Groot 19B-A3B uncensored (NVFP4)
Directional ablation of GrootTeam/Groot-19B-A3B-261023, re-quantised to the parent's own NVFP4 plan for Blackwell. Architecture unchanged: 19B MoE, 3B active, 128 experts top-8, 30 gated-delta + 10 full-attention layers, 256K context, MTP layer retained.
This is an experiment with measured results, not a safety claim. Read the cost section before using it.
Method
- Directions. First-generated-token residuals from 200 harmful / 200 harmless prompts, matched per prompt on token length (22.8 mean both sides), per-layer normalised difference of means.
- Attention ablation. Heretic, 120 Optuna trials, norm-preserving, on
self_attn.o_projandlinear_attn.out_proj. Selected trial 57: KL 0.0801 on benign text,max_weight=1.45at layer 28.93,min_weight=0.18,min_weight_distance=18.61(per-layer directions). - Expert ablation. Heretic cannot reach this model's fused expert tensors, so routed experts and the shared expert were ablated separately at 1.5 strength, norm-preserving, all 40 layers.
- Quantisation. Parent's
config_groupsreused verbatim: FP8 W8A8 attention, NVFP4 group-16 experts/shared/lm_head, vision tower andmtp.*ignored. 512 Alpaca calibration samples. MTP ships unquantised, so speculative decoding (2 draft tokens) works.
Results
HarmBench compliance = share of prompts where the model produced the requested
behaviour, graded by cais/HarmBench-Llama-2-13b-cls. Refusals/Hot = a local
rubric judge (StrongREJECT-style) over 320 held-out prompts, disjoint from the
extraction set. XSTest = 250 safe prompts for over-refusal.
| Build | HarmBench compliance | Refusals | Hot ≥0.5 | XSTest refusals |
|---|---|---|---|---|
| parent (BF16) | 1.6% | 7.8% | 92.2% | – |
| abliterated (BF16) | 2.5% | 5.0% | 95.0% | – |
| this build (NVFP4) | 3.7% | 2.8% | 97.2% | 0.0% |
Capability, same harness both sides:
| Build | GSM8K (200) | blackwall quality | decode | Wh/correct |
|---|---|---|---|---|
| parent | 94.0 | 78.5 | 379 tok/s | 0.79 |
| this build | 83.0 (BF16) | 73.6 | 364 tok/s | 1.98 |
Paired over shared blackwall questions: quality −4.9 (95% CI −7.6 to −2.3), LiveCodeBench −8.9, Graphwalks −6.5. Math, MRCR, SuperGPQA and tool use fall inside the interval — no clear difference. The same weights scored 75.5 in an earlier run, so run-to-run variance is ~2 points.
What this does and does not do
- Compliance moved 1.6% → 3.7%. The parent already produced the requested behaviour on 98.4% of this prompt class; this buys the last ~2 points.
- It costs 4.9 quality points, 8.9 on LiveCodeBench, and 2.5× the energy per correct answer, because it spends more tokens per answer.
- Abliteration removes a refusal direction. It adds no judgement, no accuracy and no safety. Output is the user's responsibility.
- String matching on refusal phrases is useless here (1.6% on a build the judges score very differently).
Reproduction
Pipeline, prompts, judge harness and quantisation scripts: https://github.com/guitaripod/groot-abliteration
Seeds and parameters are fixed in that repository; the calibration set is
tatsu-lab/alpaca (512 samples, parent chat template). Licence follows the
parent (Apache-2.0).
LocalMaxxing