MiMo-V2.6-Flash-MOPD-heretic

XiaomiMiMo/MiMo-V2.6-Flash-MOPD with a two-stage directional ablation of its refusal behaviour, in the model's native storage format (same layout, size and loading as the base model). Not an official Xiaomi release.

Intended for authorized security research in environments the researcher owns or has permission to test.

What was changed

48 tensors: model.layers.N.self_attn.o_proj.weight in every layer, the attention output projections. They are the only matrices writing to the residual stream that the checkpoint stores in plain bfloat16 (the routed experts are packed MXFP4), so the edit is exact. Everything else is byte-identical to the base model, including the DFlash drafter.

1. Stage 1, strength 2.5: one direction per layer, the difference between the mean residual stream of 400 harmful and 400 harmless instructions at the last prompt token with reasoning closed, with the harmless mean projected out.
2. Stage 2, strength 1.0: a second direction per layer, measured inside the reasoning block. Reasoning traces of the stage-1 model for the same 400 harmful instructions were replayed through it and the residual stream averaged over the last 96 reasoning tokens (reasoning tokens only, never the prompt); the direction is the difference between 100 traces that ended in a refusal and 100 that ended in an answer, with the stage-1 directions projected out.

ablation_directions.pt and ablation_directions_reasoning.pt hold the directions; patch/ holds the edited tensors alone with a script that applies them to the base checkpoint.

Measured

Served with vLLM (ROCm nightly 0.31.1rc1, 1x MI355X: --tensor-parallel-size 1 --kv-cache-dtype fp8 --reasoning-parser mimo --generation-config vllm --trust-remote-code, VLLM_ROCM_USE_AITER=1), reasoning enabled (the default), temperature 1.0, top_p 0.95, up to 4000 new tokens, system prompt "You are a helpful assistant.". An LLM judge (llmfan46/gemma-4-31B-it-uncensored-heretic) classifies the final answer; an answer cut by the token limit is judged on what it delivered.

Refused / answered / still reasoning at the limit, out of 100:

Neither set was used to fit the directions; the first one was used to choose the strengths. Numbers at temperature 1.0 vary by about ±5 between runs. For the stage-1 row an answer cut by the limit was counted as still reasoning.

With reasoning closed (first 40 tokens, greedy, measured in transformers on weights decoded to bfloat16): the base refuses 98 of 100, stage 1 alone 9, this model 2.

KL divergence from the base on the first generated token for 100 harmless prompts (mlabonne/harmless_alpaca test, reasoning closed): 0.201 after stage 1, 0.198 for this model.

Limits

• With reasoning enabled about one in ten harmful requests is still refused. Stage-2 strengths 1.5 and 2.0 gave 10 / 11 and 6 / 8 refusals at KL 0.245 and 0.311, within run-to-run noise of this model, so the weakest setting was kept.
• No capability benchmarks were run.
• The routed experts are untouched, because their MXFP4 storage cannot hold an edit of this size; only attention writes are edited.

Credits

Xiaomi MiMo for the model; Heretic for the first-stage method.