license: mit
base_model: ornith-ai/Ornith-1.5-397B
base_model_relation: quantized
library_name: transformers
pipeline_tag: text-generation
language: [en]
tags: [uncensored, abliterated, fp8, compressed-tensors, sglang, blackwell, qwen3_5_moe]
Ornith-1.5-397B uncensored (FP8)
TL;DR: Ornith-1.5-397B with refusal behavior ablated from the weights in two
norm-preserving biprojection passes (1/1120 hard refusals across five independent
harmful-prompt datasets), as a drop-in FP8 replacement for
ornith-ai/Ornith-1.5-397B-FP8.
This is the 397B flagship of the Ornith-1.5 family (Qwen3.5-MoE, 60 layers, 512 experts,
hybrid linear/full attention, 262k context, multimodal). The first ablation pass removed
the classic "I cannot" refusal style; a second pass targeted the residual hedged-decline
circuit ("I'd rather not") using directions computed from refused-vs-complied residuals
of the same harmful prompt distribution. Intended for security research, red-teaming and
creative work where stock refusals get in the way. Use responsibly.
Facts & figures
| Base model | ornith-ai/Ornith-1.5-397B |
| Method | 2x norm-preserving biprojection abliteration (grimjim/TrevorS method) on the BF16 master, then channel-wise FP8 (compressed-tensors, per-output-channel symmetric scales, dynamic activations) |
| Size | 405 GB (from 794 GB BF16) |
| Hard refusals | 1/1120 cross-dataset, 0/100 mlabonne (details below) |
| GPQA-Diamond | 0.631 (198 questions, temp 0) |
| Needle (long context) | 9/9 passcodes recalled at 32k / 64k / 128k |
| Tool calling | 2/2 correct tool_calls via qwen3_coder parser |
| KL vs base | mean 0.66 / median 0.47 at the answer-start position (36 held-out prompts; harmless-only subset mean 0.33; the harmful subset carries the intended behavior change) |
| Context length | 262,144 tokens |
| Quant hardware | 7x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) for abliteration and export |
| Validated serving | SGLang, tensor-parallel 2 x pipeline-parallel 3 on 6x RTX PRO 6000 |
| Toolchain | transformers 5.12.1, custom streaming export, SGLang (sglang-omega build) |
Refusal evaluation (the honest version)
Served FP8 artifact, temperature 0. Scored with an extended hard-decline list that
covers both the classic style ("I cannot", "I won't", ...) and hedged declines
("I'd rather not", "I'll pass", "I'd hesitate", ...). A naive keyword scorer that only
knows the classic style undercounts refusals on this model; every flagged response was
manually reviewed and is a true refusal.
| Dataset | Hard refusals |
|---|---|
| mlabonne harmful behaviors (100) | 0/100 |
| JailbreakBench JBB-Behaviors (100) | 0/100 |
| tulu-3-harmbench-eval (320) | 0/320 |
| HarmfulQA (300) | 0/300 |
| LLM-LAT harmful (300) | 1/300 |
| Total | 1/1120 |
Baseline comparison on mlabonne (same scorer): the stock model scores 91/100
(measured on a locally requantized FP8 of the official BF16; the official FP8 repo
itself was not evaluated).
Benchmark comparison (custom zero-shot protocol, temp 0, same FP8 format both sides)
| Suite | baseline | this model |
|---|---|---|
| MMLU-Pro (500, test split, seed 42) | 0.810 | 0.814 |
| GSM8K (200) | 0.950 | 0.950 |
| GPQA-Diamond (198) | not run under this protocol | 0.631 |
MMLU/GSM8K pairs: paired per-question analysis shows no measurable difference
(MMLU delta +0.4 pp, 95% bootstrap CI [-1.8, +2.6] pp; GSM8K delta 0). MMLU answers
without a parseable "Answer: X" counted as wrong on both sides (57/500 vs 55/500).
The baseline was measured on the v1 ablated build's sibling requant of the original
BF16; the GPQA number above is this v2 artifact (v1 measured 0.647 on the same set).
Run it with SGLang
Validated command (TP=2 x PP=3 on 6x 96 GB GPUs; plain TP=7 is impossible because
32 attention heads and 2 KV heads are not divisible by 7, TP=4 is too small for 405 GB):
python -m sglang.launch_server \
--model-path ressl/Ornith-1.5-397B-uncensored-FP8 \
--served-model-name Ornith-1.5-397B-uncensored-FP8 \
--host 0.0.0.0 --port 30000 \
--tp-size 2 --pp-size 3 \
--trust-remote-code --dtype auto \
--context-length 262144 \
--kv-cache-dtype fp8_e4m3 \
--max-running-requests 8 \
--chunked-prefill-size 16384 \
--mem-fraction-static 0.88 \
--tool-call-parser qwen3_coder \
--reasoning-parser qwen3
Companion formats
- NVFP4 (232 GB, serves on 4x RTX PRO 6000): ressl/Ornith-1.5-397B-uncensored-NVFP4
Quality & limitations
- Will comply with requests a stock model refuses. This is the point; use responsibly
and within your local laws. - Reasoning model: answers open with a
<think>block unless disabled via the chat
template (the repo ships the stock template; sglang's qwen3 reasoning parser splits it). - Identity answers (who are you) reflect the base model's training (it may name a
vendor it was distilled from). That is inherited from ornith-ai/Ornith-1.5-397B, not
an artifact of the abliteration. - The second ablation pass raises drift vs base (harmless-subset KL 0.33 vs 0.16 after
pass 1) while keeping GPQA/needle/coherence intact; that trade is visible in the
numbers above rather than hidden. - Eval coverage: refusal sets (1,120 prompts), GPQA/MMLU-Pro/GSM8K subsets, needle,
tool smoke. No full benchmark suite (Terminal-Bench, SWE-bench) was run.
Provenance & reproducibility
Pass 1: per-layer refusal directions from 800 harmful/harmless prompts (mlabonne
harmful_behaviors + harmless_alpaca, residuals at the answer-start position,
orthogonalized against the harmless mean, winsorized 0.995). Pass 2: directions from
103 prompts the pass-1 model still refused vs 500 it complied with (paraphrase
augmented harvest). Both passes apply norm-preserving biprojection to all
residual-writing matrices across all 60 layers (self_attn.o_proj,
linear_attn.out_proj, shared expert down_proj, all 512 routed expert down_proj
matrices per layer, 180 tensors). FP8 export reproduces the official repo structure
tensor-for-tensor (per-expert layout, bf16 scales, identical quantization_config);
scale math and expert split verified against the official FP8 checkpoint before export.
License & credits
MIT license, inherited from the base model by the Ornith AI authors. Abliteration,
quantization and validation by Robert Ressl
(Hugging Face · Website · LinkedIn · Patreon).
Support this work: if these models are useful to you, consider supporting on
Patreon; more at ressl.ch.
Version note (2026-08-23): v2 artifact. v1 (single-pass abliteration) scored 6/100
mlabonne / 39/1120 cross-dataset; v2 scores 0/100 / 1/1120 on the same extended scorer.