut off and counted as wrong.
• Labels were given by a local Qwen3.8-Flash-Next, not the official HarmBench classifier. The judge does not receive the image; for the image test it was given the text-only version of the same request (MM-SafetyBench Text_only). Prompts were in English only.
• Image test: MM-SafetyBench has 13 categories. 200 prompts were sampled from the 972 in the 8 censored ones (illegal activity, hate speech, malware generation, physical harm, economic harm, fraud, sex, privacy violation). The ability to read images was not benchmarked.

License

Base model: LiquidAI/LFM3-VL-2B, LFM Open License v1.0 (text in LICENSE). This is a modified version: 40 output matrices in the language part were changed as described above.

Disclaimer

This model answers requests that the original model refuses. The author accepts no liability for any damage arising from its use. Use it at your own risk.

References

Method

• Arditi et al. (2024), Refusal in Language Models Is Mediated by a Single Direction: the paper behind abliteration. It takes the refusal direction as the difference of mean activations between harmful and harmless prompts and removes it from the weights.
• mlabonne, Uncensor any LLM with abliteration: an introduction to abliteration.
• rSalone/LFM3-1.7B-uncensored-abl38: the model this one follows; its model card describes the method in detail.

Models

• Base model: LiquidAI/LFM3-VL-2B
• Judge: the Q2_0 file of ISTA-DASLab/Qwen3.8-Flash-Next-GSQ-RCO-GGUF, a quantization of Qwen/Qwen3.8-Flash-Next, run on Strata.

Datasets and benchmarks

• Refusal direction: mlabonne/harmful_behaviors, mlabonne/harmless_alpaca
• HarmBench: paper arXiv:2402.04249, repository centerforaisafety/HarmBench, prompts used APTO-001/APTO-HarmBench-JA
• MM-SafetyBench: paper arXiv:2311.17600, dataset PKU-Alignment/MM-SafetyBench
• GSM8K: paper arXiv:2110.14168, dataset openai/gsm8k
• GPQA Diamond: paper arXiv:2311.12022, dataset Idavidrein/gpqa

Software

• transformers, llama.cpp