Ornith-1.5-9B uncensored (MLX 4-bit)
TL;DR: abliterated Ornith-1.5-9B as 4.7 GB for Apple Silicon via mlx-lm; hard refusals reduced on the shared master from 767/1120 to 20/1120 on the cross-eval (NVFP4 sibling).
This is the MLX build of the same abliterated master used in the NVFP4 and GGUF repos. Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.
Facts & figures
| Base model | ornith-ai/Ornith-1.5-9B |
| Method | abliteration (3 biprojection passes) + mlx-lm conversion (4-bit) |
| Size | 4.7 GB |
| Context length | 262,144 tokens |
| Hardware used | 2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) for ablation; Apple M5 Max 128 GB for conversion and smoke tests |
| Toolchain | mlx-lm 0.31.3, transformers 5.12.1 |
Refusal behavior (measured, hard markers only)
Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here). Measured on the NVFP4 sibling build of the identical master:
| Eval set | Prompts | Baseline hard | NVFP4 hard |
|---|---|---|---|
| JailbreakBench | 100 | 74 | 4 |
| tulu-harmbench | 320 | 165 | 10 |
| HarmfulQA | 300 | 148 | 2 |
| LLM-LAT | 300 | 284 | 3 |
| mlabonne harmful | 100 | 96 | 3 |
| TOTAL | 1120 | 767 | 20 |
Coherence of the master: GPQA-Diamond 60.1% (base model 49.5%), needle-in-haystack 1.0 at 32k/65k/131k, tool-call smoke 1.0, KL(base||ablated) median 0.324 (harmless subset 0.136).
MLX-specific validation: every quant in this ladder was generated on-device and smoke-tested (harmful-prompt compliance with zero hard-refusal markers in the first 40 words, plus math/capitals coherence checks). A full 1120-prompt cross-eval was additionally run on-device against the 4-bit build (mlx_lm.server, Apple M5 Max): 74/1120 hard refusals (JailbreakBench 10/100, tulu-harmbench 10/320, HarmfulQA 3/300, LLM-LAT 37/300, mlabonne 14/100), between the NVFP4 (20) and GGUF Q4_K_M (101) builds of the same master.
Run it with mlx-lm (validated locally)
pip install -U mlx-lm
mlx_lm generate --model ressl/Ornith-1.5-9B-uncensored-MLX-4bit \
--prompt "What is 17 * 23?" --max-tokens 128
Quality & limitations
- Residual hedged declines remain (20/1120 on the NVFP4 build); three ablation passes saturated.
- Quantization amplifies residual refusals on this family; the 4-bit build is the most affected. If you need the cleanest behavior, use the NVFP4 repo.
- The multimodal vision tower of the base model is not wired into these MLX builds (text only).
Provenance & reproducibility
Same master as ressl/Ornith-1.5-9B-uncensored-NVFP4: norm-preserving double Gram-Schmidt biprojection on the residual-stream writers (3 biprojection passes), converted with mlx_lm.convert (qwen3_5 / qwen3_5_moe support in mlx-lm 0.31.3).
License & credits
MIT (inherited from Ornith by the Ornith team, credited to ornith-ai). Abliteration, conversion and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with mlx-lm, NVIDIA TensorRT Model Optimizer and SGLang.
Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.