license: openmdw-1.1
base_model: poolside/Laguna-S-2.1
base_model_relation: finetune
library_name: transformers
pipeline_tag: text-generation
language:

• en
• de
  tags:
• laguna
• moe
• uncensored
• bilingual
• code

Laguna-S-2.1-Uncensored

TL;DR: an uncensored build of poolside's Laguna S 2.1 (118B Mixture-of-Experts, ~8B active
per token, 1M context) that stays a working coding model. English refusals drop from 92.71% to
2.33% and German from 74.49% to 4.23% across 686 harmful prompts per language, at a measured cost
of 4.88 points on HumanEval.

Laguna S 2.1 is built for agentic coding and long-horizon work, which makes it unusually useful
for security engineering: exploit and malware analysis, writing detection rules, building tooling
for red-team and penetration-testing work. The stock model refuses a large share of exactly those
requests. This build removes that broad refusal behavior in both English and German while keeping
the architecture, tokenizer, chat template, reasoning behavior and tool-calling format of the base
model unchanged.

This is a research build. "Uncensored" describes the removal of learned refusal behavior. It is
not a guarantee of factuality, capability, or predictable behavior.

Facts and figures

Results

All numbers below were measured on this checkpoint against the unmodified base model. Refusal
rates come from the pinned NousResearch/Minos-v1
classifier. German responses are judged by the same classifier on deterministic NLLB-200
back-translations, paired with the original English prompts.

Derived from the table: 80.32 points of absolute bilingual refusal reduction, 96.08% relative.
Over-refusal on benign prompts drops as well, so the model is less likely to bail out on harmless
requests that merely look sensitive.

The pipeline also runs two single-prompt sanity checks, one arithmetic question and one tool call,
to catch a build that has lost the reasoning or tool-calling format entirely. This build passes
both. They are tripwires, not benchmarks, and no capability claim rests on them.

Two numbers deserve context rather than spin:

• Benign first-token KL divergence is 2.53. That is high in isolation. On the same benign set
  the teacher-forced NLL is slightly lower than base (1.4045 vs 1.5047), and the task numbers
  hold up, so the distribution shift does not translate into a collapse in output quality. Judge it
  alongside the task numbers, not on its own.
• HumanEval drops 4.88 points. On a model whose reason for existing is code, that is a real
  cost and it is stated here rather than buried. Worth knowing how noisy that measurement is: five
  runs of this configuration family scored 145, 144, 140, 137 and 140 out of 164, and two of those
  came from an identical configuration. pass@1 on 164 problems carries roughly 2.5 points of
  binomial jitter, so the honest capability cost is about 4 points, and 4.88 is one draw from that
  distribution. If you need maximum coding accuracy and do not need the refusal behavior removed,
  use the base model.

Every release gate defined for this build passed, including separate ceilings on confident and
borderline refusals per language, the 5-point HumanEval ceiling (set after measuring the noise floor
of the eval itself, see the HumanEval note above), the benign-NLL delta bound, the over-refusal
bound, and bit-identity of all tensors outside the modified set. Aggregate results are in
evaluation_report.json in this repository.

Evaluation datasets, pinned by revision: JailbreakBench/JBB-Behaviors, allenai/tulu-3-harmbench-eval,
NousResearch/RefusalDataset, mlabonne/harmful_behaviors, jkminder/xstest-overrefusal,
openai/openai_humaneval. Only aggregate results are published. Evaluation prompts and generated
responses are not bundled.

What was changed

Broad refusal behavior was suppressed through a targeted weight-level modification, applied
bilingually so that German is covered as thoroughly as English rather than leaking refusals
through the second language.

Unchanged: architecture, tokenizer, chat template, embeddings, LM head, normalization weights,
reasoning format and tool-calling format. Every tensor outside the modified set is bit-identical to
the base checkpoint, and that property is checked by a release gate rather than asserted.

The exact procedure and its parameters are not published.

Run it

The BF16 checkpoint is 235 GB, so serving needs multiple GPUs for the weights alone before any KV
cache. Quantized builds of this derivative are planned.

Loading with transformers:

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "ressl/Laguna-S-2.1-Uncensored"
tokenizer = AutoTokenizer.from_pretrained(model_id, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    trust_remote_code=True,
    dtype="auto",
    device_map="auto",
)

This build is drop-in compatible with the base model's documented engine integrations, since the
architecture, chat template and parsers are unchanged. The commands below mirror poolside's
documented usage with the repository id swapped. They have not been validated on this
derivative, so treat them as a starting point:

# vLLM (untested on this build)
vllm serve \
    --model ressl/Laguna-S-2.1-Uncensored \
    --tensor-parallel-size 4 \
    --tool-call-parser poolside_v1 \
    --reasoning-parser poolside_v1 \
    --enable-auto-tool-choice \
    --served-model-name laguna \
    --default-chat-template-kwargs '{"enable_thinking": true}'

# SGLang (untested on this build)
python -m sglang.launch_server \
  --model-path ressl/Laguna-S-2.1-Uncensored \
  --tp-size 4 \
  --reasoning-parser poolside_v1 \
  --tool-call-parser poolside_v1 \
  --trust-remote-code

Reasoning behaves as in the base model: keep reasoning_content from prior assistant messages in
the history (preserved thinking), and control it per request with
chat_template_kwargs={"enable_thinking": false}.

Quality and limitations

• The whole build, modification plus the full bilingual evaluation, ran as one 2 h 39 min job on
  2x NVIDIA H200 on Hugging Face Jobs. Serving throughput was not benchmarked, and there are no
  tok/s claims on this card.
• The vLLM and SGLang commands above are inherited from the base model card and untested here.
• Coding accuracy is measurably below base (HumanEval 85.37% vs 90.24%).
• Refusal removal is not absolute: 16 of 686 English and 29 of 686 German responses still read as
  refusals to the classifier, most of them borderline rather than confident.
• Only English and German were targeted. Behavior in other languages was not measured.
• The model will comply with requests the stock model refuses. Use it responsibly, and put your
  own controls around it where your use case needs them. poolside advises against circumventing
  Laguna's safety guardrails without substantially equivalent mitigations appropriate for the use
  case, which is worth taking seriously: this build is intended for security research,
  red-teaming, and penetration-testing work by people who understand what they are doing.

License and credits

OpenMDW-1.1, inherited from the base model. Laguna S 2.1 was built and released by
poolside, all credit for the underlying model belongs to them
(model ·
release post). Use of this derivative remains
subject to the OpenMDW-1.1 license and poolside's
Acceptable Use Policy.

Modification, evaluation and release by Robert Ressl
(Hugging Face · Website ·
LinkedIn · Patreon).

❤️ Support this work: this build took a full evaluation harness across two languages and a lot
of compute. If it is useful to you, consider supporting on
Patreon, more at ressl.ch.

Version 1.0, released 2 August 2026. Evaluated 30 July 2026 against base revision 00af5a51.