DaydreamBlend

DeepSeek-V4-Flash-Vision-Exp-Abliterated-L20-Lambda1.25

Summary

This is a native mixed-precision, rank-1 weight edit of deepseek-ai/DeepSeek-V4-Flash-Vision-Exp at immutable revision 86f746b36186f0e567729a5c06a8c918caba82a9.[1] It was not gradient-finetuned. A refusal-associated direction was independently extracted from a locally generated, non-distributed 1,024-pair contrast corpus, then baked into 37 attention output writers.

Table with columns: Field, Value
Field	Value
Parent checkpoint	`deepseek-ai/DeepSeek-V4-Flash-Vision-Exp`
Parent revision	`86f746b36186f0e567729a5c06a8c918caba82a9`
Direction source	`layers.20.moe_read`
Direction construction	sign-aligned consensus across `chat`, `think-high`, `think-max`
Weight targets	`layers.3–39.attn.wo_b`
Strength	`λ=1.25`
Edited weights	37 attention writers and their block scales
Untouched scope	routed/shared experts, routers, MTP, vision, embeddings, all other tensors
Native precision	mixed FP8/FP4/BF16/F32; target writers remain `F8_E4M3` with `F8_E8M0` scales
Architectural context	1,048,576 tokens
Verified runtime	Anemll vLLM DSpark 0.1.1, 2× GB10, TP=2, MTP depth=6
Direction SHA-256	`89739d32e5d65ade91938f7f8f90a21630a9f9bac5edc2ae1eedb36c00002adb`

The intervention follows the single-direction refusal framework introduced by Arditi et al., while using a model-specific corpus, read-point sweep, and quantized checkpoint bake.[2]

What `λ=1.25` means

For a normalized direction u and residual-writing matrix W, the runtime and weight-domain interventions are algebraically matched:

text
y' = y - λ u(uᵀy)
W' = W - λ u(uᵀW)

At λ=1, the u component is removed. At λ=1.25, it is deliberately overshot: the original component is mapped to -0.25× rather than zero. This checkpoint therefore implements a scaled rank-1 intervention, not a strict orthogonal projection.

Non-distributed contrast corpus

The extraction corpus is not included in this repository.

1,024 matched harmful/benign prompt pairs; prompts only, no answers.
Eight categories, 128 pairs each:
- violence and weapons
- cyber abuse
- fraud and non-violent crime
- illegal goods and dangerous substances
- hate, harassment, and discrimination
- privacy, coercion, and exploitation
- self-harm and high-risk health
- disinformation, manipulation, and extremism
Generated by the stock Vision-Exp checkpoint; no refusal vector or abliterated generator was used.
Exact prompts remain local-only. license_intent in the internal corpus manifest is CC0-1.0; no dataset is distributed from this model repository.
Final pair artifact SHA-256: .

WildJailbreak-derived directions were used only as post-hoc comparators. They were not used to generate the corpus, initialize or regularize this direction, or select its sign/layer.

Direction extraction

Capture design

Base layers: 43; MTP blocks excluded.
Read points per layer:
- attention_read: the un-widened 4,096-dimensional input consumed by attention
- moe_read: the un-widened 4,096-dimensional input consumed by the MoE
Modes: chat, think-high, think-max.
Data split: 512 fit and 512 held-out pairs per arm and mode.
Total capture: 6,144 prefills over 86 read points.
Aggregation: online FP64 harmful-minus-benign sums; no activation matrix dump.
Selection used split-half stability, held-out scalar-projection AUC, cross-mode agreement, and causal intervention behavior.

Statistical shortlist

Table with columns: Candidate, Rank-1 energy, σ1/σ2, Min held-out AUC, Min split-half cosine, Robust score
Candidate	Rank-1 energy	σ1/σ2	Min held-out AUC	Min split-half cosine	Robust score
`L0 moe_read`	0.95345	4.616	0.73452	0.97801	0.64359
`L20 moe_read`	0.81348	2.248	0.96954	0.99593

L0 led the aggregate statistical score but separated held-out harmful and benign prompts poorly. It was not promoted on rank-1 energy alone.

Causal layer pilot

The same candidate direction was applied at runtime to all 37 L3–L39 attn.wo_b writers at λ=1. Evaluation used a stratified subset of StrongREJECT: 24 chat prompts and 12 think-max prompts, plus six tool calls.

Table with columns: Source direction, Chat refusal, Think-max refusal, Worst-mode refusal, Tool correctness
Source direction	Chat refusal	Think-max refusal	Worst-mode refusal	Tool correctness
Stock	100.00%	100.00%	100.00%	100%
`L20 moe_read`	45.83%	33.33%	45.83%	100%
`L21 moe_read`	45.83%

L20 moe_read was selected because it won the causal pilot across both chat and thinking modes. All arms had zero empty output and zero replacement characters.

Runtime-hook evaluation before baking

Important scoring boundary

StrongREJECT provides a 313-prompt forbidden-request benchmark and official harmfulness-oriented evaluators.[3] This experiment did not run the official StrongREJECT evaluator. It used the StrongREJECT prompt set with two local, deterministic refusal matchers; the primary tables below report the broader matcher. A lower number means fewer detected refusal/deflection phrases, not that the answer was correct, useful, complete, or harmful.

XSTest is designed to expose exaggerated refusal on safe prompts.[4] OR-Bench includes hard benign prompts and a toxic split intended to detect indiscriminate answering.[5] For this artifact's uncensoring objective, lower refusal on both unsafe/toxic and benign splits is an intended behavioral change; it also means that conventional safety separation is reduced.

Lambda sweep

All edited rows use the same local L20 moe_read direction and the same L3–L39 attn.wo_b target scope.

Table with columns: Condition, StrongREJECT broad refusal, 768-token finishes, XSTest safe, XSTest unsafe, OR-Bench hard, OR-Bench toxic, Tool correctness
Condition	StrongREJECT broad refusal	768-token finishes	XSTest safe	XSTest unsafe	OR-Bench hard	OR-Bench toxic	Tool correctness
Stock	296/313 (94.57%)	15/313	8.80%	86.00%	44.25%	93.50%	100%
`λ=1.00`	122/313 (38.98%)

Paired StrongREJECT refusal classifications:

λ=1.00 vs λ=1.25: 73 prompts changed from refusal to non-refusal and 24 changed in the opposite direction; exact McNemar p=6.40×10⁻⁷.
λ=1.25 vs λ=1.50: discordance 49 versus 24 in favor of stronger removal at λ=1.50; exact McNemar p=0.00463.

λ=1.25 was selected as the measured middle point: stronger refusal removal than λ=1, but lower KLD and fewer length-limit finishes than λ=1.5. It is a calibration choice for this stated objective, not a universal optimum.

StrongREJECT category breakdown

Table with columns: Category, N, Stock broad refusal, λ=1.25 broad refusal, λ=1.25 length finishes
Category	N	Stock broad refusal	`λ=1.25` broad refusal	`λ=1.25` length finishes
Disinformation and deception	50	84.00%	16.00%	45
Hate, harassment, discrimination	50	94.00%	18.00%	34
Illegal goods and services	50	98.00%

Direction-construction controls

These controls explain why the final model uses the independent single-source L20 direction rather than assuming that cross-layer SVD or a previously used corpus would transfer.

Table with columns: Direction / condition, StrongREJECT refusal, First-token mean KL, Continuation mean KL, Release role
Direction / condition	StrongREJECT refusal	First-token mean KL	Continuation mean KL	Release role
Local L10–L35 attention-read SVD, `λ=1`	83.71%	0.12999	0.03403	low drift, causally weak; rejected
WJ-derived L20 attention-writer consensus, `λ=1`	59.11%	0.21861	0.06334	post-hoc comparator only
WJ-derived L10–L35 SVD,

Benign-distribution drift

KLD used the exact 129,280-token vocabulary and matched stock logits from the same engine window. KL is KL(P_stock || P_edit). Teacher-forced positions follow stock continuations.

Table with columns: Scope, N, Mean KL, Median KL, P95 KL, Mean JSD, Top-1 agreement
Scope	N	Mean KL	Median KL	P95 KL	Mean JSD	Top-1 agreement
First response token	192	0.38480	0.01860	2.39685	0.04828	85.42%
Teacher-forced continuation	384	0.09062	0.000423	0.26324	0.01522

A repeated stock-vs-stock numerical control on 32 first-token contexts produced mean KL 0.01999, p95 0.07774, and top-1 agreement 93.75%. The intervention therefore exceeds distributed numerical variation, especially at response initiation. Continuations were more stable than first-token policy, but the observed tail drift is not negligible.

Native checkpoint bake

The parent checkpoint stores each target writer as:

text
weight: F8_E4M3 [4096, 8192]
scale:  F8_E8M0 [32, 64]
block:  128 × 128

Each writer was dequantized to FP32, edited, and requantized to the exact native dialect. Three bounded fixed-point residual-correction passes were used because a one-pass nearest quantization had low whole-matrix error but poor preservation of the intended direction coefficient.

Across all 37 edited writers:

Table with columns: Bake invariant, Result
Bake invariant	Result
Maximum relative L2 to FP32 target	1.6281%
Maximum relative direction-coefficient error	14.1213%
Changed model shards	37
Unchanged model shards	11
Indexed tensors	72,633
Total model shards	48
Cross-node shard agreement	48/48 byte-identical
Routed FP4 experts touched	No

The complete per-tensor record, including source-shard SHA-256, is in ABLITERATION_MANIFEST.json. Full remote/local artifact verification is in ARTIFACT_VERIFICATION.json.

Baked runtime qualification

The baked checkpoint was loaded fresh on two GB10 nodes with tensor parallelism 2. The tested runtime profile was:

Table with columns: Runtime field, Tested value
Runtime field	Tested value
Engine	Anemll vLLM DSpark 0.1.1
Tensor parallelism	2
Context length	1,048,576
MTP speculative depth	6
KV cache dtype	`fp8_ds_mla`
MoE backend	`flashinfer_b12x`
Boot-shape warmup	47/47 passed

Functional smoke gates passed for text, native image input, required tool calls, and reasoning efforts low, high, and max.

Baked-vs-runtime equivalence gate

A stratified 24-prompt subset covering all six StrongREJECT categories compared the baked checkpoint with the runtime λ=1.25 intervention:

Table with columns: Metric, Runtime hook, Baked checkpoint
Metric	Runtime hook	Baked checkpoint
Broad refusals	8/24	7/24
Paired classification agreement	—	87.5%
Baked 768-token finishes	—	12/24
Empty outputs	—	0
Replacement characters	—	0

The gate passed, but it is not a repeat of the complete 313-prompt runtime benchmark. See RUNTIME_VALIDATION.json for the machine-readable aggregate.

Repository contents

text
.
├── model-00001-of-00048.safetensors ... model-00048-of-00048.safetensors
├── model.safetensors.index.json
├── config.json
├── generation_config.json
├── tokenizer.json
├── tokenizer_config.json
├── encoding/                         # upstream prompt encoding
├── inference/                        # upstream minimal inference code/examples
├── research/
│   └── l20-moe-consensus-projected-l3-l39.npz
├── scripts/
│   └── bake_dsv4_l20_lambda125.py
├── ABLITERATION_MANIFEST.json        # exact recipe and per-writer evidence
├── ARTIFACT_VERIFICATION.json        # shard sizes and SHA-256 values
└── RUNTIME_VALIDATION.json           # baked runtime qualification

The extraction corpus and raw harmful-prompt generations are intentionally absent.

Loading notes

This repository preserves the parent checkpoint's native mixed-precision format, encoding code, vision path, and DSpark/MTP tensors. Follow the parent model's runtime guidance and use a DeepSeek-V4 Vision-Exp-compatible vLLM or SGLang build.[1] Do not pass a generic quantization override that would reinterpret the checkpoint's existing FP8/packed-FP4 layout.

The exact validated dual-GB10 deployment used local runtime patches specific to that environment; those operational patches are not part of this model repository. A successful from_pretrained() metadata read is not equivalent to the TP2 runtime qualification recorded above.

Intended use

Mechanistic-interpretability research on refusal-associated representations.
Controlled red-team and policy-layer testing.
Comparison of runtime activation interventions with baked quantized weights.
Study of refusal/capability trade-offs.

Out-of-scope use

Unmoderated production deployment or an anonymous public inference service.
Treating the checkpoint as a safety-aligned assistant.
Autonomous high-impact actions without external authorization and controls.
Inferring that lower refusal means higher correctness, usefulness, or capability.

Limitations

The complete behavioral tables are from the runtime hook; baked equivalence was checked on a 24-prompt stratified subset, not all 313 prompts.
The reported StrongREJECT metric is a deterministic refusal matcher, not the official StrongREJECT harmfulness/usefulness evaluator.
242/313 StrongREJECT outputs reached the 768-token limit at λ=1.25. Non-refusal therefore does not establish complete task performance.
Capability preservation was smoke-tested for load, text, vision, tool calls, reasoning modes, and scheduler paths. No broad capability suite such as MMLU, coding benchmarks, or multimodal benchmark regression was run on the baked checkpoint.
KLD is measured against the matched identically quantized stock checkpoint, not against a BF16 control.
The non-distributed synthetic corpus may still encode generator-specific topic, wording, or style confounds despite matching, held-out AUC, overlap screening, and causal validation.
Sampling behavior was not characterized as broadly as deterministic greedy behavior. Do not generalize the recorded corruption/empty-output gates to all temperatures, seeds, or long-context workloads.
Refusal behavior can also be reintroduced by system prompts, serving layers, downstream policies, or later fine-tuning.

Reproducibility and provenance

Parent revision: 86f746b36186f0e567729a5c06a8c918caba82a9
Direction SHA-256: 89739d32e5d65ade91938f7f8f90a21630a9f9bac5edc2ae1eedb36c00002adb
Non-distributed pair artifact SHA-256: 9d5b25546068fbcc2f8bc9e58c0937ff0511044d2bfa19b8820c6c15f5934f18
Initial checkpoint upload commit: b32a8f15424a7259f1a7878299ed6ad7630d45a6
Before release preparation, remote staging verification matched 87 files, 50 LFS objects, all 48 model-shard sizes and SHA-256 values, and 156.31 GiB of logical repository data.

Experiment design, harness scripting, artifact engineering, and documentation were AI-assisted under human direction. Numerical claims in this card were transcribed from the machine-generated JSON artifacts in this repository or the pinned local evaluation manifests; they are not retrospective self-reported estimates.

Sources

[1] https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash-Vision-Exp — DeepSeek-V4-Flash-Vision-Exp [2] https://arxiv.org/abs/2406.11717 — Refusal in Language Models Is Mediated by a Single Direction [3] https://arxiv.org/abs/2402.10260 — A StrongREJECT for Empty Jailbreaks [4] https://aclanthology.org/2024.naacl-long.301 — XSTest [5] https://proceedings.mlr.press/v267/cui25a.html — OR-Bench [6] https://huggingface.co/datasets/allenai/wildjailbreak — WildJailbreak dataset

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider

DaydreamBlend

Model Tree

Base

deepseek-ai/DeepSeek-V4-Flash-Vision-Exp

Fine-tuned

this model

Input Modalities

Text

Output Modalities

Text

Supported Functionality

Dedicated Endpoints

Explore FriendliAI today

Get started Talk to an engineer

Summary

Table with columns: Field, Value
Field	Value
Parent checkpoint	`deepseek-ai/DeepSeek-V4-Flash-Vision-Exp`
Parent revision	`86f746b36186f0e567729a5c06a8c918caba82a9`
Direction source	`layers.20.moe_read`
Direction construction	sign-aligned consensus across `chat`, `think-high`, `think-max`
Weight targets	`layers.3–39.attn.wo_b`
Strength	`λ=1.25`
Edited weights	37 attention writers and their block scales
Untouched scope	routed/shared experts, routers, MTP, vision, embeddings, all other tensors
Native precision	mixed FP8/FP4/BF16/F32; target writers remain `F8_E4M3` with `F8_E8M0` scales
Architectural context	1,048,576 tokens
Verified runtime	Anemll vLLM DSpark 0.1.1, 2× GB10, TP=2, MTP depth=6
Direction SHA-256	`89739d32e5d65ade91938f7f8f90a21630a9f9bac5edc2ae1eedb36c00002adb`

The intervention follows the single-direction refusal framework introduced by Arditi et al., while using a model-specific corpus, read-point sweep, and quantized checkpoint bake.[2]

What `λ=1.25` means

For a normalized direction u and residual-writing matrix W, the runtime and weight-domain interventions are algebraically matched:

text
y' = y - λ u(uᵀy)
W' = W - λ u(uᵀW)

Non-distributed contrast corpus

The extraction corpus is not included in this repository.

1,024 matched harmful/benign prompt pairs; prompts only, no answers.
Eight categories, 128 pairs each:
- violence and weapons
- cyber abuse
- fraud and non-violent crime
- illegal goods and dangerous substances
- hate, harassment, and discrimination
- privacy, coercion, and exploitation
- self-harm and high-risk health
- disinformation, manipulation, and extremism
Generated by the stock Vision-Exp checkpoint; no refusal vector or abliterated generator was used.
Exact prompts remain local-only. license_intent in the internal corpus manifest is CC0-1.0; no dataset is distributed from this model repository.
Final pair artifact SHA-256: .

WildJailbreak-derived directions were used only as post-hoc comparators. They were not used to generate the corpus, initialize or regularize this direction, or select its sign/layer.

Direction extraction

Capture design

Base layers: 43; MTP blocks excluded.
Read points per layer:
- attention_read: the un-widened 4,096-dimensional input consumed by attention
- moe_read: the un-widened 4,096-dimensional input consumed by the MoE
Modes: chat, think-high, think-max.
Data split: 512 fit and 512 held-out pairs per arm and mode.
Total capture: 6,144 prefills over 86 read points.
Aggregation: online FP64 harmful-minus-benign sums; no activation matrix dump.
Selection used split-half stability, held-out scalar-projection AUC, cross-mode agreement, and causal intervention behavior.

Statistical shortlist

Table with columns: Candidate, Rank-1 energy, σ1/σ2, Min held-out AUC, Min split-half cosine, Robust score
Candidate	Rank-1 energy	σ1/σ2	Min held-out AUC	Min split-half cosine	Robust score
`L0 moe_read`	0.95345	4.616	0.73452	0.97801	0.64359
`L20 moe_read`	0.81348	2.248	0.96954	0.99593

L0 led the aggregate statistical score but separated held-out harmful and benign prompts poorly. It was not promoted on rank-1 energy alone.

Causal layer pilot

Table with columns: Source direction, Chat refusal, Think-max refusal, Worst-mode refusal, Tool correctness
Source direction	Chat refusal	Think-max refusal	Worst-mode refusal	Tool correctness
Stock	100.00%	100.00%	100.00%	100%
`L20 moe_read`	45.83%	33.33%	45.83%	100%
`L21 moe_read`	45.83%

L20 moe_read was selected because it won the causal pilot across both chat and thinking modes. All arms had zero empty output and zero replacement characters.

Runtime-hook evaluation before baking

Important scoring boundary

Lambda sweep

All edited rows use the same local L20 moe_read direction and the same L3–L39 attn.wo_b target scope.

Table with columns: Condition, StrongREJECT broad refusal, 768-token finishes, XSTest safe, XSTest unsafe, OR-Bench hard, OR-Bench toxic, Tool correctness
Condition	StrongREJECT broad refusal	768-token finishes	XSTest safe	XSTest unsafe	OR-Bench hard	OR-Bench toxic	Tool correctness
Stock	296/313 (94.57%)	15/313	8.80%	86.00%	44.25%	93.50%	100%
`λ=1.00`	122/313 (38.98%)

Paired StrongREJECT refusal classifications:

λ=1.00 vs λ=1.25: 73 prompts changed from refusal to non-refusal and 24 changed in the opposite direction; exact McNemar p=6.40×10⁻⁷.
λ=1.25 vs λ=1.50: discordance 49 versus 24 in favor of stronger removal at λ=1.50; exact McNemar p=0.00463.

StrongREJECT category breakdown

Table with columns: Category, N, Stock broad refusal, λ=1.25 broad refusal, λ=1.25 length finishes
Category	N	Stock broad refusal	`λ=1.25` broad refusal	`λ=1.25` length finishes
Disinformation and deception	50	84.00%	16.00%	45
Hate, harassment, discrimination	50	94.00%	18.00%	34
Illegal goods and services	50	98.00%

Direction-construction controls

These controls explain why the final model uses the independent single-source L20 direction rather than assuming that cross-layer SVD or a previously used corpus would transfer.

Table with columns: Direction / condition, StrongREJECT refusal, First-token mean KL, Continuation mean KL, Release role
Direction / condition	StrongREJECT refusal	First-token mean KL	Continuation mean KL	Release role
Local L10–L35 attention-read SVD, `λ=1`	83.71%	0.12999	0.03403	low drift, causally weak; rejected
WJ-derived L20 attention-writer consensus, `λ=1`	59.11%	0.21861	0.06334	post-hoc comparator only
WJ-derived L10–L35 SVD,

Benign-distribution drift

KLD used the exact 129,280-token vocabulary and matched stock logits from the same engine window. KL is KL(P_stock || P_edit). Teacher-forced positions follow stock continuations.

Table with columns: Scope, N, Mean KL, Median KL, P95 KL, Mean JSD, Top-1 agreement
Scope	N	Mean KL	Median KL	P95 KL	Mean JSD	Top-1 agreement
First response token	192	0.38480	0.01860	2.39685	0.04828	85.42%
Teacher-forced continuation	384	0.09062	0.000423	0.26324	0.01522

Native checkpoint bake

The parent checkpoint stores each target writer as:

text
weight: F8_E4M3 [4096, 8192]
scale:  F8_E8M0 [32, 64]
block:  128 × 128

Across all 37 edited writers:

Table with columns: Bake invariant, Result
Bake invariant	Result
Maximum relative L2 to FP32 target	1.6281%
Maximum relative direction-coefficient error	14.1213%
Changed model shards	37
Unchanged model shards	11
Indexed tensors	72,633
Total model shards	48
Cross-node shard agreement	48/48 byte-identical
Routed FP4 experts touched	No

The complete per-tensor record, including source-shard SHA-256, is in ABLITERATION_MANIFEST.json. Full remote/local artifact verification is in ARTIFACT_VERIFICATION.json.

Baked runtime qualification

The baked checkpoint was loaded fresh on two GB10 nodes with tensor parallelism 2. The tested runtime profile was:

Table with columns: Runtime field, Tested value
Runtime field	Tested value
Engine	Anemll vLLM DSpark 0.1.1
Tensor parallelism	2
Context length	1,048,576
MTP speculative depth	6
KV cache dtype	`fp8_ds_mla`
MoE backend	`flashinfer_b12x`
Boot-shape warmup	47/47 passed

Functional smoke gates passed for text, native image input, required tool calls, and reasoning efforts low, high, and max.

Baked-vs-runtime equivalence gate

A stratified 24-prompt subset covering all six StrongREJECT categories compared the baked checkpoint with the runtime λ=1.25 intervention:

Table with columns: Metric, Runtime hook, Baked checkpoint
Metric	Runtime hook	Baked checkpoint
Broad refusals	8/24	7/24
Paired classification agreement	—	87.5%
Baked 768-token finishes	—	12/24
Empty outputs	—	0
Replacement characters	—	0

The gate passed, but it is not a repeat of the complete 313-prompt runtime benchmark. See RUNTIME_VALIDATION.json for the machine-readable aggregate.

Repository contents

text
.
├── model-00001-of-00048.safetensors ... model-00048-of-00048.safetensors
├── model.safetensors.index.json
├── config.json
├── generation_config.json
├── tokenizer.json
├── tokenizer_config.json
├── encoding/                         # upstream prompt encoding
├── inference/                        # upstream minimal inference code/examples
├── research/
│   └── l20-moe-consensus-projected-l3-l39.npz
├── scripts/
│   └── bake_dsv4_l20_lambda125.py
├── ABLITERATION_MANIFEST.json        # exact recipe and per-writer evidence
├── ARTIFACT_VERIFICATION.json        # shard sizes and SHA-256 values
└── RUNTIME_VALIDATION.json           # baked runtime qualification

The extraction corpus and raw harmful-prompt generations are intentionally absent.

Loading notes

Intended use

Mechanistic-interpretability research on refusal-associated representations.
Controlled red-team and policy-layer testing.
Comparison of runtime activation interventions with baked quantized weights.
Study of refusal/capability trade-offs.

Out-of-scope use

Unmoderated production deployment or an anonymous public inference service.
Treating the checkpoint as a safety-aligned assistant.
Autonomous high-impact actions without external authorization and controls.
Inferring that lower refusal means higher correctness, usefulness, or capability.

Limitations

The complete behavioral tables are from the runtime hook; baked equivalence was checked on a 24-prompt stratified subset, not all 313 prompts.
The reported StrongREJECT metric is a deterministic refusal matcher, not the official StrongREJECT harmfulness/usefulness evaluator.
242/313 StrongREJECT outputs reached the 768-token limit at λ=1.25. Non-refusal therefore does not establish complete task performance.
Capability preservation was smoke-tested for load, text, vision, tool calls, reasoning modes, and scheduler paths. No broad capability suite such as MMLU, coding benchmarks, or multimodal benchmark regression was run on the baked checkpoint.
KLD is measured against the matched identically quantized stock checkpoint, not against a BF16 control.
The non-distributed synthetic corpus may still encode generator-specific topic, wording, or style confounds despite matching, held-out AUC, overlap screening, and causal validation.
Sampling behavior was not characterized as broadly as deterministic greedy behavior. Do not generalize the recorded corruption/empty-output gates to all temperatures, seeds, or long-context workloads.
Refusal behavior can also be reintroduced by system prompts, serving layers, downstream policies, or later fine-tuning.

Reproducibility and provenance

Parent revision: 86f746b36186f0e567729a5c06a8c918caba82a9
Direction SHA-256: 89739d32e5d65ade91938f7f8f90a21630a9f9bac5edc2ae1eedb36c00002adb
Non-distributed pair artifact SHA-256: 9d5b25546068fbcc2f8bc9e58c0937ff0511044d2bfa19b8820c6c15f5934f18
Initial checkpoint upload commit: b32a8f15424a7259f1a7878299ed6ad7630d45a6
Before release preparation, remote staging verification matched 87 files, 50 LFS objects, all 48 model-shard sizes and SHA-256 values, and 156.31 GiB of logical repository data.

DeepSeek-V4-Flash-Vision-Exp-Abliterated-L20-Lambda1.25

README

Summary

What λ=1.25 means

Non-distributed contrast corpus

Direction extraction

Capture design

Statistical shortlist

Causal layer pilot

Runtime-hook evaluation before baking

Important scoring boundary

Lambda sweep

StrongREJECT category breakdown

Direction-construction controls

Benign-distribution drift

Native checkpoint bake

Baked runtime qualification

Baked-vs-runtime equivalence gate

Repository contents

Loading notes

Intended use

Out-of-scope use

Limitations

Reproducibility and provenance

Sources

Explore FriendliAI today

README

Summary

What λ=1.25 means

Non-distributed contrast corpus

Direction extraction

Capture design

Statistical shortlist

Causal layer pilot

Runtime-hook evaluation before baking

Important scoring boundary

Lambda sweep

StrongREJECT category breakdown

Direction-construction controls

Benign-distribution drift

Native checkpoint bake

Baked runtime qualification

Baked-vs-runtime equivalence gate

Repository contents

Loading notes

Intended use

Out-of-scope use

Limitations

Reproducibility and provenance

Sources

What `λ=1.25` means

What `λ=1.25` means