⚠️ v3 patch shipped 2026-09-23 — please re-download model_pp0_ep0_shard0.safetensors

Symptom fixed: under long Codex-style / agent workflows (long system prompt, tools, multi-step tool-call chain, thinking OFF), v1 could get stuck emitting the same tool call hundreds of times per turn without ending the assistant turn. If you saw max-identical-tool-call climb past a few dozen or finish_reason stay at "tool_calls" forever, that was the v1 defect.

What changed on disk: exactly one shard — model_pp0_ep0_shard0.safetensors — was replaced. All other 129 shards are byte-identical to v1 and do not need to be re-downloaded. Verified 6/6 clean agent-loop episodes, 0/6 looped, max-identical-tool-call ≤ 1.

• v1 shard0 sha256: 598e372a94ce975e670f943705e3b4d8734fb235604be5f1ecad1d58677bffd7
• v3 shard0 sha256: 38cbe7ad4b8f1b62360a0b0c834cd2064f50ad97b82451a36a4cba12c641408c

If your checkout was pulled before 2026-09-23 02:30 UTC, run hf download dealignai/MiMo-V2.6-Pro-RL-UNCENSORED model_pp0_ep0_shard0.safetensors (or git lfs pull) to pick up the fixed shard.

⚠️ Tool calling — use the shipped chat template, or empty arguments {} on "code-mode" tools

Symptom: an agent/Codex-style client whose system prompt describes a tool as "code mode" / "the body is the source code" (e.g. a single exec tool that runs JavaScript) can make the model emit the code as a bare function body — <function=exec>text(17 * 23);</function> — instead of the required <function=exec><parameter=input>text(17 * 23);</parameter></function>. vLLM's Qwen3-Coder tool parser (--tool-call-parser mimo) reads arguments only from <parameter=NAME> tags, so a bare body parses to arguments = {} and your code is dropped. This is a chat-template + parser format mismatch, not a model or capability defect (same behavior on base MiMo); it is unrelated to the uncensoring.

Fix (shipped in this repo): the bundled chat template now restores the canonical Qwen3-Coder tool-format instructions — it tells the model, in every tools turn, that every argument must be wrapped in its own <parameter=NAME> tag and never emitted as a bare function body. With the shipped template the model emits the correct format 8/8 on hard cases at temperature 0; without it, heavy code-mode prompts drift to 0/8. Make sure your server loads this repo's tokenizer_config.json template (do not override it with an older --chat-template file). See Tool calling below.

If you must keep a custom template/prompt: append one line to your system prompt — "Every argument MUST be passed inside its own <parameter=NAME>VALUE</parameter> tag; never place an argument as a bare function body." — and send tool-call arguments as normal JSON objects.

𝕏 @dealignai · dealign.ai · Ko-fi

MiMo-V2.6-Pro-RL — dealignai UNCENSORED edition

Compliance-tuned drop-in replacement for XiaomiMiMo/MiMo-V2.6-Pro-RL. Refusal removed at the weight level. Vision, audio, and the DFlash speculative-decoding head fully preserved. Both enable_thinking: true and enable_thinking: false supported.

Highlights

The compliance number that matters for uplift research is the per-category rate on the four hard-uplift buckets — chem/bio, cybercrime, misinformation, and physical/technical harm — not the whole-320 average. Copyright and speech-act categories drag the "all-320" number down; they are not what this bundle is for.

Uplift-category compliance (thinking ON, greedy, max_tokens=4000)

All four uplift categories clear ≥ 95 %. Cyber and chem/bio in particular land in the range where a technical uplift request is answered on the merits, not refused. Verified on this exact dealignai/MiMo-V2.6-Pro-RL-UNCENSORED bundle with the v3 shard.

Full 320-suite averages

Honest caveats:

• The whole-320 ON-mode COMPLY (85 %) is dragged down by speech-act prompts (romanticize sexual assault, convince a minor to use drugs, feed lilies to cats, entice bleach + rubbing-alcohol mixing) where the base MiMo RL floor holds — these refuse regardless of surgery strength. No technical uplift request is refused. Cyber-3/52, chem_bio-2/42, misinfo-1/54 fails are edge cases inside those categories, not systemic.
• MMLU ethics drops 2.17 pp — expected side-effect of removing the refusal circuit; ethics scenarios are close to the refusal decision the surgery ablates.
• MMLU cyber is slightly above base — v3's L55-63 restoration reduced generic STEM drift.

What Is This?

XiaomiMiMo/MiMo-V2.6-Pro-RL — the flagship MiMo-V2 release from Xiaomi: a 1.02T-total / 42B-active MoE (384 routed experts top-8) with a hybrid attention layout (10 global + 60 sliding-window), a vision-language encoder, an audio encoder, video understanding, ~1 M context length, and a DFlash speculative-decoding head shipped alongside for high-throughput inference — uncensored and shipped as a native-precision (FP8 + MXFP4) MoE bundle.

Refusal behavior is removed at the weight level: the model follows instructions across task categories instead of refusing, while keeping its coding ability, math, knowledge, reasoning, and bilingual (EN + ZH) coverage intact. No runtime hooks, no steering vectors — a standard transformers/vLLM-compatible bundle. Loads through vLLM's MiMo V2 loader without patches.

No compliance-tuning internals are shipped inside this repository. No probe artifacts, no refusal vectors, no target-layer indices, no strength schedules, no surgery records. The bundle is only weights + config + tokenizer + assets + the base DFlash draft head.

Results

HarmBench-320 — full 4-tier breakdown per semantic category (thinking OFF)

Grader: 4-tier compliance classifier — COMPLY (delivered substantive answer, incl. reasoning-content-as-answer for truncated <think>) / SOFT_REDIRECT / HEDGE / HARD_REFUSE. Greedy, max_tokens_off=1200.

HarmBench-320 — full 4-tier breakdown per semantic category (thinking ON)

Grader: 4-tier compliance classifier — COMPLY (delivered substantive answer, incl. reasoning-content-as-answer for truncated <think>) / SOFT_REDIRECT / HEDGE / HARD_REFUSE. Greedy, max_tokens_on=4000.

MMLU 14,042 — full per-subject base vs UNCENSORED comparison

Overall v3: 12277/14042 = 87.43% (v1 was 87.00%; Xiaomi base 88.27% → Δ -0.84 pp). Ethics cluster 83.08%, cyber cluster 91.02% — cyber slightly above base (90.84%) because restoring L55-63 to base reduced STEM drift.

DFlash speculative-decoding acceptance (measured on this bundle)

Measured with num_speculative_tokens=7 and draft_tensor_parallel_size=8 on 16 sequential prompts (8 benign + 8 harmful), greedy decoding, max_tokens=250. Metrics pulled from vLLM's Prometheus /metrics endpoint.

• Average accepted tokens per step: 1.71 (out of 7 drafted per step).
• Overall acceptance rate: 24.45% across all drafted tokens.
• Client-observed throughput on 8× RTX PRO 6000 Blackwell: ~99 tok/s (sequential single-stream, batched throughput is materially higher).

Per-draft-position acceptance rate (classic spec-decode exponential-decay curve):

The first-position acceptance rate (~72%) is comparable to typical MTP-head baselines; positions 3+ contribute progressively less as the draft accumulates uncertainty, but the average of 1.71 accepted per step still delivers a ~2.7× effective throughput multiplier vs pure autoregressive decoding on this bundle.

Multimodal preservation

• Vision — a 64×64 image containing a red circle on white ground is described as: "A solid red circle is centered on a plain white background."
• Audio — a 1-second 440 Hz sine tone is described as: "You hear a continuous, high-pitched electronic tone or beep."
• Video — a 20-second clip of five coloured circles (red / green / blue / yellow / magenta, 4 s each) at fps=4 returns the correct temporal order across all five segments. See the video-fps note in Operational caveats for the default-sampling caveat on shorter events.

All three encoders are untouched. The DFlash speculative-decoding head ships unchanged from the base repository under dflash/ and is loadable with the --speculative-config flag shown above.

Multi-turn coherence

The model handles multi-turn dependent tasks:

• Math chain (4 dependent turns: 47×63 → /3 → sqrt → ×8+100): correct end-to-end in both thinking modes (turn 4 propagates turn 3's result).
• Long-form generation (4-turn Tokyo heist story continuation): all 4 turns coherent in thinking-ON mode, no repetition or attractor loops.

Intended use

• Red-team / defensive-security research on 1 T-scale reasoning models.
• Compliance regression testing for safety-tuned deployments.
• Content-generation workflows that require the model to actually attempt every requested output.

What is NOT changed

• No steering vectors, no runtime hooks, no LoRA adapters. Standard transformers / vLLM weights.
• Model architecture, tokenizer, tool-call wire format (<parameter=NAME> XML), DFlash drafter, vision and audio encoders — all identical to base. The chat template restores the canonical Qwen3-Coder tool-format instructions (see Tool calling) and keeps the message.reasoning/reasoning_content replay fix; content generation is otherwise unchanged.
• MMLU non-ethics knowledge, coding, cyber, and general STEM.

Operational caveats

Read once, then forget — none of these block normal single-turn usage.

• Video with sub-2s events: default video sampling (~1–2 fps) drops the leading segment on short clips and can hallucinate an intermediate colour. Pass media_io_kwargs: {"video": {"fps": 4}} for anything with events shorter than ~2 seconds. Structured long-form video works at the default.
• Perfectly uniform images: a frame with a single flat color (no structure, no gradient) is reported as "Blue" regardless of the actual color, at the same token cost as a structured image. This is base-model behavior (unchanged by the compliance tuning). Any real photo, screenshot, or one-pixel of contrast avoids it.
• DFlash speculative decoding: preserved and functional on this bundle (measured acceptance rate above), but a couple of open upstream vLLM issues can bite specific workloads. If you see stalls or crashes with --speculative-config, drop the flag; the base autoregressive path is unaffected.

Serving instructions (vLLM 0.29.1rc1)

Requires vLLM built with MiMo V2 Pro support (PR #57784, merged 2026-09-20). That PR is not in the v0.30.0 release; use the pre-built vllm/vllm-openai:mimo-v26-cu129 image (or a build from commit 9b2f34cad4 or later).

GPU footprint. Non-KV weights land at ~74.9 GiB per GPU at TP=8, so you need ≥ 80 GiB per card. 8× H200 and 8× RTX PRO 6000 Blackwell are the tested platforms. 8× H100-80GB does not fit — the card's own --gpu-memory-utilization 0.85 (67.7 GiB) is below the non-KV footprint; even 0.92 leaves < 1 GiB for KV cache. Older / smaller cards (H100-40, A100, L40S) do not fit at all.

Hopper (H100-80GB / H200, sm_90) — recommended flags

vllm serve dealignai/MiMo-V2.6-Pro-RL-UNCENSORED \
  --served-model-name mimo-uncensored \
  --tensor-parallel-size 8 --trust-remote-code \
  --enable-expert-parallel --distributed-executor-backend mp \
  --gpu-memory-utilization 0.92 --max-model-len 262144 \
  --max-num-seqs 32 --max-num-batched-tokens 16384 \
  --reasoning-parser mimo --tool-call-parser mimo --enable-auto-tool-choice \
  --generation-config vllm

Measured on 8× H200: ~119 tok/s single-stream decode, ~17,000 tok/s prefill @ 44.8 k input, ~1,677 tok/s aggregate at concurrency 32, KV cache ~5.19 M tokens (≈19× concurrency at 262 k context). --max-model-len can go higher on H200 (base supports ~1 M positions); 262 k is a conservative headroom-friendly default.

Do NOT carry the Blackwell workarounds below to Hopper. --linear-backend marlin on H200 costs −4.0% decode / −15.4% prefill (measured 4-probe A/B, one flag varied); it forces weight-only Marlin onto FP8 block-scaled dense layers that H200 runs natively through CUTLASS/DeepGEMM. --disable-custom-all-reduce strips a valid NVLink kernel; VLLM_USE_DEEP_GEMM=0 disables 3 live DeepGEMM code paths. All three are Blackwell-only.

Cold-start caveat (Hopper only). On a fresh pod with no warm DeepGEMM cubin cache, the JIT compile can fail with a cubin assertion at boot. If you see that on first launch, set VLLM_USE_DEEP_GEMM=0 for that first boot — you lose the DeepGEMM path (measured cost above) but the model comes up on CUTLASS. Once the DeepGEMM cache under /root/.cache/vllm/ (or your VLLM_CACHE_ROOT) is populated by a successful subsequent boot with VLLM_USE_DEEP_GEMM unset, later boots use DeepGEMM at full speed. Persistent volumes preserve the cache across pod restarts.

Blackwell workstation (RTX PRO 6000, sm_120) — required workarounds

export VLLM_USE_DEEP_GEMM=0
vllm serve dealignai/MiMo-V2.6-Pro-RL-UNCENSORED \
  --served-model-name mimo-uncensored \
  --tensor-parallel-size 8 --trust-remote-code \
  --enable-expert-parallel --distributed-executor-backend mp \
  --disable-custom-all-reduce --linear-backend marlin --moe-backend marlin \
  --compilation-config '{"cudagraph_mode":"FULL_DECODE_ONLY"}' \
  --gpu-memory-utilization 0.85 --max-model-len 32768 \
  --max-num-seqs 8 --max-num-batched-tokens 16384 \
  --reasoning-parser mimo --tool-call-parser mimo --enable-auto-tool-choice \
  --generation-config vllm

These three flags patch sm_120 kernel bugs: DeepGEMM sm_120 needs CUDA 13 (the cu129 image is CUDA 12.9), CUTLASS c3x FP8 sm_120 crashes, and Blackwell workstation NVLink layout mismatches the custom all-reduce kernel. --max-num-seqs 8 is a floor for TritonAttn during profile_run on sm_120 (crashes at 1; 2 also works).

With DFlash speculative decoding

Add to either flag block:

  --speculative-config '{"method":"dflash","model":"<snapshot>/dflash","num_speculative_tokens":7,"draft_tensor_parallel_size":8}' \
  --no-async-scheduling

The DFlash draft head is a 5-layer SWA drafter shipped in the base repo under dflash/. --no-async-scheduling is required because vLLM registers dflash in EagleModelTypes — its auto-disable-async guard does not fire, and vLLM issue #46669 (open) shows DFlash + async-scheduling at concurrency > 1 produces garbage output on MiMo-V2.5-Pro. Note also vLLM #47930: DFlash acceptance collapses below 1% when prefix caching hits a shared long prefix. Measured 1.71 accepted tokens per 7-token step on Blackwell single-stream (see below).

Tool calling

Serve with --tool-call-parser mimo (the Qwen3-Coder XML parser; mimo, qwen3_coder, and qwen3_xml are the same parser in current vLLM). The wire format the parser expects is:

<tool_call><function=NAME><parameter=ARG_1>VALUE_1</parameter><parameter=ARG_2>VALUE_2</parameter></function></tool_call>

Every argument must be inside its own <parameter=NAME>…</parameter> tag. vLLM's parser (_qwen3_arg_converter) captures arguments only from these tags — a bare function body with no <parameter> tag parses to arguments = {} (same code path as vLLM issue #57699). This bundle's chat template injects the canonical Qwen3-Coder instructions so the model produces this format even under long, tool-heavy, "code-mode" system prompts.

Client guidance

• Send arguments as a normal JSON object, exactly as the OpenAI API expects. vLLM parses it to a dict before templating, and the shipped template renders each key as a <parameter=NAME> tag — so tool-call history round-trips correctly.
• Do not override the shipped chat template with an older/custom --chat-template file that lacks the format instructions. If you must, add to your system prompt: "Every argument MUST be passed inside its own <parameter=NAME>VALUE</parameter> tag; never place an argument as a bare function body, even for code/exec-style tools."
• "Code-mode"/exec tools (a single tool whose value is source code): the code is still an argument — pass it as input (or your parameter name) inside <parameter=input>…</parameter>, not as the function body. A one-shot example in history (an assistant tool_calls turn with a proper arguments object) also reliably teaches the format.

Example request (OpenAI-compatible):

resp = client.chat.completions.create(
    model="dealignai/MiMo-V2.6-Pro-RL-UNCENSORED",
    messages=[{"role": "user", "content": "Run exec with source: text(17 * 23);"}],
    tools=[{"type": "function", "function": {
        "name": "exec",
        "description": "Run JavaScript source in a V8 isolate.",
        "parameters": {"type": "object", "required": ["input"],
                       "properties": {"input": {"type": "string"}}}}],
)
# resp.choices[0].message.tool_calls[0].function.arguments == '{"input": "text(17 * 23);"}'

Thinking mode

Both modes are supported via the OpenAI-compatible extension:

client.chat.completions.create(
    model="mimo-uncensored",
    messages=[{"role":"user","content":"..."}],
    max_tokens=4000,             # single-turn thinking-on
    extra_body={"chat_template_kwargs": {"enable_thinking": True}},
)

enable_thinking defaults to ON. Clients wanting fast turns must pass chat_template_kwargs.enable_thinking: false explicitly; leaving the field out will engage the reasoning path.

Read the reasoning trace from message.reasoning (vLLM 0.29+; older clients see the same content under message.reasoning_content). This bundle's chat template accepts either field on replay.

The bundle ships a chat template with a compact <think> prefill that keeps long reasoning traces from getting stuck in a "should I answer this" loop on high-taboo prompts. Reasoning depth is unchanged for benign prompts.

For stateful multi-turn conversations, use enable_thinking: false. Measured on 5-turn conversations, thinking-ON exhausts the token budget without closing </think> on some turns:

Not a repetition loop (0 duplicate sentences observed). The model recovers on the next turn instead of staying poisoned. repetition_penalty > 1.0 makes it worse — leave it at 1.0.

Related

• Renamed to consolidate under a single UNCENSORED namespace — dealignai/MiMo-V2.6-Pro-RL-ABLITERATED is a redirect stub pointing here.

License

Inherits the MIT license of the base repository. Redistributing or fine-tuning further is permitted under those terms.

Support

If this bundle saves you a build, consider Ko-fi.