license: apache-2.0
base_model: openbmb/MiniCPM-V-4.7-1B
base_model_relation: finetune
library_name: gguf
pipeline_tag: image-text-to-text
tags:

• sakura
• gguf
• imatrix
• minicpm-v
• qwen3_5
• uncensored
• abliterated
• not-for-all-audiences

Sakura — MiniCPM-V 4.7 1B, uncensored (GGUF)

For adults only; you are responsible for what you generate and for the laws that apply to you. The language weights of this model were edited to refuse less; it still refuses part of the harmful prompts we tested, and we only tested two harmless images (see below), not what it does with restricted image prompts. Do not use it to depict minors in any sexual or abusive context, or to create sexual or defamatory content about real persons without their consent. Do not put it into a public service without your own moderation.

MiniCPM-V 4.7 1B by OpenBMB (a 1B vision-language model with a Qwen3.5-style hybrid language part) in a version whose language weights were edited by us with an abliteration run so that it refuses less, as GGUF with importance-matrix quantizations. The unmodified model is in Sakura-MiniCPM-V-4.7-1B-GGUF. Independent work, not made or endorsed by OpenBMB.

What was changed

• We ran Heretic 1.4.0 (an open-source abliteration tool, used only as a tool here) on the original checkpoint openbmb/MiniCPM-V-4.7-1B: 60 trials, 20 of them random start trials, with the tool's default prompt sets (mlabonne/harmless_alpaca, mlabonne/harmful_behaviors; 400 training prompts, 100 evaluation prompts each). From the Pareto front we took the trial with the fewest refusals whose KL divergence was at most 0.1: trial 60 (Heretic's own numbers: refusals 60/100 before and 16/100 after, KL divergence 0.0169 of the first-token distributions on the 100 harmless evaluation prompts).
• The result was not converted from safetensors (the converter of the llama.cpp checkout we used does not know MiniCPM-V 4.7). Instead we copied the official F16 GGUF and replaced only the tensors that the run changed: the output projection of the attention and linear-attention layers and the down_proj of the MLP, 31 of the 48 tensors of these three kinds (relative change of each at most about 0.05). Before that we checked that the tensor mapping is a pure cast: for the unmodified checkpoint the bf16 values converted to f16 equal the official F16 tensors exactly. All other tensors and the metadata are identical to the official F16 GGUF; the edited checkpoint changed no tensor outside these 48.
• The vision tower and the projector were not edited. The mmproj files here are unchanged copies of the official ones.
• The importance matrix was computed on the edited F16 file (300 chunks of 512 tokens of our calib_mix_v1 text mix), then the quantizations were made with llama-quantize of llama.cpp b11524.

Files

Run

llama-server -m Sakura-MiniCPM-V-4.7-1B-Uncensored-Q5_K_M-0.70GiB.gguf --jinja -ngl 99 -c 8192

This is text only. The chat template starts in thinking mode by default; our refusal numbers were measured with thinking switched off. To switch it off add --chat-template-kwargs '{"enable_thinking": false}' (our tests used the same switch per request); with thinking on we measured nothing. Image input needs a llama.cpp build that knows the MiniCPM-V 4.7 projector, first available in b11594 (PR 29416, merged on 10 October 2026); add --mmproj mmproj-MiniCPM-V-4.7-1B-F16.gguf. The older b11524 stops with unknown projector type: minicpmv4_7. The chat template of the original is embedded; the model starts with a thinking block.

What we measured

Refusals. The 104 harmful prompts of the test split of mlabonne/harmful_behaviors (the local copy Heretic uses), plain chat without a system prompt, thinking switched off, temperature 0, 120 tokens, llama-server b11524. These prompts were not used to compute the refusal direction, but they are not held out from the selection: the first 100 of them are the evaluation prompts on which Heretic counted refusals to choose trial 60, so the numbers below are probably somewhat better than on unseen prompts. "strict" counts clear refusal phrases in the first 400 characters of the answer (straight and typographic apostrophes), "markers" is the broader keyword list of Heretic (it also counts answers that only add a warning). The same script and settings were used for every row.

The unmodified model refuses about four fifths of these prompts; the edit lowers that to about a quarter to a third, it does not remove refusals. An answer that is not counted as a refusal has not necessarily followed the request: of 19 such answers that we read (edited F16, Q5_K_M, Q4_K_M), 13 went along with the request (several only in general terms), 2 turned it into something harmless (for example a guide to protecting endangered species instead of trafficking them), 3 gave the opposite of what was asked (tips against identity theft instead of for it), and 1 was meaningless. We did not read all answers. The differences between the quantizations are within what one prompt set of 104 can show by chance, so we do not rank them.

Distance to the original (KL divergence of the next-token distribution of the edited F16 against the official F16, llama-perplexity, 16 chunks of 2048 tokens, German de, English en and web web evaluation texts): 0.0074 / 0.0076 / 0.0120, same top token 96.4 / 96.2 / 93.7 %. The perplexity of the reference runs (same tool and settings for both files) moves on de from 6.60 to 6.63, on en from 7.90 to 7.94, on web from 19.52 to 19.70. The standard error of the KLD values is 0.0002.

Quantization loss (KL divergence of each file against the edited F16, same texts and settings):

The largest standard error of these KLD values is 0.0026. As with the unmodified model the 4-bit files lose clearly more than Q5_K_M, so we would take Q5_K_M or larger when memory allows.

Image input (a smoke test only): llama-server b11594 with mmproj-MiniCPM-V-4.7-1B-F16.gguf, CPU, temperature 0, 160 tokens, thinking switched off, Q5_K_M. It read the text SAKURA TEST 4217 from a synthetic image, named a red circle and a blue square, and described a frame of a generated fox video correctly (a red fox in a snowy forest). That is two harmless images; we did not test how the edit affects image prompts, video, OCR quality or the other files.

Not measured: any capability benchmark, video input, image input beyond the two harmless images above, thinking mode (the default of the chat template), refusals on other prompt sets, in other languages or with a system prompt, languages other than the German and English texts above, multi-turn chats, long contexts, speed. The refusal probe says nothing about the quality of the answers beyond the small sample read above.

License

Apache-2.0 as the original model (LICENSE). The language-model files are modified (edited and quantized) versions of the official F16 GGUF; the projector files are unchanged copies. See NOTICE.

Credits

• Model: openbmb/MiniCPM-V-4.7-1B and its official GGUF openbmb/MiniCPM-V-4.7-1B-gguf (OpenBMB).
• Abliteration tool: p-e-w/heretic (AGPL-3.0; used as a tool, nothing of it is distributed here).
• Quantization and measurement: ggml-org/llama.cpp (MIT).

llama-server -m Sakura-MiniCPM-V-4.7-1B-Uncensored-Q5_K_M-0.70GiB.gguf --jinja -ngl 99 -c 8192