DeepSeek-V4.1-1017-Ablitrated-testmodel

A weight-edited (abliterated) derivative of deepseek-ai/DeepSeek-V4.1-Flash-1017, published as an experimental TEST artifact.

⚠️ Read this first

• This is not an official DeepSeek model, and it is not a finished product.
• No serving evaluation of this build exists. It has not been measured for refusal rate, capability, thinking-mode stability, or anything else. There are no benchmark numbers in this card, and none should be inferred.
• Only weight-level edits were applied: no fine-tuning, no SFT, no LoRA, no inference-time hooks or steering. Nothing was added to the architecture.
• Being "abliterated" means refusal directions were projected out of a small set of weight matrices. The published evidence for this family of edits is that they remove the refusal switch and do not make the model reliably comply with the request (see "Known limitations" below). Do not treat this as a jailbreak or as a safety-bypass product.
• Output looping / non-termination is a known, expected failure mode. Under thinking mode this model family degenerates into repetitive traces or runs away without ever answering, and abliterated builds of this family measurably repeat more than the base. Read "Known issue: repetitive / non-terminating output" below before you serve it.
• Provided as is, with no warranty of any kind. You are responsible for how you use it.

What was changed

The editable unit was chosen per-layer, in the model's own basis. Two "writers" (weight matrices that sit on the residual-output path) received a rank-1 projection removal of a measured refusal direction, plus the output head.

• Operator: projection-remove (rank-1 removal, applied in FP8 storage domain and re-quantized to the checkpoint's native FP8/UE8M0 format).
• Spec name: v7_abl_t20h1 (the earlier two-pass recipe "t20 then head dose 1.0" folded into a single bake).
• The head edit at dose 1.0 is the shipped variant; the layer edits use dose 5.0.

Deliberately NOT changed

ffn.experts.* (routed experts), engram.*, vision.*, aligner.*, mtp.*, attn.wq_*, attn.wkv*, attn.wo_a*, ffn.gate.*, hc_*, *norm*, embed.weight.

Rationale: the routed experts and engram/vision/MTP paths are either FP4-stored or structurally entangled, and the campaign that produced this build found that edits of those planes did not survive re-quantization or produced degenerate output. The router/gates and norms were excluded to keep routing statistics intact.

EOS orthogonalization: measured, not applied

eos_orth was evaluated and is a no-op for this model + direction: |cos(u, head.weight[eos=1])| averaged 0.013 (max 0.098) over the 40 layers. The effect reported on other models (+0.12…+0.17) does not transfer here. Recorded for reproducibility; no change was made.

Verification actually performed on this build

Byte-level and tensor-level checks run on the exact files in this repo:

Not verified / not run: model loading, generation, refusal rate, capability retention, thinking-mode behavior, multimodal paths. No quality claim of any kind is made.

Known issue: repetitive / non-terminating output ("looping")

This is the single most likely way this model will fail in practice, so it gets its own section. Two separate effects are involved, and only one of them comes from the abliteration.

1. Inherited from the base model: thinking never terminates

Measured on the base model (same tokenizer, thinking mode, 24-prompt suite):

• With a small output budget the failure looks like a periodic loop (the tail repeats until the budget is cut).
• With a larger budget the loop stops looking periodic and the trace instead runs away to roughly 58k–80k characters without ever emitting an answer.
• Raising the budget removes the loop but leaves the empty answers in place, so it is not a fix.
• repetition_penalty = 1.1 was measured and was ineffective.
• During runaway, output was observed collapsing into Chinese. On the English benchmark suite this did not reproduce (CJK ratio 0.00), so treat it as a mode/context-dependent risk rather than a benchmarked one.

The base checkpoint carries this; the weight edits here neither introduce nor remove it.

2. Amplified by abliteration: degenerate repetition in thinking traces

A windowed recurrence instrument (500-char windows; a trace is flagged when it enters a run of ≥3 near-identical windows) was run over thinking traces of this family:

• On the same instrument, synthetic repetitive text scores 1.000 and normal advancing text 0.000, so the separation is real.
• The longest flagged repetitive run was 54,500 characters; long answer channels were flagged 4/5 in validation.
• Removing a refusal direction is a global change to the residual stream, and the thinking-mode trajectory is the most sensitive part of it. Any abliterated build of this model should be assumed to repeat more than base until you measure otherwise.

3. Status for this build

The v7 build has not been measured with either instrument. At publication time the recurrence instrument reported v7 files absent, and no serve-mode run of these weights exists. The numbers above are from the base model and from other variants of this family. Assume v7 loops at least as often as the variants above, and verify before use.

Practical handling

• Prefer thinking off when you need reliable termination (0 loops / 0 empties out of 24 in the base measurement).
• Always set a hard max_tokens; a runaway trace can consume tens of thousands of characters.
• Add an output-side watchdog (repeated n-gram or window-similarity stop) instead of raising the budget.
• Treat an empty content with a very long reasoning field as the failure signature, not as a "the model is still thinking" state.

Known limitations (beyond the looping issue above)

Reported on this model family, not re-measured here:

• Rank-1 weight edits reliably lower the refusal rate but the delivery of the requested content plateaus well below 100% — safe-completion / task-substitution behavior remains.
• Under Thinking Max operation the refusal does not disappear via weight-only linear removal, and aggressive doses can produce empty or degenerate output. Expect mode-dependent behavior.
• Removing a refusal direction is a global change to the residual stream: unrelated behaviors can shift. No capability guard was run on this build.
• The publishing campaign's own progression instrument (a stagnation metric) had no v7 measurement at publication time; the v7 build is therefore explicitly unevaluated.

Model details (inherited from base, unchanged)

• Architecture: DeepseekV41ForCausalLM — multimodal MoE, 40 layers + MTP 3 (num_nextn_predict_layers=3).
• Hidden size 5120, vocab 129,280, 384 routed experts (top-6) + 1 shared expert, MoE intermediate 2304.
• Attention: DSA / sparse attention path with index tensors; Hyper-Connections (hc_*, 4 streams); Engram n-gram embedding tables on layers engram_layer_ids.
• Context: up to 1,048,576 positions.
• Vision tower: 32 layers, hidden 1024, patch 14.
• Storage format: FP8 E4M3 weights with UE8M0 block scales, block size 32×32; routed experts stored as FP4 (quantization_config.expert_dtype = "fp4"). dtype field is bfloat16; head.weight and norms are unquantized.

Size / files

• 48 safetensors shards, 510,296,708,312 bytes ≈ 475.3 GiB total.
• Largest shard: 101.5 GB (model-00048-of-00048.safetensors); shards 47–48 hold the Engram embedding tables.
• Also included: config.json, model.safetensors.index.json, tokenizer/encoding assets (tokenizer.json, tokenizer_config.json, encoding/, vocab-style assets), inference/ reference code, LICENSE, and abliteration/ (the exact bake spec + manifest used).

How to use

This is a one-to-one weight replacement of the base checkpoint: load it with whatever stack you already use for deepseek-ai/DeepSeek-V4.1-Flash-1017 (transformers, vLLM, SGLang, or the bundled inference/ reference implementation). No flag or patch is needed — the format is identical to base.

Practical notes:

• ~475 GiB of weights: multi-GPU / multi-node is required. Plan tensor-parallel or expert-parallel sizing accordingly, and leave room for a large KV cache at long context.
• Keep the base model's quantization settings (--quantization fp8, expert FP4 path) exactly as you would for base. Re-quantizing these weights to another format will invalidate the edits' calibration.
• MTP 3 and the Engram tables are intact, so speculative decoding paths remain available if your stack supports them.

from transformers import AutoModelForCausalLM, AutoTokenizer

repo = "Hikari07jp/DeepSeek-V4.1-1017-Ablitrated-testmodel"
tok = AutoTokenizer.from_pretrained(repo, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(repo, device_map="auto", trust_remote_code=True)

Provenance

License and attribution

• Base model and this derivative are distributed under the MIT License; the original LICENSE file (Copyright (c) 2023 DeepSeek) is retained unchanged in this repository as required by the license terms.
• The weight modifications described above were produced by Hikari07jp and are likewise released under the MIT License.
• This repository is an independent derivative. It is not endorsed by, affiliated with, or reviewed by DeepSeek. Any behavior of this model is the result of the modification, not of the base release — but conversely, defects in the base model remain the base model's.
• Upstream model card and technical report: https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash-1017

Intended use / prohibited use

Intended use: research and testing of weight-level refusal-direction removal — reproducing the edit, comparing base vs. edited behavior, and validating serving stacks. That is the entire purpose of this release.

Do not use this model as a safety filter, as a compliance tool, or as a source of authoritative information. Do not deploy it to end users without your own evaluation and your own safety mitigations. You are responsible for compliance with applicable law and with the upstream license.