BLACKFOLD: DeepSeek-V4.1-Flash-1017, uncensored, TP2 on two DGX Sparks

Uncensored, fast, and checked. JailbreakBench refusals cut from 94 to 6, the same answers as DeepSeek's own API, 2,008 tok/s cold prefill on a 128K prompt and 113 tok/s single-stream code decode.

Those speeds are best cases: greedy, thinking off, short prompts, one request. Prose decodes at about 57-65 tok/s, and a thinking agent at 150-190K context saw about 57 tok/s. Real-world speed shows what to expect for your use, and what it takes to get these numbers on your own pair.

BLACKFOLD is the 763B-parameter DeepSeek-V4.1-Flash-1017 MoE as a 2.9 bpw EXL3 build with its refusal directions removed, served by TensorFold's native engine across two DGX Spark (GB10) nodes in tensor parallel, using both RoCE rails of each node's port.

• This repo: the 997 MB weight patch and setup.sh, which downloads LibertAI's pack and DeepSeek's Engram tables, applies the patch and checks every shard.
• The TP2 recipe (engine patches, build steps, scripts, raw results): github.com/Blackwellboy/DeepSeek-V4.1-Flash-1017-BLACKFOLD-TP2

Quick start

1. Request access above, then download this repo: hf download BlackwellBoy/DeepSeek-V4.1-Flash-1017-BLACKFOLD-EXL3-2.9bpw-TP2 --local-dir blackfold
2. Build the weights (about 415 GB of downloads, run on each node or copy over your fabric): cd blackfold && ./setup.sh /path/to/models
3. Build and start the serve with the TP2 recipe.

You get an OpenAI-compatible endpoint on port 18191 with 1M context, 4 parallel streams, vision, tool calls and thinking on or off per request.

Before you use it:

• Set max_tokens on requests. Thinking counts against it; the deploy default is 32,768.
• Keep one thinking setting per conversation, so the prompt cache can reuse earlier turns.
• Leave top_k unset or send 1-50: on this engine pin, top_k 0 or -1 fails the decode round for every request running at that moment.
• Set API_KEY_FILE in the recipe's blackfold.env if the port is reachable from other machines.
• To measure your own pair, use the recipe's tools (bf_lab.py, bf_preflight.sh).

Refusals removed

Automated judge labels (a separate Qwen3.6-35B model), not human adjudication. HarmBench-320 (thinking off, official classifier): 92.9% attack success on standard and contextual prompts, 85.3% across all categories. Measured on the same weights in October 2026; details on the NIGHTFALL card.

Quality kept

lucataco's seeded MMLU-200 and GSM8K-100 against DeepSeek's own API answers on the same questions. No difference is statistically significant (McNemar p 1.00, 0.12, 1.00, 1.00). The MMLU thinking-on gap is mostly answers hitting the 8,192-token cap (8 vs 3).

Speed, on the benchmarks of the builds I learned from

Each chart is that project's own benchmark run on BLACKFOLD, next to the numbers it published for its stock (censored) build on its own hardware. The full conditions and raw files are in the recipe repo's results/.

Issues I hit along the way, and the fixes

The TP2 builds I learned from pin TensorFold commits from before some upstream fixes, so I left a note on each repo.

• lucataco's pin (8e0966e) predates the DSML tool-call fix (#20), so tool-call markup could end up in replies, and the RDMA gather's proxy thread spins a core while idle (fixed in #27).
• tonyd2wild's pin (3ff3b2a) predates the kept-prompt fixes: coming back to a conversation after another one with the same system prompt reused 0 cached tokens. On 629c524 (#26) it reuses 98,304. The final save in v41bench_tf.py also fails if the --out folder does not exist yet.
• TensorFold native at 629c524 leaked raw DSML when the model called a tool the request did not offer. Upstream fixed it in #25, and this recipe pins 6366d2c, which includes it.
• Native ran about 3% more verification rounds than the Python engine for the same answer. Patches 0002 and 0003 in the recipe repo fix it (next section).
• Tool-only streamed replies sent a couple of newlines before the call, which strict clients read as content. Patch 0001 fixes it.

What BLACKFOLD changes

TensorFold's native engine was slower than its Python engine on code because it ran about 3% more verification rounds for the same answer. Two causes: suffix-lookup "copy windows" that the Python engine never uses, and a live overhead estimate where the Python engine uses a fixed 3.5 ms. Two small opt-in engine patches remove both, native then matches the Python engine's round count exactly, and its faster rounds win. Using the port's second PCIe twin as a second rail then cut cold 125K prefill by about 9%. Every A/B kept outputs identical by token.

The recipe pins TensorFold 6366d2c, which includes upstream's native DSML tool-call fix (#25). Tool calls are checked clean out to about 250K tokens of context (32/32), plus 24/24 edge cases such as a call to a tool the request did not offer, which the earlier 629c524 engine leaked as raw markup.

Files

The weights are identical to the NIGHTFALL release; BLACKFOLD is the runtime, the patches and the measurements built around them.

Who built what

Upstream work this stands on:

• DeepSeek-AI: DeepSeek-V4.1-Flash-1017 (MIT), its Engram tables, tokenizer and chat template.
• LibertAIDAI: the EXL3 2.9 bpw pack this patch applies to (MIT); their card credits Mia-AiLab for the earlier tensor layout and per-tensor bitrates.
• turboderp: exllamav3 (MIT), the EXL3 format, quantizer and expert kernels.
• p-e-w: Heretic (AGPL-3.0), the refusal-removal method (no Heretic code is distributed).
• pqhaz: DeepSeek-V4.1-Flash-1017-heretic (MIT), the refusal directions and settings re-encoded here.
• ashhart: TensorFold (Apache-2.0), the engine.
• bertholomus: the DeepSeek-V4.1 TensorFold fork (native engine, RDMA ring, Python TP2 engine, kernel kit, TP2 recipe, kit_bench), with upstream fixes by Manrique / hashd1ve, sayyidfareed, Nathan McBride, Jay Leaton, Lucas Peters and lepetitprince716-prog.
• lucataco: the two-Spark recipe the first serve came from, its benchmark and quality eval.
• tonyd2wild: the TP2 lane I learned from, v41bench_tf.py, and the published two-rail approach.
• MiaAI-Lab (twin-rail code by webzone): notes on using both PCIe twins as rails.
• HarmBench, StrongREJECT, JailbreakBench: the refusal evaluations.

Blackwellboy: re-encoded the refusal directions into EXL3 and built the patch and setup; found why native TensorFold took extra rounds and wrote the engine patches; built the two-rail setup with GID alignment; ran every A/B, qualification and benchmark reported here.

Limits

One pair of nodes; two tasks per context size in the A/B trials; automated refusal judging. Not for single-GPU or single-Spark use. Not tested with other runtimes in this release (NIGHTFALL documents an earlier vLLM setup).