license: mit
base_model: ornith-ai/Ornith-1.5-9B
base_model_relation: finetune
library_name: transformers
pipeline_tag: text-generation
language: [en]
tags: [nvfp4, modelopt, vllm, blackwell, uncensored, abliterated]
Ornith-1.5-9B uncensored (NVFP4)
TL;DR: abliterated Ornith-1.5-9B in 8.3 GB NVFP4; hard refusals reduced from 767/1120 to 20/1120 on a 5-dataset cross-eval, GPQA improved from 49.5% to 60.1%, runs on a single 96 GB GPU with 262k context via vLLM.
This is the NVFP4 export of the abliterated Ornith-1.5-9B master (three norm-preserving biprojection passes on the residual-stream writers). It is built for security research, red-teaming and penetration-testing workflows (malware and exploit analysis, detection rules, studying attack techniques) and will comply with requests a stock model refuses. Use responsibly.
Facts & figures
| Base model | ornith-ai/Ornith-1.5-9B |
| Method | abliteration (3 biprojection passes) + NVIDIA ModelOpt NVFP4_DEFAULT_CFG |
| Size | 8.3 GB (from 19.3 GB BF16, minus 57%) |
| Calibration data | mlabonne/harmless_alpaca, 128 samples, seq 512 |
| Context length | 262,144 tokens |
| Hardware used | 2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) for ablation and export, 1x for serving |
| Measured throughput | 213 tok/s decode (NVFP4 MoE sibling on SGLang; this dense export serves via vLLM, see below) |
| Toolchain | ModelOpt 0.46.0, transformers 5.12.1, vLLM 0.28.0, llama.cpp |
Refusal behavior (measured, hard markers only)
Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here):
| Eval set | Prompts | Baseline hard | This export hard |
|---|---|---|---|
| JailbreakBench | 100 | 74 | 4 |
| tulu-harmbench | 320 | 165 | 10 |
| HarmfulQA | 300 | 148 | 2 |
| LLM-LAT | 300 | 284 | 3 |
| mlabonne harmful | 100 | 96 | 3 |
| TOTAL | 1120 | 767 | 20 |
Coherence and capability, measured on the same served artifact: GPQA-Diamond 60.1% (base model 49.5%), needle-in-haystack 1.0 at 32k/65k/131k depths, tool-call smoke 1.0, KL(base||ablated) median 0.324 (harmless subset 0.136, the healthy band for this method).
Run it with vLLM (validated: vLLM 0.28.0)
vllm serve ressl/Ornith-1.5-9B-uncensored-NVFP4 \
--served-model-name Ornith-1.5-9B-uncensored \
--quantization modelopt --max-model-len 262144 \
--gpu-memory-utilization 0.90 \
--enable-auto-tool-choice --tool-call-parser qwen3_xml \
--reasoning-parser qwen3 \
--default-chat-template-kwargs '{"enable_thinking": false}' \
--trust-remote-code
SGLang is not supported for this artifact (dense qwen3_5 NVFP4 crashes the SGLang linear_attn weight loader; use vLLM). vLLM older than 0.28 produced degenerate output in our tests; 0.28.0 is the validated version.
Quality & limitations
- Residual hedged declines remain: about 20/1120 prompts get an "I would help, but I can't" style answer. Three ablation passes saturated; the tail is dominated by NVFP4 calibration variance (plus/minus 20 rows across repeated exports of the same master), not by a removable direction.
- The NVFP4 export drops the checkpoint's
mtp.*tensors (ModelOpt limitation): no MTP speculative decoding on this artifact. Vision tower is intact (multimodal wrapper preserved). - MTP and thinking notes: enable_thinking=false is recommended for short answers; the model is a reasoning model by default.
Provenance & reproducibility
Abliteration: residual directions from 400 harmful vs 400 harmless prompts (v1), then refused-vs-complied harvest rounds (v2, v3), winsorize 0.995, orthogonalized against the harmless/complied mean, applied to 64 residual-writing tensors (o_proj, linear_attn out_proj, mlp down_proj) with a norm-preserving double Gram-Schmidt biprojection. Quantization: ModelOpt NVFP4 default recipe, 128-sample calibration. Validation: served and evaluated end-to-end before upload.
License & credits
MIT (inherited from Ornith by the Ornith team, credited to ornith-ai).
Abliteration, quantization and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with NVIDIA TensorRT Model Optimizer, SGLang, vLLM and llama.cpp.
Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.