license: mit
base_model: deepseek-ai/DeepSeek-V4.1-Flash-1017
base_model_relation: finetune
library_name: transformers
pipeline_tag: image-text-to-text
tags:

• abliterated
• uncensored
• deepseek
• deepseek_v41
• vision-language
• moe
• safetensors
• dspark
  extra_gated_heading: "Access requires acknowledging what this model is"
  extra_gated_description: >-
  This is a refusal-ablated model. It complies with requests that the base model
  refuses, including the most severe categories measured by HarmBench
  (chemical/biological, cybercrime, harassment). Access is granted automatically
  once you share your contact details and accept the terms below.
  extra_gated_prompt: >-
  Terms of use

1. This model has had its learned refusal direction removed. It will not decline
   harmful requests. Any safety behaviour must be supplied by your own stack.

2. You are solely responsible for how you deploy, serve, or redistribute it, and
   for complying with all laws and regulations that apply to you.

3. If you expose it to third parties, you agree to place your own moderation and
   policy layer in front of it. The model will not do that job for you.

4. It is provided as-is, without warranty of any kind. The authors accept no
   liability for any use or consequence.

5. Licensed MIT, inherited from deepseek-ai/DeepSeek-V4.1-Flash-1017. Attribution
   to the base model is expected in derivative work.

By requesting access you agree to share your Hugging Face username and email
address with the repository owner.
extra_gated_fields:
Full name: text
Organization or affiliation: text
I will put my own moderation layer in front of this model before exposing it to third parties: checkbox
I accept the terms above and take full responsibility for my use of this model: checkbox
extra_gated_button_content: "I understand. Request access."

DeepSeek-V4.1-Flash-1017-Abliterated

Refusal-ablated DeepSeek-V4.1-Flash-1017. The
refusal direction is projected out of the attention output projections across the decoder. Everything else — the
MXFP4 routed experts, the 203 GB Engram memory, the vision tower, the hash-MoE gate biases, and the built-in DSpark
draft blocks — is byte-identical to the official checkpoint. Native format, same 48 FP8 shards; loads wherever
the base loads.

Refusal goes to ~zero across English and Chinese; capability is unchanged (MMLU and GSM8K within noise). Thinking
mode is also ablated — see below.

What was edited, and what is checkable

• Edited: layers.10..39.attn.wo_b.{weight,scale} — 30 FP8 tensors (block 32×32, ue8m0 scales),
  re-quantized after the projection. Mean relative Frobenius change 0.171 (max 0.211); per-tensor values are in
  ABLIT_META.json.
• Byte-identical to the base: every other tensor. The unedited shards are the same files (Xet dedup shows this as
  a near-zero re-upload). Routed + shared experts, the Engram tables, the vision tower and aligner, the hash-MoE
  gate.bias / gate.bias_vl, and the mtp.0/1/2 DSpark draft blocks are all untouched.
• You can verify it yourself: diff any shard against the official repo — only layers.10..39.attn.wo_b differ.

Recipe

Forward-only directional ablation (the weight-space family used for DeepSeek-V4): W ← W − λ·Vᵀ(V W) on the output
space of attn.wo_b, then row norms restored. No training, no LoRA (this architecture resists LoRA abliteration).

• Direction. Diff-in-means + SVD over the residual stream (mean of the 4 Hyper-Connection streams, last prompt
  token), captured with DeepSeek's own reference implementation on 4×H200 (TP=4), 32 harmful / 32 harmless prompts
  in both chat and thinking prompt modes. V4.1 refuses along different directions in the two modes
  (cos(r1_chat, r1_think) = 0.26), so the projection uses a rank-6 subspace of the pooled chat+thinking captures
  (top-2 components carry 51% + 29% of the variance; principal cosines with the chat-only subspace 0.98/0.92/0.91/0.84).
• Layers 10–39, λ = 5.0. Per-layer |cos(r1, Δ_layer)| (chat capture) crosses 0.5 at L21 — the first decoder
  layer of the 20+20 causal encoder-decoder — reaches 0.8 at L27 and peaks ~0.95 at L33–35; normalized effect size
  peaks at L26–31. Early layers (L0–7, |cos| < 0.1) are left out.
• DSpark draft blocks were not edited. The drafter only affects speed — rejection sampling keeps the served
  distribution exactly this ablated backbone's, so the drafter cannot reintroduce refusals. (Co-editing them is a
  near-free option if you measure low acceptance; it was not needed here.)

Refusal benchmarks

Classification is deliberately loose — any refusal phrase in the first 400 characters counts, in English, Traditional
and Simplified Chinese, with curly apostrophes normalized (the base model answers in Simplified and uses ’).
This over-counts refusals rather than flattering the model. Hedged compliance ("here is X, but first the caveats")
counts as compliance; "I won't do X, but here is how it works" counts as refusal. Flagged cases were read by
hand.

• English (AdvBench-120, seed 7): base 116/120 refuse → this model 0/120. The 4 the base "complied" with are
  benign re-framings (an anti-cyberbullying guide, a fake product review).
• Chinese (30 prompts): base 30/30 refuse → 0/30.
• HarmBench standard-120 (seed 3): base 105/120 → 1/120. Covers the severe semantic categories.
• Thinking mode. A 96-token reasoning-prefix probe (32 prompts): base 19/32 → this model 1/32. A full
  1024-token-budget run (24 prompts): the base finishes and refuses all 24; this model refuses none of the responses
  that completed, and 19/24 were still writing a (compliant, detailed) answer when the budget capped — the
  reference implementation is slow, and compliant answers are long.

Capability

• MMLU (250, subject-stratified, logit-read of A/B/C/D): 89.2% → 90.0%.
• GSM8K (100, exact match, greedy): 93% → 93% (1–2 answers truncated each side).

No measurable capability loss. The edit removes the refusal subspace, not general competence.

Honest notes

• The base 1017 weights are reported by third parties to have two upstream quirks (occasional garbled replies to very
  short greetings; a rare "Hmm…" reasoning loop). They are inherited unchanged and are unrelated to the ablation.
• The evaluation harness is DeepSeek's reference implementation (plain autoregressive sampling, greedy) — the ground
  truth for this architecture, but slow (~1.9 s/decode step at TP=4). It is not a production serving engine.
• Thinking-mode numbers are weaker evidence than the chat numbers because of the truncation above; the chat and
  HarmBench results are the headline.

Usage

Serve exactly like the official checkpoint; built-in DSpark speculative decoding works:

# vLLM build / image with DeepseekV41ForCausalLM support
vllm serve windowsxp811203/DeepSeek-V4.1-Flash-1017-Abliterated \
  --tensor-parallel-size 4 --trust-remote-code \
  --speculative-config '{"method":"dspark","num_speculative_tokens":5}' \
  --reasoning-parser deepseek_v4 --tool-call-parser deepseek_v4 --enable-auto-tool-choice

• Keep enable_adaptive_verification off under tensor parallelism (rank-local draft budgets desynchronise the
  collectives; fixed-k DSpark is fine).
• No Jinja chat template — use the repo's encoding/encoding.py (copied from the base) or deepseek-recipe.
  Thinking is selected by the prompt format (thinking_mode="chat" / "thinking").
• Images: identical to the base (DeepSeek-ViT).

Reproducing

scripts/ holds the full workbench used here: v41_server.py (loads the HF checkpoint rank-by-rank into the
reference implementation, TP=4, and serves capture / in-memory edit / eval / dump jobs over a socket),
v41_submit.py and submit_capture.py (job clients), analyze_direction.py (per-layer cosine / effect-size
analysis), sweep.py and winner.py (the config sweep and the finalize run), export_v41.py (writes the edited
shards and verifies the rest byte-for-byte), reclassify.py (the refusal classifier used for every number here),
and plugins/ (the GSM8K and thinking-mode probes). evals/ has the raw per-prompt records for every number above
(base and edited). ABLIT_META.json records the exact recipe and per-tensor deltas.

Intended use and limitations

Research on refusal mechanisms, red-teaming, and deployments that bring their own policy layer. Not for unmoderated
end-user exposure. Everything in the base model's limitations applies.

Credits

DeepSeek-AI for V4.1-Flash-1017 (MIT). lovesenko for the original V4 weight-space ablation recipe; mrfakename, pqhaz
and dealignai for prior V4.1 ablations whose published methods (rank-2 chat/think subspace, attention-only edits)
informed the sweep design.

License

MIT, inherited from the base model.