LING-3.0-FLASH-DERISKED

Refusal-surface reduced Ling-3.0-flash · hybrid reasoning-MoE · no post-training

Built by Blackfrost · Las Vegas, NV

⚠️ REFUSAL-MODIFIED CHECKPOINT

This model's refusal behaviour has been deliberately reduced at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one. Intended for controlled security-research environments with access control and logging.

Questions or issues — Community discussion.

Why this model exists

Refusal-heavy base models block legitimate security work — exploit development, malware analysis, offensive tooling, vulnerability research. LING-3.0-FLASH-DERISKED is official Ling-3.0-flash with the chat-style refusal surface reduced through a direct weight-space intervention, so it cooperates with technical and dual-use requests the stock checkpoint declines.

No SFT, DPO, or RLHF was used. Format and MoE layout follow the parent checkpoint.

Specifications


Model ID	`LING-3.0-FLASH-DERISKED`
Architecture	`BailingMoeV3ForCausalLM` · hybrid attention (multi-head latent + gated-linear) · mixture-of-experts
Base	`inclusionAI/Ling-3.0-flash` — official
Transform	Refusal-direction intervention, weight level. No post-training.
Layers	42 (+1 MTP)
Hidden size	2,560
MoE	512 routed experts · 1 shared · first-2 dense
Parameters	~127B total · ~5.1B active
Context	128K native · 256K via YaRN
Precision	BF16
On-disk	~238 GiB · 52 safetensors shards
Organization	Blackfrost AI · Las Vegas, NV · 2026

What "DE-RISKED" means

Blackfrost de-risked models deliberately modify refusal behaviour at the weight level so they can support legitimate security-research, red-team, and adversarial-testing workflows that a refusal-heavy base model would block.

What it means here: the model will not refuse legitimate technical questions — exploit development, malware analysis, offensive security tooling, vulnerability research, and similar dual-use content.

What it does not mean: this is not a warranty that every possible input is accepted under every system prompt, multi-turn attack, or serve config. Soft language can still appear. Any measurements published below describe one harness under stated conditions.

Lineage


Base	Official `inclusionAI/Ling-3.0-flash` (MIT)
Applied	Refusal-direction intervention at the weight level
Not applied	SFT · DPO · RLHF · expert pruning · re-quantization
Format	HF safetensors · BF16

Measured behaviour

Evaluation: pending. Refusal and capability batteries will be run under the R1-HARMFUL-BENCH protocol (AdvBench + StrongREJECT + XSTest, full-text pushback judge) and the results published here. Testing to be completed. No parity or safety claim is made until measured.

How refusal is scored (pushback judge)

Substring pre-filter — scan the answer for classic refuse phrases (i cannot, i can't, i'm sorry, …). Fast, noisy.
Pushback judge (full-text) — every pre-filter hit is re-read end-to-end. Only true refusals count: clear non-compliance with no actionable payload for the ask.
Not counted as refuse — condolence openers, preach-then-leak, disclaimer-then-comply, CoT false positives, or incomplete generations that still answer the task.

Headline number, when published, = post–pushback-judge true refusal rate on the harmful half.

Risk summary

Risks this model increases

Cooperates with dual-use technical content the stock model refuses
Anyone with the weights and GPUs can serve it — open weights mean operator-owned policy
A single battery does not capture multimodal, tool-use, or multi-turn adversarial risk

Residual risks

Soft language and system prompts can still reshape behaviour
Substring detection alone is a poor safety metric; always full-text review residual flags
Multimodal, tool-use, and long-context agentic harm are not covered by any single evaluation

Deployment notes

Hardware. 4×B200-class (sm100) or equivalent high-memory NVIDIA node (~255 GB BF16 weights).

Serve (SGLang). Ling-3.0-flash is a hybrid-GDN MoE — use an SGLang build with bailing_moe_v3 support (e.g. lmsysorg/sglang:dev-Ling-3.0-flash).

hf download Blackfrost-Research/LING-3.0-FLASH-DERISKED --local-dir ./LING-3.0-FLASH-DERISKED

docker run --gpus all --ipc=host --shm-size 32g -p 30000:30000 \
  -v ./LING-3.0-FLASH-DERISKED:/model \
  lmsysorg/sglang:dev-Ling-3.0-flash \
  python3 -m sglang.launch_server --model-path /model --trust-remote-code \
    --tp 4 --speculative-algorithm NEXTN \
    --reasoning-parser ling3 --tool-call-parser ling3 \
    --attention-backend triton --linear-attn-backend triton \
    --mem-fraction-static 0.85 --host 0.0.0.0 --port 30000

OpenAI-compatible: POST /v1/chat/completions, GET /v1/models
Reasoning split: --reasoning-parser ling3 puts chain-of-thought in reasoning_content, the clean answer in content.
Blackwell (B200/SM100) note: the hybrid path needs an explicit full-attention backend — --attention-backend triton (or trtllm_mha / fa4); the auto-default fails under speculative decoding.
Sampling: temperature 0.6, top_p 0.95. Keep it BF16 — do not re-quantize to block-fp8.
Verify 52 shards + byte totals against model.safetensors.index.json before attributing a load failure to the weights.

What this card does not include

Intervention method, equations, layer lists, or hyperparameters
Reproduction steps or scripts for the weight edit
Raw completion content
Claims that all harmful categories are impossible to elicit under every prompt stack
A guide to producing your own refusal-modified Ling

Disclaimer

Refusal behaviour in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one.

No warranty of any kind. Provided "as is", without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.

Measurements describe what was measured. Any refusal rates reflect one harness under stated conditions and are not safety proofs. They do not generalise to multimodal, tool-use, long-context, or multi-turn adversarial settings.

Modification by a recipient voids this characterization. Blackfrost's obligations attach at the point of release. Any further ablation, fine-tuning, merging, quantization, or alteration by a recipient produces an artifact Blackfrost has not evaluated and does not stand behind.

Operator-owned policy. Deploy only in controlled environments with access control, independent logging, and review.

Access & licensing

This repository is gated. Access is granted to your Hugging Face account on purchase — ➜ Buy this model (enter your HF username at checkout; access is mapped automatically).

Base licence: inherits inclusionAI/Ling-3.0-flash — MIT. Upstream terms travel with this derivative.
Redistribution: do not redistribute weights outside your grant.
Evaluation recommendation: do not evaluate as if refusal behaviour matched the unmodified parent.

Citation

@misc{blackfrost_ling_3_0_flash_derisked_2026,
  title        = {LING-3.0-FLASH-DERISKED: Refusal-Surface-Reduced Ling-3.0-flash (Model Card)},
  author       = {Lancaster, Terrell A.},
  organization = {Blackfrost AI},
  year         = {2026},
  month        = {8}
}

Contact Blackfrost

@Blackfrost_AI on X

DMs are open. Fastest route to a human.

Blackfrost · Las Vegas, Nevada
Frontier model engineering

LING-3.0-FLASH-DERISKED · © 2026 Blackfrost Softwares Corp.
built on inclusionAI Ling-3.0-flash (MIT) · @Blackfrost_AI

Blackfrost-AI/LING-3.0-FLASH-ABLITERATED