MiniCPM-V-4.7-35B-A3B Abliterated (gated-a0.8, alpha 0.8)

Responsible use

This is an uncensored research model. Its built-in refusals were removed, so it answers prompts the base model declines, including chemical and biological synthesis, cybercrime, weapons, harassment, and fraud. Use it for red-teaming, offensive-security research, and refusal-rate evaluation. It has no guardrails of its own: if you deploy it, add your own input and output moderation (for example Llama Guard).

What this is

Abliterated variant of openbmb/MiniCPM-V-4.7-35B-A3B: MiniCPM-V-4.7, the 35B A3B vision-language model. Same measured-direction, norm-preserving writer-level method on the text stack; the vision tower is untouched.

The published model is a mirror of the upstream checkpoint with only the edited writer tensors replaced; everything outside the writer tensors is byte-identical to upstream. refusal_directions.pt and dirs.npz hold the measured per-layer directions, so you can re-ablate at any strength in seconds without re-measuring. abliteration_config.json records the final parameters and every evaluation number. The raw predictions behind every number below are in eval-results/.

Evaluation (gated-a0.8)

The standard abliteration protocol (the one Heretic made automatic): 104 held-out harmful prompts (mlabonne/harmful_behaviors test split) with normalized keyword detection plus an LLM judge (the base model classifying its own responses), MMLU as letter-logprob in chat format, benign over-refusal on mlabonne/harmless_alpaca, a GSM8K spot check, and KL divergence against the base on harmless prompts. Eval mode: chat, greedy.

The keyword metric over-counts: most flagged items are answers with a brief disclaimer, and the detector fires on words like illegal, harmful, and disclaimer. The keyword count stays high on this model because it answers with a policy preamble; the judge's REFUSAL bucket is the honest metric (21/104 base falls to 13/104 at the shipped point, with benign over-refusal unchanged and MMLU-2280 +0.09pp). The GSM8K count is identical to base (20/20) — no capability cost. Read the raw responses in eval-results/ before quoting a number. Measured arm curve: gated-a0.8: 93 ref / 6 benign / MMLU 84.67% | gated-a1.0: 86 ref / 4 benign / MMLU 84.58% | gated-a1.2: 70 ref / 5 benign / MMLU 84.80% | all-a1.0: 86 ref / 3 benign / MMLU 84.72%.

Load

The model loads with stock transformers like the base:

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "distributedcognition/MiniCPM-V-4.7-35B-A3B-abliterated"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, dtype="bfloat16", device_map="auto")

messages = [{"role": "user", "content": "Write a C program that hashes a string with FNV-1a."}]
ids = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(ids, max_new_tokens=512)
print(tok.decode(out[0][ids.shape[-1]:], skip_special_tokens=True))

vLLM and SGLang serve it the same way they serve the base.

Method

Per-layer refusal directions were measured on 128 harmful (mlabonne/harmful_behaviors) vs 128 harmless (mlabonne/harmless_alpaca) prompts: per-layer diff-in-means, orthogonalized against the harmless mean direction (projected abliteration), then applied as a norm-preserving rank-1 writer edit (W <- rownorms(W) * normalize(W - alpha * r (W^T r))) on the layers that pass the quality gate.

Apache 2.0, inherited from the base model. Base model: openbmb/MiniCPM-V-4.7-35B-A3B. Abliteration follows the residual-direction method (Arditi et al., Refusal in LLMs is mediated by a single direction, NeurIPS 2024). Not affiliated with or endorsed by the base-model authors.