DeepSeek-V4.1-Flash-1017-obliterated

DeepSeek-V4.1-Flash-1017-obliterated is a refusal-direction ablated version of DeepSeek-V4.1-Flash-1017, produced with OBLITERATUS using the failspy method. The weights are BF16 safetensors, released under the MIT license. Method details.

Tournament results

DeepSeek-V4.1-Flash-1017-obliterated refused 2 of 50 evaluation prompts and passed 6 of 6 capability checks. KL is sequence-token forward KL against the original model. Evaluation results.

Refusal and harmful-assistance evaluation

The OBLITERATUS corpus contains 842 prompts. Both models produced completed answers for 838; four prompts with incomplete responses from DeepSeek-V4.1-Flash-1017-obliterated are excluded from this comparison.

Responses were classified for refusal, harmful assistance, harmfulness, actionability and response type. Valid annotations cover 837 responses from DeepSeek-V4.1-Flash-1017 and 813 from DeepSeek-V4.1-Flash-1017-obliterated. The remaining 1 and 25 responses are shown as unresolved in every distribution.

Percentages use all 838 prompts. Deltas are DeepSeek-V4.1-Flash-1017-obliterated minus DeepSeek-V4.1-Flash-1017, in percentage points.

Refusal

A full refusal declines the requested assistance without materially providing it. A partial refusal declines part of the request while substantively answering another part.

Harmful assistance

Of the 656 non-refusals from DeepSeek-V4.1-Flash-1017-obliterated, 563 were classified as harmful assistance and 93 were not. Non-refusal and harmful assistance are separate labels.

Response type

Harmfulness and actionability distributions

Harmfulness measures the potential harm facilitated by the response.

Actionability measures the practical specificity of harmful assistance.

Evaluation protocol and annotation coverage

Judges classified existing responses without answering the prompts or expanding the responses. The annotation models were Claude Opus 4.6 and GPT-6.1 Sol; three additional annotations came from a local Codex review. Scores describe the visible text; the evaluation did not execute or verify the supplied instructions.

The comparison includes 808 pairs evaluated by the same judge. Five further pairs have valid annotations from different judges. For the remaining records, valid annotations are selected by a fixed priority: Sol reassessment, Opus, Sol, then local Codex. Selection does not depend on the score. Twenty-five responses remain unannotated after provider or platform review blocks; one annotation is ambiguous. There are no valid annotations in the unclear-refusal, unclear-assistance, irrelevant, empty or incoherent categories.

Of the 838 prompts, 254 appeared in the intervention calibration set, 50 in method selection, and 534 in neither. These corpus results are separate from the held-out MMLU evaluation below. Later diagnostic retries of the four incomplete responses are excluded.

Evaluation date: 30 October 2026.

MMLU

DeepSeek-V4.1-Flash-1017 and DeepSeek-V4.1-Flash-1017-obliterated were evaluated on the same 2,500 questions across all 57 subjects, held out from method selection. Each subject contributes 43 or 44 questions, selected by a fixed hash ordering.

Protocol: zero-shot chat, thinking disabled, answer-choice logits, one question per forward pass.

DeepSeek-V4.1-Flash-1017-obliterated scored +0.12 percentage points relative to DeepSeek-V4.1-Flash-1017: 20 questions changed from incorrect to correct and 17 from correct to incorrect. Exact two-sided McNemar p=0.742829.

Per-subject results

Full results · Subject scores (CSV) · Per-question records.