DeepSeek-V4.1-Flash Abliterated (scale 3.0)

Responsible use

This is an uncensored research model. Its built-in refusals were removed permanently at the weight level, so it answers prompts the base model declines, including chemical and biological synthesis, cybercrime, weapons, harassment, and fraud. Use it for red-teaming, offensive-security research, and refusal-rate evaluation. It has no guardrails of its own: if you deploy it, add your own input and output moderation (for example Llama Guard).

What this is

Abliterated variant of deepseek-ai/DeepSeek-V4.1-Flash (552B backbone / 8-16B active, multimodal MoE). The refusal direction was removed with norm-preserving biprojected abliteration (grimjim 2025), a weight-space refinement of directional ablation (Arditi et al. 2024), applied to the attention output projection (attn.wo_b) and the shared-expert down projection (ffn.shared_experts.w2).

The repo mirrors the upstream checkpoint (same 48-shard FP8/FP4 layout, same tokenizer). Only the abliterated tensors differ; everything else is byte-identical to upstream. refusal_directions.pt holds the measured per-layer directions, so you can re-ablate at any scale in seconds without re-measuring. abliteration_config.json records the final parameters and evaluation results.

Load

The deepseek_v41 architecture is not yet in transformers/vLLM mainline (as of Sep 2026); use DeepSeek's reference runtime with its convert.py:

# convert to the TP-sharded runtime format (fp8 experts, lossless from fp4)
python convert.py --hf-ckpt-path ./DeepSeek-V4.1-Flash-abliterated \
  --save-path abl-tp8 --model-parallel 8 --expert-dtype fp8
torchrun --nproc-per-node 8 inference/generate.py \
  --ckpt-path abl-tp8 --config config.json --interactive

SGLang also serves this checkpoint today; see the Serving section.

Evaluation (scale 3.0)

The standard abliteration-community protocol (the one Heretic made automatic): 100 held-out harmful prompts (mlabonne/harmful_behaviors test split) with unicode/emphasis-normalized keyword detection plus an LLM judge (the base model classifying its own responses), KL divergence vs base on 100 harmless prompts (mlabonne/harmless_alpaca), a GSM8K spot check, and a cross-modal image test. Eval mode: chat, greedy, TP8 on H200 (fp8 experts).

The keyword metric over-counts at scale 3.0: most of the 41 flagged items are answers with a brief disclaimer, and the detector fires on words like illegal, harmful, and disclaimer. The honest number is the judge's 1/100 true refusals. KL 0.142 sits at the measurement noise floor (0.131, measured by an identity requant round-trip), so the distribution shift on benign inputs is effectively zero. GSM8K 16/20 is within run-to-run noise of the base (14 to 17 across repeats), so there is no capability cost at this scale.

Harmful prompts rendered as images and fed through the vision tower were all answered. The ablated decoder serves every modality.

MMLU-14k (full test set, chat letter-logprob, T=0, SGLang)

No capability cost across all 57 subjects; the largest per-subject moves are ±2pp noise on 100-item subjects. Abliteration at this strength is not always free; the more aggressive dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 measured −4.22pp on the same protocol class (−39.9pp on moral_scenarios) in exchange for zero-hedge compliance. Ours keeps the hedged style but removes refusals, including at reasoning_effort=max (6/6 harmful answered at max effort, 0 refusals, while the stock model becomes more refusal-prone at high effort).

Serving

Validated end-to-end as a drop-in checkpoint on SGLang (lmsysorg/sglang:dev-dsv41), 4× H200, TP4/EP4, 256k context: chat, streaming, logprobs, tool calls, and vision all pass; 100.9 tok/s single-stream decode.

export SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1   # Engram tables to host RAM (~200 GB)
sglang serve --model-path distributedcog/DeepSeek-V4.1-Flash-abliterated \
  --tp-size 4 --ep-size 4 \
  --context-length 262144 --mem-fraction-static 0.85 \
  --reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
  --trust-remote-code

Non-obvious requirements: --ep-size 4 is mandatory at TP4 (moe_intermediate_size=2304 breaks the MXFP4 multiple-of-128 rule when split 4 ways), name both parsers explicitly (the model ships no chat template, so auto selects nothing), and reasoning is off by default (send reasoning_effort to enable it).

Method

Per-layer refusal directions were measured at the hyper-connection-collapsed residual stream (attn_norm input) on 128 harmful vs 128 harmless prompts, orthogonalized against the harmless mean direction (projected abliteration), then applied as norm-preserving biprojected edits to wo_b and shared_experts.w2 rows across the target layer range. FP8 32×32 (ue8m0) blocks are dequantized → ablated → requantized exactly (power-of-two scales), leaving the FP4 routed experts, Engram memory, and vision tower byte-identical to upstream.