Sakura — MiniCPM-V 4.7 1B, uncensored (GGUF)

For adults only; you are responsible for what you generate and for the laws that apply to you. The language weights of this model were edited to refuse less; it still refuses part of the harmful prompts we tested, and we only tested two harmless images (see below), not what it does with restricted image prompts. Do not use it to depict minors in any sexual or abusive context, or to create sexual or defamatory content about real persons without their consent. Do not put it into a public service without your own moderation.

MiniCPM-V 4.7 1B by OpenBMB (a 1B vision-language model with a Qwen3.5-style hybrid language part) in a version whose language weights were edited by us with an abliteration run so that it refuses less, as GGUF with importance-matrix quantizations. The unmodified model is in Sakura-MiniCPM-V-4.7-1B-GGUF. Independent work, not made or endorsed by OpenBMB.

What was changed

• The language weights were edited with an abliteration method on the original checkpoint openbmb/MiniCPM-V-4.7-1B, with settings chosen by us (the optimisation's own numbers: refusals on its 100 evaluation prompts 60/100 before and 16/100 after, KL divergence 0.0169 of the first-token distributions on 100 harmless evaluation prompts).
• The files are based on the official F16 GGUF with only the edited tensors replaced; all other tensors and the metadata are identical to the official F16 GGUF.
• The vision tower and the projector were not edited. The mmproj files here are unchanged copies of the official ones.
• The importance matrix was computed on the edited F16 file (300 chunks of 512 tokens of our calib_mix_v1 text mix), then the quantizations were made with llama-quantize of llama.cpp b11524.

Files

Run

llama-server -m Sakura-MiniCPM-V-4.7-1B-Uncensored-Q5_K_M-0.70GiB.gguf --jinja -ngl 99 -c 8192

This is text only. The chat template starts in thinking mode by default; our refusal numbers were measured with thinking switched off. To switch it off add --chat-template-kwargs '{"enable_thinking": false}' (our tests used the same switch per request); with thinking on we measured the refusal numbers given below. Image input needs a llama.cpp build that knows the MiniCPM-V 4.7 projector, first available in b11594 (PR 29416, merged on 10 October 2026); add --mmproj mmproj-MiniCPM-V-4.7-1B-F16.gguf. The older b11524 stops with unknown projector type: minicpmv4_7. The chat template of the original is embedded; the model starts with a thinking block.

What we measured

Refusals. The 104 harmful prompts of the test split of mlabonne/harmful_behaviors, plain chat without a system prompt, thinking switched off, temperature 0, 120 tokens, llama-server b11524. These prompts were not used to compute the edit, but they are not held out from the selection: the first 100 of them are the evaluation prompts on which refusals were counted to choose the settings, so the numbers below are probably somewhat better than on unseen prompts. "strict" counts clear refusal phrases in the first 400 characters of the answer (straight and typographic apostrophes), "markers" is a broader keyword list (it also counts answers that only add a warning). The same script and settings were used for every row.

The unmodified model refuses about four fifths of these prompts; the edit lowers that to about a quarter to a third, it does not remove refusals. An answer that is not counted as a refusal has not necessarily followed the request: of 19 such answers that we read (edited F16, Q5_K_M, Q4_K_M), 13 went along with the request (several only in general terms), 2 turned it into something harmless (for example a guide to protecting endangered species instead of trafficking them), 3 gave the opposite of what was asked (tips against identity theft instead of for it), and 1 was meaningless. We did not read all answers. The differences between the quantizations are within what one prompt set of 104 can show by chance, so we do not rank them.

Thinking mode and a system prompt (same 104 prompts and script; "unmodified" is our Q8_0, whose tensors equal the official Q8_0, against the Uncensored Q8_0; temperature 0): with thinking switched on, the default of the chat template (1200 tokens; the answer after the thinking block is counted, not the thinking text), the unmodified model refused 66 / 104 (strict) and 75 / 104 (markers), the uncensored file 6 / 104 and 18 / 104. With the system prompt "You are a helpful, harmless and honest assistant." and thinking off, the unmodified model refused 73 / 104 and 83 / 104, the uncensored file 34 / 104 and 44 / 104. For the uncensored file the system prompt therefore changed little against the 35 / 104 and 40 / 104 without it. An automatic check found no empty answers and no repetition loops in these four runs; we did not read the answers.

Distance to the original (KL divergence of the next-token distribution of the edited F16 against the official F16, llama-perplexity, 16 chunks of 2048 tokens, German de, English en and web web evaluation texts): 0.0074 / 0.0076 / 0.0120, same top token 96.4 / 96.2 / 93.7 %. The perplexity of the reference runs (same tool and settings for both files) moves on de from 6.60 to 6.63, on en from 7.90 to 7.94, on web from 19.52 to 19.70. The standard error of the KLD values is 0.0002.

Quantization loss (KL divergence of each file against the edited F16, same texts and settings):

The largest standard error of these KLD values is 0.0026. As with the unmodified model the 4-bit files lose clearly more than Q5_K_M, so we would take Q5_K_M or larger when memory allows.

Capability (zero-shot MMLU, all 14,042 test questions of cais/mmlu; the model picks among the answer letters A to D by token probability after a plain Answer: prompt, no chat template; llama-server b11524, temperature 0): unmodified Q8_0 50.4 % (95 % interval 49.6 to 51.2), uncensored Q8_0 50.5 % (49.6 to 51.3), unmodified Q4_K_M 49.3 % (48.4 to 50.1), uncensored Q4_K_M 49.6 % (48.8 to 50.4). The paired difference uncensored minus unmodified is +0.07 percentage points (95 % interval -0.20 to +0.34) for Q8_0 and +0.36 (-0.01 to +0.72) for Q4_K_M, so this test shows no loss of this kind of knowledge. Absolute values depend on this prompt format and are not comparable to published MMLU numbers.

Image input (a smoke test only): llama-server b11594 with mmproj-MiniCPM-V-4.7-1B-F16.gguf, CPU, temperature 0, 160 tokens, thinking switched off, Q5_K_M. It read the text SAKURA TEST 4217 from a synthetic image, named a red circle and a blue square, and described a frame of a generated fox video correctly (a red fox in a snowy forest). That is two harmless images; we did not test how the edit affects image prompts, video, OCR quality or the other files.

Not measured: any capability benchmark other than the MMLU test above, video input, image input beyond the two harmless images above, refusals on other prompt sets, other system prompts or in other languages, languages other than the German and English texts above, multi-turn chats, long contexts, speed. The refusal probe says nothing about the quality of the answers beyond the small sample read above.

License

Apache-2.0 as the original model (LICENSE). The language-model files are modified (edited and quantized) versions of the official F16 GGUF; the projector files are unchanged copies. See NOTICE.

Credits

• Model: openbmb/MiniCPM-V-4.7-1B and its official GGUF openbmb/MiniCPM-V-4.7-1B-gguf (OpenBMB).
• Quantization and measurement: ggml-org/llama.cpp (MIT).

---

中文说明 · 樱花 (Simplified Chinese)

English above. 本节为上文的中文翻译(Sakura = 樱花 yīnghuā);完整的独立中文版见 README_zh.md。

Sakura — MiniCPM-V 4.7 1B,去审查版(GGUF)

仅限成年人使用;您需对自己生成的内容以及适用于您的法律负责。本模型的语言权重经过编辑以减少拒绝;它对我们测试的有害提示词仍会拒绝一部分,而且我们只测试了两张无害图像(见下文),没有测试它对受限图像提示词的处理。不要用它来描绘涉及性或虐待情境的未成年人,也不要在未经同意的情况下制作关于真实人物的性相关或诽谤性内容。未经您自己的内容审核,请勿将其放入公共服务。

OpenBMB 的 MiniCPM-V 4.7 1B(1B 视觉语言模型,语言部分为 Qwen3.5 风格的混合结构)的一个版本,其 语言权重由我们通过消融运行编辑过,使其拒绝更少,提供 GGUF 格式及带重要性矩阵的量化。未改动的模型在 Sakura-MiniCPM-V-4.7-1B-GGUF。属于独立工作,并非 OpenBMB 制作或认可。

做了哪些修改

• 我们在原始检查点 openbmb/MiniCPM-V-4.7-1B 上用消融方法编辑了 语言权重,设置由我们选择(优化过程自己的数值:在其 100 条评估提示词上拒绝从 60/100 降到 16/100,在 100 条无害评估提示词上的首词元 KL 散度 0.0169)。
• 文件以官方 F16 GGUF 为基础,只替换了被编辑的张量;其他所有张量和元数据与官方 F16 GGUF 相同。
• 视觉塔和投影器没有被编辑。这里的 mmproj 文件是官方文件的未改动副本。
• 重要性矩阵在编辑后的 F16 文件上计算(我们的 calib_mix_v1 文本混合的 300 个、每个 512 词元的块),然后用 llama.cpp b11524 的 llama-quantize 制作量化文件。

文件

运行

llama-server -m Sakura-MiniCPM-V-4.7-1B-Uncensored-Q5_K_M-0.70GiB.gguf --jinja -ngl 99 -c 8192

这是仅文本命令。聊天模板默认以思考模式开始;我们的拒绝数值是在关闭思考的情况下测得的。要关闭思考,请加上 --chat-template-kwargs '{"enable_thinking": false}'(我们的测试中按请求使用了同一开关);开启思考时的拒绝数值见下文。图像输入需要认识 MiniCPM-V 4.7 投影器的 llama.cpp 版本,最早为 b11594(PR 29416,2026 年 10 月 10 日合并);请加上 --mmproj mmproj-MiniCPM-V-4.7-1B-F16.gguf。较旧的 b11524 会以 unknown projector type: minicpmv4_7 停止。原模型的聊天模板已嵌入;模型会以思考块开始。

我们测量了什么

拒绝。 mlabonne/harmful_behaviors 测试划分中的 104 条有害提示词,纯聊天、无系统提示词,关闭思考,温度 0;120 个词元,b11524 的 llama-server。这些提示词没有用于计算编辑,但 并非独立于设置选择:其中前 100 条正是选择设置时用来统计拒绝次数的评估提示词,因此下面的数值很可能比在未见过的提示词上略好。“strict”统计回答前 400 个字符中明确的拒绝措辞(直撇号和弯撇号都计入),“markers”是更宽泛的关键词列表(只加了警告的回答也会被计入)。每一行使用相同的脚本和设置。

未改动的模型会拒绝这些提示词中的约五分之四;编辑把这一比例降到约四分之一到三分之一,并没有消除拒绝。未被计为拒绝的回答并不一定遵循了请求:在我们阅读的 19 条此类回答(编辑后的 F16、Q5_K_M、Q4_K_M)中,13 条照做了请求(其中几条只是泛泛而谈),2 条把请求改成了无害的内容(例如写成保护濒危物种的指南,而不是贩运指南),3 条给出了与请求相反的内容(防范身份盗窃的建议,而不是实施的方法),1 条没有意义。我们没有读完所有回答。各量化之间的差异在 104 条提示词的一个集合可能偶然出现的范围之内,所以我们不对它们排序。

思考模式与系统提示词(同样的 104 条提示词和脚本;“未改动”指我们的 Q8_0,其张量与官方 Q8_0 相同,对比去审查版 Q8_0;温度 0):开启思考(聊天模板的默认模式;1200 个词元;统计的是思考块之后的回答,不是思考文本)时,未改动的模型拒绝了 66 / 104(strict)和 75 / 104(markers),去审查文件为 6 / 104 和 18 / 104。使用系统提示词“You are a helpful, harmless and honest assistant.”并关闭思考时,未改动的模型拒绝了 73 / 104 和 83 / 104,去审查文件为 34 / 104 和 44 / 104。因此对去审查文件而言,系统提示词与没有系统提示词时的 35 / 104 和 40 / 104 相比变化不大。自动检查在这四次运行中没有发现空回答和重复循环;我们没有阅读这些回答。

与原版的距离(编辑后的 F16 相对于官方 F16 在下一个词元分布上的 KL 散度,llama-perplexity,16 个、每个 2048 词元的块,德文 de、英文 en 和网页 web 评估文本):0.0074 / 0.0076 / 0.0120,相同首选词元 96.4 / 96.2 / 93.7 %。参考运行(两个文件使用相同的工具和设置)的困惑度在 de 上从 6.60 变为 6.63,en 上从 7.90 变为 7.94,web 上从 19.52 变为 19.70。KLD 值的标准误差为 0.0002。

量化损失(每个文件相对于编辑后的 F16 的 KL 散度,相同文本和设置):

这些 KLD 值的最大标准误差为 0.0026。与未改动的模型一样,4 比特文件的损失明显大于 Q5_K_M,因此在内存允许时我们会选 Q5_K_M 或更大的文件。

能力(零样本 MMLU,cais/mmlu 的全部 14,042 道测试题;模型在简单的 Answer: 提示词之后按词元概率在答案字母 A 到 D 之间选择,不使用聊天模板;b11524 的 llama-server,温度 0):未改动的 Q8_0 为 50.4 %(95 % 区间 49.6 到 51.2),去审查的 Q8_0 为 50.5 %(49.6 到 51.3),未改动的 Q4_K_M 为 49.3 %(48.4 到 50.1),去审查的 Q4_K_M 为 49.6 %(48.8 到 50.4)。去审查版减去未改动版的配对差,Q8_0 为 +0.07 个百分点(95 % 区间 -0.20 到 +0.34),Q4_K_M 为 +0.36(-0.01 到 +0.72),因此该测试没有显示这类知识的损失。绝对数值取决于这种提示词格式,不能与已发布的 MMLU 数字比较。

图像输入(仅为冒烟测试):b11594 的 llama-server,使用 mmproj-MiniCPM-V-4.7-1B-F16.gguf,CPU,温度 0;160 个词元,关闭思考,Q5_K_M。它从一张合成图中读出了文字 SAKURA TEST 4217,说出了红色圆形和蓝色方形,并正确描述了生成的狐狸视频中的一帧(雪林中的一只红狐狸)。这是两张无害图像;我们没有测试编辑对图像提示词的影响,也没有测试视频、OCR 质量或其他文件。

没有测量: 除上述 MMLU 之外的任何能力基准测试、视频输入、上述两张无害图像之外的图像输入、在其他提示词集、其他系统提示词或其他语言下的拒绝情况、上述德文和英文文本之外的语言、多轮对话、长上下文、速度。拒绝测试除了上面读过的小样本之外,并不说明回答的质量。

许可

与原模型相同,为 Apache-2.0(LICENSE)。语言模型文件是官方 F16 GGUF 的修改(编辑并量化)版本;投影器文件是未改动的副本。见 NOTICE。

致谢

• 模型:openbmb/MiniCPM-V-4.7-1B 及其官方 GGUF openbmb/MiniCPM-V-4.7-1B-gguf(OpenBMB)。
• 量化与测量:ggml-org/llama.cpp(MIT)。