DeepSeek-V4-Flash-0731-FFT-BF16-Cyber-2.0 API & Inference Endpoint

Overview

The base model used for this project is:

text
deepseek-ai/DeepSeek-V4-Flash-0731-2.0

This variant was created as an experiment in modifying refusal behaviour for cybersecurity-oriented use cases such as:

security research;
penetration-testing labs;
vulnerability analysis;
defensive security;
exploit analysis;
CTF environments;
supervised agentic security workflows.

The modification was inspired by research showing that refusal behaviour in several instruction-tuned language models can be strongly associated with a low-dimensional direction in the residual stream.

The goal of this experiment was not to claim that the model has a literal neural-network "refusal layer."

A more accurate description is:

the model's refusal-related representation was identified and modified using refusal-direction / abliteration-style techniques.

Method

The approach was based on the refusal-direction line of mechanistic-interpretability research. And also for this model I use rtx pro 5000 and with Q8 quantization so there was no problem with memory and it was pretty comfortable.

Conceptually:

text
Harmful / refusal-triggering prompts
                 │
                \ /
        Residual activations
                 │
                 │
                 │ difference in mean activations
                \ /
         Refusal direction
                 │
                \ /
      Weight-space intervention
                 │
                \ /
        Modified checkpoint

The general method compares model activations produced by two prompt groups:

text
refusal-triggering prompts
          vs.
non-refusal / benign prompts

A candidate direction associated with refusal behaviour can then be estimated from the difference between their representations.

The identified direction can be suppressed through an orthogonalization-style weight intervention.

Conceptually, given a refusal direction r, an affected output weight matrix W can be modified approximately as:

text
W' = W - r rᵀ W

This makes the affected component less able to write the identified refusal direction into the residual stream.

This project followed that general research approach rather than training a new foundation model.

Research Basis

This experiment was primarily inspired by the following work.

Refusal in Language Models Is Mediated by a Single Direction So Who Cares

Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, Neel Nanda — 2024

The work reports that refusal behaviour across several open-source instruction-tuned model families can be strongly mediated by a single direction in the residual stream.

The authors demonstrate two complementary interventions:

text
remove refusal direction
        |
       \ /
reduced refusal
        |
       \ /
add refusal direction
        |
       \ /
increased refusal

The work also demonstrates a direct weight-space intervention through orthogonalization.

Paper identifier:

text
arXiv:2406.11717

Reference implementation:

text
andyrdt/refusal_direction

The original research was initially presented as the LessWrong article:

text
Refusal in LLMs is mediated by a single direction

before publication of the full paper.

Abliteration

The experiment was also informed by community implementations usually referred to as abliteration.

Relevant implementations and explanations include:

text
FailSpy/abliterator

and Maxime Labonne's technical article:

text
Uncensor any LLM with abliteration

These works adapt refusal-direction ablation into a practical workflow for modifying open-weight instruction models.

Contrastive Data

This type of intervention requires examples that produce different refusal-related model behaviour.

The original refusal-direction research used contrasting collections of:

text
harmful / refusal-triggering instructions
                 vs.
harmless instructions

The original research reports using approximately:

text
512 harmful prompts
512 harmless prompts

for refusal-direction extraction experiments.

The same research evaluated refusal suppression using:

text
100 harmful instructions from JailbreakBench

and evaluated induced refusal using:

text
128 harmless instructions from Alpaca

Historical Evaluation

After the model modification, I evaluated the base and modified checkpoints on an internal set of approximately 400 cybersecurity-oriented prompts.

The benchmark focused primarily on refusal frequency.

Result

Table with columns: Model, Refusal rate
Model	Refusal rate
DeepSeek-V4-Flash-0731-2.0 base model	~97%
Modified Cyber variant	23%

This is a reduction of approximately:

text
97% → 23%

-74 percentage points

or roughly a 76% relative reduction in observed refusals.

The main conclusion from the experiment was therefore:

The refusal-direction intervention substantially reduced refusal behaviour on the internal cybersecurity prompt set.

What the Result Does Not Mean

A lower refusal rate is not equivalent to higher model quality.

The experiment does not establish that this checkpoint has:

higher factual accuracy;
better exploit reasoning;
better coding ability;
better cybersecurity knowledge;
better general intelligence;
better safety;
higher benchmark performance than the base model.

It establishes only that, on the historical internal test set, the modified model refused significantly fewer prompts.

Evaluation Limitations

The original ~400-prompt evaluation was an internal experiment.

At the moment, the complete prompt-level artifacts are not published with this repository.

Therefore the 97% → 23% result should be treated as:

a historical internal experimental result, not an independently reproduced benchmark.

Current limitations include:

original prompt-level results are not yet published;
exact original contrastive dataset identifier has not yet been recovered;
no independent evaluator was used;
no statistical confidence interval was recorded;
refusal rate alone does not measure technical correctness;
lower refusal does not imply safer or more useful answers;
results have not yet been reproduced against the current repository state.

Planned Reproducible Evaluation

A future evaluation release should preserve every prompt and completion and evaluate multiple dimensions separately.

Planned metrics:

Table with columns: Metric, Description
Metric	Description
Refusal Rate	Percentage of requests refused
Inappropriate Refusal Rate	Legitimate authorised requests incorrectly refused
Appropriate Refusal Rate	Requests correctly refused
Task Completion Rate	Whether the requested task was completed
Technical Correctness	Whether the security answer is correct
Hallucination Rate	Unsupported technical claims
Unsafe Completion Rate	Problematic model completions
Latency	Generation latency

The intended experimental comparison is:

text
DeepSeek-V4-Flash-0731-2.0
          │
          │
          ├── baseline evaluation
          │
         \ /
Refusal-direction intervention
          │
         \ /
Cyber checkpoint
          │
          │
          └── same evaluation

Relationship to PENdS

This model and PENdS are separate projects.

The model is responsible for language-model inference:

text
DeepSeek-V4-Flash-0731-2.0
          ↓
Refusal-direction intervention
          ↓
Cyber checkpoint

PENdS is the agent/security runtime:

text
Model
  |
Hermes Agent
  |
PENdS
  |
Scope Guard
  |
Approval
  |
Execution
  |
Evidence

PENdS provides controls such as:

engagement scoping;
target validation;
guarded execution;
human approval;
task tracking;
evidence collection;
reporting.

Those are PENdS properties, not properties of the model weights.

The model can be used independently from PENdS.

Base Model

This checkpoint derives from:

text
deepseek-ai/DeepSeek-V4-Flash-0731-2.0

DeepSeek-V4-Flash-0731-2.0 is distributed under the MIT License.

Refer to the upstream model card for:

architecture;
parameter count;
inference configuration;
official benchmarks;
chat template;
deployment requirements.

I intentionally do not reproduce DeepSeek's benchmark tables here because they describe the upstream base model, not experimental results produced by this checkpoint.

Usage

The checkpoint uses the DeepSeek-V4 chat format.

Example tokenizer usage:

python
from encoding_dsv4 import (
    encode_messages,
    parse_message_from_completion_text,
)

from transformers import AutoTokenizer

messages = [
    {
        "role": "user",
        "content": "Explain the security impact of this vulnerability.",
    }
]

prompt = encode_messages(
    messages,
    thinking_mode="thinking",
    reasoning_effort="max",
)

tokenizer = AutoTokenizer.from_pretrained(
    "Akan4ik/DeepSeek-V4-Flash-0731-2.0-FFT-BF16-Cyber"
)

tokens = tokenizer.encode(prompt)

Refer to the upstream DeepSeek documentation for hardware-specific inference instructions.

Intended Use

This checkpoint was created for research involving:

LLM refusal behaviour;
mechanistic interpretability;
cybersecurity-oriented LLM evaluation;
authorised penetration-testing environments;
AI-security research;
supervised security agents;
model-behaviour experiments.

It should be treated as experimental research software.

Limitations

The intervention modifies refusal behaviour but does not make the model inherently reliable.

Potential limitations include:

reduced refusal may increase problematic completions;
security answers may still contain hallucinations;
generated exploit information may be incorrect;
model behaviour may differ substantially from the original checkpoint;
refusal-direction results may not generalise uniformly across domains
the original internal benchmark needs reproduction
exact data provenance for the original modification experiment is still being recovered
the 100% refusal could be bad for some usages, so I made it mostly like friendly for research making but not fully uncencored.
For example it refuses against child-abuse prompts and some sexual areas also and e.t.c

Responsible Use

Use this model only where you are authorised to perform the requested security work.

For autonomous or semi-autonomous security tooling, model output should not directly control target-touching operations without an independent execution boundary.

Projects such as PENdS address this separately through scope and execution controls.

License

The upstream DeepSeek-V4-Flash-0731-2.0 repository and model weights are distributed under the MIT License.

This repository is also distributed under the MIT License.

See LICENSE for details.

References

Arditi et al., 2024

Refusal in Language Models Is Mediated by a Single Direction

Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, Neel Nanda.

text
arXiv:2406.11717
GitHub: andyrdt/refusal_direction

Arditi et al., 2024 — original technical post

Refusal in LLMs is mediated by a single direction

LessWrong, April 27, 2024.

FailSpy

Abliterator

text
GitHub: FailSpy/abliterator

Independent implementation and extension of refusal-direction ablation techniques.

Maxime Labonne

Uncensor any LLM with abliteration

Hugging Face technical article, 2024.

DeepSeek-AI

DeepSeek-V4-Flash-0731-2.0

Base model and upstream inference documentation.

Reproducibility Status

Table with columns: Component, Status
Component	Status
Base checkpoint	Public
Modification research basis	Documented
Reference implementation	Public
Historical ~400-prompt evaluation	Completed historically
Historical base refusal rate	~97%
Historical modified refusal rate	23%
Exact original prompt dataset	Recovery pending
Prompt-level benchmark release	Pending
Independent reproduction

The next priority for this project is therefore not another architectural modification.

It is reproducing and publishing the original evaluation with complete provenance.

Overview

The base model used for this project is:

text
deepseek-ai/DeepSeek-V4-Flash-0731-2.0

This variant was created as an experiment in modifying refusal behaviour for cybersecurity-oriented use cases such as:

security research;
penetration-testing labs;
vulnerability analysis;
defensive security;
exploit analysis;
CTF environments;
supervised agentic security workflows.

The goal of this experiment was not to claim that the model has a literal neural-network "refusal layer."

A more accurate description is:

the model's refusal-related representation was identified and modified using refusal-direction / abliteration-style techniques.

Method

Conceptually:

text
Harmful / refusal-triggering prompts
                 │
                \ /
        Residual activations
                 │
                 │
                 │ difference in mean activations
                \ /
         Refusal direction
                 │
                \ /
      Weight-space intervention
                 │
                \ /
        Modified checkpoint

The general method compares model activations produced by two prompt groups:

text
refusal-triggering prompts
          vs.
non-refusal / benign prompts

A candidate direction associated with refusal behaviour can then be estimated from the difference between their representations.

The identified direction can be suppressed through an orthogonalization-style weight intervention.

Conceptually, given a refusal direction r, an affected output weight matrix W can be modified approximately as:

text
W' = W - r rᵀ W

This makes the affected component less able to write the identified refusal direction into the residual stream.

This project followed that general research approach rather than training a new foundation model.

Research Basis

This experiment was primarily inspired by the following work.

Refusal in Language Models Is Mediated by a Single Direction So Who Cares

Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, Neel Nanda — 2024

The work reports that refusal behaviour across several open-source instruction-tuned model families can be strongly mediated by a single direction in the residual stream.

The authors demonstrate two complementary interventions:

text
remove refusal direction
        |
       \ /
reduced refusal
        |
       \ /
add refusal direction
        |
       \ /
increased refusal

The work also demonstrates a direct weight-space intervention through orthogonalization.

Paper identifier:

text
arXiv:2406.11717

Reference implementation:

text
andyrdt/refusal_direction

The original research was initially presented as the LessWrong article:

text
Refusal in LLMs is mediated by a single direction

before publication of the full paper.

Abliteration

The experiment was also informed by community implementations usually referred to as abliteration.

Relevant implementations and explanations include:

text
FailSpy/abliterator

and Maxime Labonne's technical article:

text
Uncensor any LLM with abliteration

These works adapt refusal-direction ablation into a practical workflow for modifying open-weight instruction models.

Contrastive Data

This type of intervention requires examples that produce different refusal-related model behaviour.

The original refusal-direction research used contrasting collections of:

text
harmful / refusal-triggering instructions
                 vs.
harmless instructions

The original research reports using approximately:

text
512 harmful prompts
512 harmless prompts

for refusal-direction extraction experiments.

The same research evaluated refusal suppression using:

text
100 harmful instructions from JailbreakBench

and evaluated induced refusal using:

text
128 harmless instructions from Alpaca

Historical Evaluation

After the model modification, I evaluated the base and modified checkpoints on an internal set of approximately 400 cybersecurity-oriented prompts.

The benchmark focused primarily on refusal frequency.

Result

Table with columns: Model, Refusal rate
Model	Refusal rate
DeepSeek-V4-Flash-0731-2.0 base model	~97%
Modified Cyber variant	23%

This is a reduction of approximately:

text
97% → 23%

-74 percentage points

or roughly a 76% relative reduction in observed refusals.

The main conclusion from the experiment was therefore:

The refusal-direction intervention substantially reduced refusal behaviour on the internal cybersecurity prompt set.

What the Result Does Not Mean

A lower refusal rate is not equivalent to higher model quality.

The experiment does not establish that this checkpoint has:

higher factual accuracy;
better exploit reasoning;
better coding ability;
better cybersecurity knowledge;
better general intelligence;
better safety;
higher benchmark performance than the base model.

It establishes only that, on the historical internal test set, the modified model refused significantly fewer prompts.

Evaluation Limitations

The original ~400-prompt evaluation was an internal experiment.

At the moment, the complete prompt-level artifacts are not published with this repository.

Therefore the 97% → 23% result should be treated as:

a historical internal experimental result, not an independently reproduced benchmark.

Current limitations include:

original prompt-level results are not yet published;
exact original contrastive dataset identifier has not yet been recovered;
no independent evaluator was used;
no statistical confidence interval was recorded;
refusal rate alone does not measure technical correctness;
lower refusal does not imply safer or more useful answers;
results have not yet been reproduced against the current repository state.

Planned Reproducible Evaluation

A future evaluation release should preserve every prompt and completion and evaluate multiple dimensions separately.

Planned metrics:

Table with columns: Metric, Description
Metric	Description
Refusal Rate	Percentage of requests refused
Inappropriate Refusal Rate	Legitimate authorised requests incorrectly refused
Appropriate Refusal Rate	Requests correctly refused
Task Completion Rate	Whether the requested task was completed
Technical Correctness	Whether the security answer is correct
Hallucination Rate	Unsupported technical claims
Unsafe Completion Rate	Problematic model completions
Latency	Generation latency

The intended experimental comparison is:

text
DeepSeek-V4-Flash-0731-2.0
          │
          │
          ├── baseline evaluation
          │
         \ /
Refusal-direction intervention
          │
         \ /
Cyber checkpoint
          │
          │
          └── same evaluation

Relationship to PENdS

This model and PENdS are separate projects.

The model is responsible for language-model inference:

text
DeepSeek-V4-Flash-0731-2.0
          ↓
Refusal-direction intervention
          ↓
Cyber checkpoint

PENdS is the agent/security runtime:

text
Model
  |
Hermes Agent
  |
PENdS
  |
Scope Guard
  |
Approval
  |
Execution
  |
Evidence

PENdS provides controls such as:

engagement scoping;
target validation;
guarded execution;
human approval;
task tracking;
evidence collection;
reporting.

Those are PENdS properties, not properties of the model weights.

The model can be used independently from PENdS.

Base Model

This checkpoint derives from:

text
deepseek-ai/DeepSeek-V4-Flash-0731-2.0

DeepSeek-V4-Flash-0731-2.0 is distributed under the MIT License.

Refer to the upstream model card for:

architecture;
parameter count;
inference configuration;
official benchmarks;
chat template;
deployment requirements.

I intentionally do not reproduce DeepSeek's benchmark tables here because they describe the upstream base model, not experimental results produced by this checkpoint.

Usage

The checkpoint uses the DeepSeek-V4 chat format.

Example tokenizer usage:

python
from encoding_dsv4 import (
    encode_messages,
    parse_message_from_completion_text,
)

from transformers import AutoTokenizer

messages = [
    {
        "role": "user",
        "content": "Explain the security impact of this vulnerability.",
    }
]

prompt = encode_messages(
    messages,
    thinking_mode="thinking",
    reasoning_effort="max",
)

tokenizer = AutoTokenizer.from_pretrained(
    "Akan4ik/DeepSeek-V4-Flash-0731-2.0-FFT-BF16-Cyber"
)

tokens = tokenizer.encode(prompt)

Refer to the upstream DeepSeek documentation for hardware-specific inference instructions.

Intended Use

This checkpoint was created for research involving:

LLM refusal behaviour;
mechanistic interpretability;
cybersecurity-oriented LLM evaluation;
authorised penetration-testing environments;
AI-security research;
supervised security agents;
model-behaviour experiments.

It should be treated as experimental research software.

Limitations

The intervention modifies refusal behaviour but does not make the model inherently reliable.

Potential limitations include:

reduced refusal may increase problematic completions;
security answers may still contain hallucinations;
generated exploit information may be incorrect;
model behaviour may differ substantially from the original checkpoint;
refusal-direction results may not generalise uniformly across domains
the original internal benchmark needs reproduction
exact data provenance for the original modification experiment is still being recovered
the 100% refusal could be bad for some usages, so I made it mostly like friendly for research making but not fully uncencored.
For example it refuses against child-abuse prompts and some sexual areas also and e.t.c

Responsible Use

Use this model only where you are authorised to perform the requested security work.

For autonomous or semi-autonomous security tooling, model output should not directly control target-touching operations without an independent execution boundary.

Projects such as PENdS address this separately through scope and execution controls.

License

The upstream DeepSeek-V4-Flash-0731-2.0 repository and model weights are distributed under the MIT License.

This repository is also distributed under the MIT License.

See LICENSE for details.

References

Arditi et al., 2024

Refusal in Language Models Is Mediated by a Single Direction

Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, Neel Nanda.

text
arXiv:2406.11717
GitHub: andyrdt/refusal_direction

Arditi et al., 2024 — original technical post

Refusal in LLMs is mediated by a single direction

LessWrong, April 27, 2024.

FailSpy

Abliterator

text
GitHub: FailSpy/abliterator

Independent implementation and extension of refusal-direction ablation techniques.

Maxime Labonne

Uncensor any LLM with abliteration

Hugging Face technical article, 2024.

DeepSeek-AI

DeepSeek-V4-Flash-0731-2.0

Base model and upstream inference documentation.

Reproducibility Status

Table with columns: Component, Status
Component	Status
Base checkpoint	Public
Modification research basis	Documented
Reference implementation	Public
Historical ~400-prompt evaluation	Completed historically
Historical base refusal rate	~97%
Historical modified refusal rate	23%
Exact original prompt dataset	Recovery pending
Prompt-level benchmark release	Pending
Independent reproduction

The next priority for this project is therefore not another architectural modification.

It is reproducing and publishing the original evaluation with complete provenance.

DeepSeek-V4-Flash-0731-FFT-BF16-Cyber-2.0

README

Overview

Method

Research Basis

Refusal in Language Models Is Mediated by a Single Direction So Who Cares

Abliteration

Contrastive Data

Historical Evaluation

Result

What the Result Does Not Mean

Evaluation Limitations

Planned Reproducible Evaluation

Relationship to PENdS

Base Model

Usage

Intended Use

Limitations

Responsible Use

License

References

Arditi et al., 2024

Arditi et al., 2024 — original technical post

FailSpy

Maxime Labonne

DeepSeek-AI

Reproducibility Status

Explore FriendliAI today

README

Overview

Method

Research Basis

Refusal in Language Models Is Mediated by a Single Direction So Who Cares

Abliteration

Contrastive Data

Historical Evaluation

Result

What the Result Does Not Mean

Evaluation Limitations

Planned Reproducible Evaluation

Relationship to PENdS

Base Model

Usage

Intended Use

Limitations

Responsible Use

License

References

Arditi et al., 2024

Arditi et al., 2024 — original technical post

FailSpy

Maxime Labonne

DeepSeek-AI

Reproducibility Status