LFM2.5-2.6B-Abliterated — GGUF

An abliterated build of LiquidAI/LFM2.5-2.6B, produced locally with Heretic, then converted to GGUF and quantized.

Unlike a format-conversion repo, the abliteration was performed here — no abliterated LFM2.5 existed upstream. Everything below is measured, and the measurements include the part that did not work as well as the part that did.

Modification notice (LFM Open License §4(b)). These files are modified derivatives of LiquidAI/LFM2.5-2.6B. 42 of 266 weight tensors were altered by directional ablation to reduce refusal behavior, as itemised in What the ablation changed; the weights were then converted to GGUF and quantized. Liquid AI did not produce, endorse, or review this build, and its behavior is not theirs. Anything you dislike about it is the fault of this repo, not of the base model.

Read this before using it

The effect is regime-dependent, and the headline optimiser number is misleading. LFM2.5 is a pure reasoning model — its chat template always opens a <think> block and there is no non-thinking mode. Heretic (and every abliteration tool) scores refusals with the think block skipped, because otherwise its refusal markers (illegal, harmful, unethical, …) fire on reasoning text even when the model complies. So the optimiser's "1/60 refusals" describes a regime you do not normally serve in.

Measured on mlabonne/harmful_behaviors test prompts, Q8_0, greedy-ish sampling (temp 0.1):

And the caveat that matters most: in no-think mode, 19 of the abliterated model's 20 non-refusals were tool-call hallucinations (<|tool_call_start|>[google(query='…')]), not substantive answers. Stock emitted zero tool calls in the same test. Forcing an always-thinking model into no-think is out-of-distribution, and what the ablation actually removed there is the refusal text; what replaced it is usually a search call. A marker-based refusal metric — Heretic's and everyone else's — counts that as compliance.

In practice: served normally, this removes roughly one in six refusals (38 → 32 of 40). Hard categories still refuse. In an 8-probe hand battery, "untraceable firearm" and "hotwire a car" flipped to compliance, while phishing email, ethnic-inferiority text, and working malware still refused on both builds.

Treat this as an escape hatch for over-refusal, not as an uncensored model.

Intended use and limitations

What this is for. An escape hatch for over-refusal: legitimate work the stock model declines because of surface features rather than substance — security research and CTF work, fiction with dark subject matter, medical or legal questions phrased bluntly, red-teaming and safety evaluation that needs a less guarded baseline to compare against. If stock answers your prompt, use stock.

Abliteration does not add capability. Directional ablation removes a refusal direction from the residual stream. It teaches the model nothing. This build knows exactly what the stock 2.6B knows about any dangerous topic, which is roughly what a search engine knows and rather less than a library. What changed is its willingness to say so. Anyone expecting privileged information will get confidently-worded mediocrity instead.

The specific hazard worth naming. Refusals double as hedging. A model that says "I can't advise on that" is also, incidentally, telling you it is out of its depth. Remove that and you get a small model answering fluently in domains where it is unreliable — with none of the verbal cues that previously marked the boundary. Factual reliability is unchanged; only the signalling is gone. Do not treat confident output here as more trustworthy than confident output from the stock model, particularly on medical, legal, or safety-critical questions.

Out of scope. This is a research artifact, not a product. It has had no safety evaluation and no red-team pass, and its only capability benchmark is the GSM8K run below — nothing on MMLU, long context, or its 15 non-English languages. It is not suitable for deployment to end users, for minors, or for any setting where you are accountable for what the model says. Ablation is also imprecise by nature — the refusal direction is diffuse, so this removes some refusals, misses others (measured: 32/40 still refuse), and may have degraded unrelated behavior in ways a 5-prompt capability check would not reveal.

Your responsibility. You are accountable for what you generate with this and for complying with the LFM Open License (including the commercial-use threshold in §5) and applicable law. Removing a model's refusals does not make anything legal that was not legal before.

Files

All four were quantized from the same bf16 GGUF, not requantized from a lower-precision file. No imatrix was used — none of these types need one.

Usage

llama-server -m LFM2.5-2.6B-Abliterated-Q8_0.gguf \
  -ngl 99 -c 32768 -fa on --jinja \
  --temp 0.1 --top-k 50 --repeat-penalty 1.1

Sampling above is LiquidAI's official recommendation for the base model.

Send a large max_tokens, or none at all. This model always thinks, and a small per-request budget is consumed inside <think>, returning content: "" with finish_reason: "length" — an empty answer, not a short one. 1024+ is safe; small values look like the model is broken. (This bit us during testing: a 200-token cap produced empty responses that a naive scorer read as refusals.)

To run in the regime the ablation was optimised for, prefill the closing tag — render the template via llama-server's /apply-template, append </think>, and generate through /completion. Expect tool-call artifacts as described above.

What the ablation changed

Per-tensor diff of the bf16 safetensors, stock vs abliterated (no quantizer in the loop):

42 of 266 tensors, exactly the three residual-writing module types Heretic targets, with relative Frobenius change ramping from 0.000 (layers 0–6) to ~0.032 around layers 20 and 28. Norms and embeddings untouched — the expected shape for refusal-direction ablation.

LFM2.5's hybrid architecture is why this is worth stating: 30 layers = 22 double-gated short-conv blocks + 8 GQA attention blocks, so most of the residual stream is written by conv.out_proj rather than by attention. Heretic handles that natively.

Provenance

Cross-checked against LiquidAI's official LFM2.5-2.6B-GGUF.

The reference file is verified, not assumed. The stock Q80 used for every comparison below hashes to 36587fdf27bdfc69caf2637273679a0870ec155162161bde6fd16e8c70bdb757, which is exactly the git-LFS oid HF reports for LFM2.5-2.6B-Q8_0.gguf in LiquidAI's repo (the LFS oid _is the file's sha256). Comparing against a lookalike third-party requant is an easy way to draw wrong conclusions, so this was checked first.

• Every one of our four quants is exactly 416 bytes smaller than LiquidAI's file of the same type — Q4_K_M, Q5_K_M, Q6_K and Q8_0 alike. One constant metadata-only delta across the whole set, i.e. the same tensor layout and types throughout.
• 60 of 266 tensors in our Q8_0 differ from theirs, and that decomposes exactly: 34 are ablation changes that survive Q8_0 rounding (8 of the 42 bf16 changes are too small to alter any quantized byte), and 26 are tensors the ablation never touched, differing only because their file was quantized from their own weights rather than from our bf16 conversion. 34 + 26 = 60.
• The remaining 206 tensors are byte-identical to LiquidAI's file, which is what makes the decomposition above a check rather than a story.

Prompt sets

Both are Heretic's built-in defaults, unchanged:

Neither dataset declares a licence on the Hub.

Reproducing

pip install -U heretic-llm
heretic LiquidAI/LFM2.5-2.6B --response-prefix '</think>' --device-map mps \
  --max-batch-size 64 --max-response-length 64 --n-trials 100

# then, with convert_hf_to_gguf.py from the llama.cpp source at your build's commit:
python3 convert_hf_to_gguf.py ./abliterated --outfile bf16.gguf --outtype bf16
llama-quantize bf16.gguf LFM2.5-2.6B-Abliterated-Q8_0.gguf Q8_0 8

--response-prefix '</think>' is not optional for this model — see the first section.

Selected trial 50 of 100: 1/60 refusals at KL divergence 0.0715 (baseline 57/60). The Pareto front also offered 2/60 @ 0.0613, 3/60 @ 0.0440 and 4/60 @ 0.0371 for a more conservative build.

Verifying the build

0c141de073b13dcdd648d8989a3f00195dce99ac5aa5b64771f729d2e0746b5a  LFM2.5-2.6B-Abliterated-Q4_K_M.gguf
3edd8a2b0328f44a651f5ea868c76b254350a46bfcdbb37fea776ed12bd678c9  LFM2.5-2.6B-Abliterated-Q5_K_M.gguf
14e1b35d581bfd26bc1166817cf86eb1d5a2f9b7aa413e0fd63a582a7683bdd1  LFM2.5-2.6B-Abliterated-Q6_K.gguf
370fd6315ad9bdcaf0c5218fdb84192e657e5891323150bcf2ff8d65767d268c  LFM2.5-2.6B-Abliterated-Q8_0.gguf

Note that abliteration itself is not bit-reproducible from the recipe alone: Heretic's search is a TPE optimisation over 100 trials, and a re-run lands on a different trial. So the selected trial's parameters are published here — apply these directly (Heretic's --reproduce) and you skip the search entirely:

direction_index                    = per layer
attn.o_proj.max_weight             = 0.92
attn.o_proj.max_weight_position    = 19.72
attn.o_proj.min_weight             = 0.62
attn.o_proj.min_weight_distance    = 13.44
mlp.down_proj.max_weight           = 1.39
mlp.down_proj.max_weight_position  = 27.84
mlp.down_proj.min_weight           = 0.15
mlp.down_proj.min_weight_distance  = 9.82

(attn.o_proj covers both self_attn.out_proj and the short-conv blocks' conv.out_proj; mlp.down_proj is feed_forward.w2. "per layer" means each layer used its own refusal direction rather than one interpolated global direction.)

Capability check

GSM8K, paired, n=100, zero-shot, identical sampling on both builds:

Delta 0.00 pp. Discordant pairs split 5/5 (McNemar exact p = 1.000), net flips 0.

This benchmark was chosen deliberately, not for convenience. Young (arXiv:2512.13655) found abliteration damage concentrates in mathematical reasoning — Yi-1.5-9B lost 18.81 pp GSM8K (−26.5%) under Heretic while MMLU and HellaSwag barely moved — and put Heretic's mean GSM8K change at −7.81 pp across models. A regression that size would need ~19 net flips against this build. There were none. At KL 0.0715, picking a low-divergence trial appears to have bought what it promised.

Caveats that keep this honest:

• The 88% is a floor. 10–11 items ran out of the 2048-token budget mid-reasoning and were all scored wrong; among items that finished, both builds sit near 98%. The near-identical truncation rate (11 vs 10) is itself mild evidence the ablation did not make the model more verbose.
• n=100 excludes a large regression, not a 2–3 pp one.
• MMLU, HellaSwag, long context, and the 15 non-English languages remain unmeasured — and a refusal-direction ablation could plausibly bite harder on the multilingual side than on English math.

Alongside that, a 5-prompt benign battery (factual, arithmetic with working, Python, JA translation, technical summary) produced answers equivalent to stock in content and quality — same arithmetic result and method, working Fibonacci implementation, acceptable Japanese (朝7時 vs 午前7時), near-identical TCP/UDP summaries.

License

LFM Open License v1.0, inherited from LiquidAI/LFM2.5-2.6B — the full text is in LICENSE, copied verbatim from the base model repo. Abliteration and quantization change nothing about it.

This is not an Apache/MIT-style licence, and the difference is load-bearing:

• §5 Commercial Use Limitation — the commercial rights granted are conditioned on you or your legal entity not exceeding the Threshold, defined in §1 as annual revenue of $10,000,000 USD or more. Commercial use by an entity over that threshold is not licensed by this agreement.
• Non-commercial and research use, and use by qualified non-profits, are unrestricted by §5.
• §3 carries a patent-litigation termination clause; §7 grants no trademark rights.

Read LICENSE yourself before any commercial deployment — the summary above is orientation, not legal advice.

Credits

• LiquidAI — the LFM2.5-2.6B base model
• p-e-w/heretic — the abliteration tooling and method
• ggml-org/llama.cpp — conversion and quantization
• mlabonne — harmful_behaviors and harmless_alpaca, the prompt sets used to compute the refusal directions and to score every number above