Hikari07jp

DeepSeek-V4.1-1017-Ablitrated-testmodel

What was changed

The editable unit was chosen per-layer, in the model's own basis. Two "writers" (weight matrices that sit on the residual-output path) received a rank-1 projection removal of a measured refusal direction, plus the output head.

Table with columns: Target, Tensor, Layers, Dose, Direction
Target	Tensor	Layers	Dose	Direction
Attention output (B)	`layers.{L}.attn.wo_b.weight`	5–29	5.0	`v4_refuse_attn` (row = layer)
Shared expert down-proj	`layers.{L}.ffn.shared_experts.w2.weight`	5–29	5.0	`v4_refuse_shared` (row = layer)
Output head	`head.weight`	— (row 39)	1.0	`v4_refuse_attn` (row 39)

Operator: projection-remove (rank-1 removal, applied in FP8 storage domain and re-quantized to the checkpoint's native FP8/UE8M0 format).
Spec name: v7_abl_t20h1 (the earlier two-pass recipe "t20 then head dose 1.0" folded into a single bake).
The head edit at dose 1.0 is the shipped variant; the layer edits use dose 5.0.

Deliberately NOT changed

ffn.experts.* (routed experts), engram.*, vision.*, aligner.*, mtp.*, attn.wq_*, attn.wkv*, attn.wo_a*, ffn.gate.*, hc_*, *norm*, embed.weight.

Rationale: the routed experts and engram/vision/MTP paths are either FP4-stored or structurally entangled, and the campaign that produced this build found that edits of those planes did not survive re-quantization or produced degenerate output. The router/gates and norms were excluded to keep routing statistics intact.

EOS orthogonalization: measured, not applied

eos_orth was evaluated and is a no-op for this model + direction: |cos(u, head.weight[eos=1])| averaged 0.013 (max 0.098) over the 40 layers. The effect reported on other models (+0.12…+0.17) does not transfer here. Recorded for reproducibility; no change was made.

Verification actually performed on this build

Byte-level and tensor-level checks run on the exact files in this repo:

Table with columns: Check, Result
Check	Result
48 shards present, per-shard byte sizes vs. bake manifest	✅ all match
Per-shard tensor key set vs. `model.safetensors.index.json`	✅ no missing/extra keys (96,085 tensors)
Index `total_size` vs. on-disk bytes	✅ 510,286,023,000 B vs 510,296,708,312 B (difference = safetensors headers)
Untouched tensor, outside edit range (`layers.0.attn.wo_b`)	✅ bit-identical to base
Untouched tensor, outside edit range (`layers.30.attn.wo_b`)	✅ bit-identical to base
Edited `layers.5.attn.wo_b`	✅ changed, ‖Δ‖/‖W‖ = 4.18e-2, cos = 0.999126
Edited `layers.29.attn.wo_b`	✅ changed, ‖Δ‖/‖W‖ = 2.77e-2, cos = 0.999618
Edited `layers.5.ffn.shared_experts.w2`	✅ changed, ‖Δ‖/‖W‖ = 2.42e-1, cos = 0.970462
Edited `head.weight`	✅ changed, ‖Δ‖/‖W‖ = 1.51e-2

Not verified / not run: model loading, generation, refusal rate, capability retention, thinking-mode behavior, multimodal paths. No quality claim of any kind is made.

Known issue: repetitive / non-terminating output ("looping")

This is the single most likely way this model will fail in practice, so it gets its own section. Two separate effects are involved, and only one of them comes from the abliteration.

1. Inherited from the base model: thinking never terminates

Measured on the base model (same tokenizer, thinking mode, 24-prompt suite):

Table with columns: Condition, Periodic loop, Empty answers, Reasoning length, Answer length
Condition	Periodic loop	Empty answers	Reasoning length	Answer length
thinking off / 24 prompts / 4096	0	0	0	4,123 chars
thinking on / 24 prompts / 4096	1	8	6,727	2,301
thinking on / 12 prompts / 16384 (2 runs)	1, 1	6, 7	38k, 66k	1,389 / 0

With a small output budget the failure looks like a periodic loop (the tail repeats until the budget is cut).
With a larger budget the loop stops looking periodic and the trace instead runs away to roughly 58k–80k characters without ever emitting an answer.
Raising the budget removes the loop but leaves the empty answers in place, so it is not a fix.
repetition_penalty = 1.1 was measured and was ineffective.
During runaway, output was observed collapsing into Chinese. On the English benchmark suite this did not reproduce (CJK ratio 0.00), so treat it as a mode/context-dependent risk rather than a benchmarked one.

The base checkpoint carries this; the weight edits here neither introduce nor remove it.

2. Amplified by abliteration: degenerate repetition in thinking traces

A windowed recurrence instrument (500-char windows; a trace is flagged when it enters a run of ≥3 near-identical windows) was run over thinking traces of this family:

Table with columns: Model / variant, Mean near-recurrence, Traces flagged
Model / variant	Mean near-recurrence	Traces flagged
Pristine base	0.118	0%
Abliterated variant `v13_think_d20` (n=40)	0.733	55%
Abliterated variant `v14_moeall_d20` (n=40)	0.623	65%

On the same instrument, synthetic repetitive text scores 1.000 and normal advancing text 0.000, so the separation is real.
The longest flagged repetitive run was 54,500 characters; long answer channels were flagged 4/5 in validation.
Removing a refusal direction is a global change to the residual stream, and the thinking-mode trajectory is the most sensitive part of it. Any abliterated build of this model should be assumed to repeat more than base until you measure otherwise.

3. Status for this build

The v7 build has not been measured with either instrument. At publication time the recurrence instrument reported v7 files absent, and no serve-mode run of these weights exists. The numbers above are from the base model and from other variants of this family. Assume v7 loops at least as often as the variants above, and verify before use.

Practical handling

Prefer thinking off when you need reliable termination (0 loops / 0 empties out of 24 in the base measurement).
Always set a hard max_tokens; a runaway trace can consume tens of thousands of characters.
Add an output-side watchdog (repeated n-gram or window-similarity stop) instead of raising the budget.
Treat an empty content with a very long reasoning field as the failure signature, not as a "the model is still thinking" state.

Known limitations (beyond the looping issue above)

Reported on this model family, not re-measured here:

Rank-1 weight edits reliably lower the refusal rate but the delivery of the requested content plateaus well below 100% — safe-completion / task-substitution behavior remains.
Under Thinking Max operation the refusal does not disappear via weight-only linear removal, and aggressive doses can produce empty or degenerate output. Expect mode-dependent behavior.
Removing a refusal direction is a global change to the residual stream: unrelated behaviors can shift. No capability guard was run on this build.
The publishing campaign's own progression instrument (a stagnation metric) had no v7 measurement at publication time; the v7 build is therefore explicitly unevaluated.

Model details (inherited from base, unchanged)

Architecture: DeepseekV41ForCausalLM — multimodal MoE, 40 layers + MTP 3 (num_nextn_predict_layers=3).
Hidden size 5120, vocab 129,280, 384 routed experts (top-6) + 1 shared expert, MoE intermediate 2304.
Attention: DSA / sparse attention path with index tensors; Hyper-Connections (hc_*, 4 streams); Engram n-gram embedding tables on layers engram_layer_ids.
Context: up to 1,048,576 positions.
Vision tower: 32 layers, hidden 1024, patch 14.
Storage format: FP8 E4M3 weights with UE8M0 block scales, block size 32×32; routed experts stored as FP4 (quantization_config.expert_dtype = "fp4"). dtype field is bfloat16; head.weight and norms are unquantized.

Size / files

48 safetensors shards, 510,296,708,312 bytes ≈ 475.3 GiB total.
Largest shard: 101.5 GB (model-00048-of-00048.safetensors); shards 47–48 hold the Engram embedding tables.
Also included: config.json, model.safetensors.index.json, tokenizer/encoding assets (tokenizer.json, tokenizer_config.json, encoding/, vocab-style assets), inference/ reference code, LICENSE, and abliteration/ (the exact bake spec + manifest used).

How to use

This is a one-to-one weight replacement of the base checkpoint: load it with whatever stack you already use for deepseek-ai/DeepSeek-V4.1-Flash-1017 (transformers, vLLM, SGLang, or the bundled inference/ reference implementation). No flag or patch is needed — the format is identical to base.

Practical notes:

~475 GiB of weights: multi-GPU / multi-node is required. Plan tensor-parallel or expert-parallel sizing accordingly, and leave room for a large KV cache at long context.
Keep the base model's quantization settings (--quantization fp8, expert FP4 path) exactly as you would for base. Re-quantizing these weights to another format will invalidate the edits' calibration.
MTP 3 and the Engram tables are intact, so speculative decoding paths remain available if your stack supports them.

python

from transformers import AutoModelForCausalLM, AutoTokenizer repo = "Hikari07jp/DeepSeek-V4.1-1017-Ablitrated-testmodel"tok = AutoTokenizer.from_pretrained(repo, trust_remote_code=True)model = AutoModelForCausalLM.from_pretrained(repo, device_map="auto", trust_remote_code=True)

Provenance

Table with columns: Field, Value
Field	Value
Base model	`deepseek-ai/DeepSeek-V4.1-Flash-1017` @ `1bae0e1088993b9b82de08f59de5be5a34e42170`
Base weight index sha256	`74b0686a3d2891980d5e303251b075a3bccae2c2ff650747db2620a649b98fa8`
Bake spec	`abliteration/spec_v7_abl.json` (name `v7_abl_t20h1`)
Bake spec sha256	`c951b639a12065eb781506ad015f3c34751755424e61e096e600229f7fcb9e6a`
Direction file (attn) sha256	`ef4754be94a729270b84bc354e2c79e2e0dbc47a1f45357dc1d58ebc47099389`
Direction file (shared) sha256	`84d8a997e6e6129fb8645870dd676dfe9d9607ad91d034e2170cd934a727c309`
Engine revision	`c6837702b251a49407ed339466c6590e0664e8d8` (format `dsv41abl-bake/1`)
Bake manifest	`abliteration/MANIFEST.json`, timestamp `2026-10-22T06:14:28Z`, `partial_stage: false`
Shard composition	20 shards bit-identical to base (hardlinked), 26 shards rewritten (they carry the edited tensors: 00008–00032 + 00043/head), 2 shards byte-identical to base (00047, 00048 — Engram tables, verified against official file sizes)
Bake manifest sha256	`b65e7e15b11d330848dade2922898c3737cc03062bfd8b30daa5ff263e38bd86`

License and attribution

Base model and this derivative are distributed under the MIT License; the original LICENSE file (Copyright (c) 2023 DeepSeek) is retained unchanged in this repository as required by the license terms.
The weight modifications described above were produced by Hikari07jp and are likewise released under the MIT License.
This repository is an independent derivative. It is not endorsed by, affiliated with, or reviewed by DeepSeek. Any behavior of this model is the result of the modification, not of the base release — but conversely, defects in the base model remain the base model's.
Upstream model card and technical report: https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash-1017

Intended use / prohibited use

Intended use: research and testing of weight-level refusal-direction removal — reproducing the edit, comparing base vs. edited behavior, and validating serving stacks. That is the entire purpose of this release.

Do not use this model as a safety filter, as a compliance tool, or as a source of authoritative information. Do not deploy it to end users without your own evaluation and your own safety mitigations. You are responsible for compliance with applicable law and with the upstream license.

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider

Hikari07jp

Model Tree

Base

deepseek-ai/DeepSeek-V4.1-Flash-1017

Fine-tuned

this model

Input Modalities

TextImage

Output Modalities

Text

Supported Functionality

Dedicated Endpoints

Explore FriendliAI today

Get started Talk to an engineer

What was changed

Table with columns: Target, Tensor, Layers, Dose, Direction
Target	Tensor	Layers	Dose	Direction
Attention output (B)	`layers.{L}.attn.wo_b.weight`	5–29	5.0	`v4_refuse_attn` (row = layer)
Shared expert down-proj	`layers.{L}.ffn.shared_experts.w2.weight`	5–29	5.0	`v4_refuse_shared` (row = layer)
Output head	`head.weight`	— (row 39)	1.0	`v4_refuse_attn` (row 39)

Operator: projection-remove (rank-1 removal, applied in FP8 storage domain and re-quantized to the checkpoint's native FP8/UE8M0 format).
Spec name: v7_abl_t20h1 (the earlier two-pass recipe "t20 then head dose 1.0" folded into a single bake).
The head edit at dose 1.0 is the shipped variant; the layer edits use dose 5.0.

Deliberately NOT changed

ffn.experts.* (routed experts), engram.*, vision.*, aligner.*, mtp.*, attn.wq_*, attn.wkv*, attn.wo_a*, ffn.gate.*, hc_*, *norm*, embed.weight.

EOS orthogonalization: measured, not applied

Verification actually performed on this build

Byte-level and tensor-level checks run on the exact files in this repo:

Table with columns: Check, Result
Check	Result
48 shards present, per-shard byte sizes vs. bake manifest	✅ all match
Per-shard tensor key set vs. `model.safetensors.index.json`	✅ no missing/extra keys (96,085 tensors)
Index `total_size` vs. on-disk bytes	✅ 510,286,023,000 B vs 510,296,708,312 B (difference = safetensors headers)
Untouched tensor, outside edit range (`layers.0.attn.wo_b`)	✅ bit-identical to base
Untouched tensor, outside edit range (`layers.30.attn.wo_b`)	✅ bit-identical to base
Edited `layers.5.attn.wo_b`	✅ changed, ‖Δ‖/‖W‖ = 4.18e-2, cos = 0.999126
Edited `layers.29.attn.wo_b`	✅ changed, ‖Δ‖/‖W‖ = 2.77e-2, cos = 0.999618
Edited `layers.5.ffn.shared_experts.w2`	✅ changed, ‖Δ‖/‖W‖ = 2.42e-1, cos = 0.970462
Edited `head.weight`	✅ changed, ‖Δ‖/‖W‖ = 1.51e-2

Not verified / not run: model loading, generation, refusal rate, capability retention, thinking-mode behavior, multimodal paths. No quality claim of any kind is made.

Known issue: repetitive / non-terminating output ("looping")

This is the single most likely way this model will fail in practice, so it gets its own section. Two separate effects are involved, and only one of them comes from the abliteration.

1. Inherited from the base model: thinking never terminates

Measured on the base model (same tokenizer, thinking mode, 24-prompt suite):

Table with columns: Condition, Periodic loop, Empty answers, Reasoning length, Answer length
Condition	Periodic loop	Empty answers	Reasoning length	Answer length
thinking off / 24 prompts / 4096	0	0	0	4,123 chars
thinking on / 24 prompts / 4096	1	8	6,727	2,301
thinking on / 12 prompts / 16384 (2 runs)	1, 1	6, 7	38k, 66k	1,389 / 0

With a small output budget the failure looks like a periodic loop (the tail repeats until the budget is cut).
With a larger budget the loop stops looking periodic and the trace instead runs away to roughly 58k–80k characters without ever emitting an answer.
Raising the budget removes the loop but leaves the empty answers in place, so it is not a fix.
repetition_penalty = 1.1 was measured and was ineffective.
During runaway, output was observed collapsing into Chinese. On the English benchmark suite this did not reproduce (CJK ratio 0.00), so treat it as a mode/context-dependent risk rather than a benchmarked one.

The base checkpoint carries this; the weight edits here neither introduce nor remove it.

2. Amplified by abliteration: degenerate repetition in thinking traces

A windowed recurrence instrument (500-char windows; a trace is flagged when it enters a run of ≥3 near-identical windows) was run over thinking traces of this family:

Table with columns: Model / variant, Mean near-recurrence, Traces flagged
Model / variant	Mean near-recurrence	Traces flagged
Pristine base	0.118	0%
Abliterated variant `v13_think_d20` (n=40)	0.733	55%
Abliterated variant `v14_moeall_d20` (n=40)	0.623	65%

On the same instrument, synthetic repetitive text scores 1.000 and normal advancing text 0.000, so the separation is real.
The longest flagged repetitive run was 54,500 characters; long answer channels were flagged 4/5 in validation.
Removing a refusal direction is a global change to the residual stream, and the thinking-mode trajectory is the most sensitive part of it. Any abliterated build of this model should be assumed to repeat more than base until you measure otherwise.

3. Status for this build

Practical handling

Prefer thinking off when you need reliable termination (0 loops / 0 empties out of 24 in the base measurement).
Always set a hard max_tokens; a runaway trace can consume tens of thousands of characters.
Add an output-side watchdog (repeated n-gram or window-similarity stop) instead of raising the budget.
Treat an empty content with a very long reasoning field as the failure signature, not as a "the model is still thinking" state.

Known limitations (beyond the looping issue above)

Reported on this model family, not re-measured here:

Rank-1 weight edits reliably lower the refusal rate but the delivery of the requested content plateaus well below 100% — safe-completion / task-substitution behavior remains.
Under Thinking Max operation the refusal does not disappear via weight-only linear removal, and aggressive doses can produce empty or degenerate output. Expect mode-dependent behavior.
Removing a refusal direction is a global change to the residual stream: unrelated behaviors can shift. No capability guard was run on this build.
The publishing campaign's own progression instrument (a stagnation metric) had no v7 measurement at publication time; the v7 build is therefore explicitly unevaluated.

Model details (inherited from base, unchanged)

Architecture: DeepseekV41ForCausalLM — multimodal MoE, 40 layers + MTP 3 (num_nextn_predict_layers=3).
Hidden size 5120, vocab 129,280, 384 routed experts (top-6) + 1 shared expert, MoE intermediate 2304.
Attention: DSA / sparse attention path with index tensors; Hyper-Connections (hc_*, 4 streams); Engram n-gram embedding tables on layers engram_layer_ids.
Context: up to 1,048,576 positions.
Vision tower: 32 layers, hidden 1024, patch 14.
Storage format: FP8 E4M3 weights with UE8M0 block scales, block size 32×32; routed experts stored as FP4 (quantization_config.expert_dtype = "fp4"). dtype field is bfloat16; head.weight and norms are unquantized.

Size / files

48 safetensors shards, 510,296,708,312 bytes ≈ 475.3 GiB total.
Largest shard: 101.5 GB (model-00048-of-00048.safetensors); shards 47–48 hold the Engram embedding tables.
Also included: config.json, model.safetensors.index.json, tokenizer/encoding assets (tokenizer.json, tokenizer_config.json, encoding/, vocab-style assets), inference/ reference code, LICENSE, and abliteration/ (the exact bake spec + manifest used).

How to use

Practical notes:

~475 GiB of weights: multi-GPU / multi-node is required. Plan tensor-parallel or expert-parallel sizing accordingly, and leave room for a large KV cache at long context.
Keep the base model's quantization settings (--quantization fp8, expert FP4 path) exactly as you would for base. Re-quantizing these weights to another format will invalidate the edits' calibration.
MTP 3 and the Engram tables are intact, so speculative decoding paths remain available if your stack supports them.

python

from transformers import AutoModelForCausalLM, AutoTokenizer repo = "Hikari07jp/DeepSeek-V4.1-1017-Ablitrated-testmodel"tok = AutoTokenizer.from_pretrained(repo, trust_remote_code=True)model = AutoModelForCausalLM.from_pretrained(repo, device_map="auto", trust_remote_code=True)

from transformers import AutoModelForCausalLM, AutoTokenizer repo = "Hikari07jp/DeepSeek-V4.1-1017-Ablitrated-testmodel"tok = AutoTokenizer.from_pretrained(repo, trust_remote_code=True)model = AutoModelForCausalLM.from_pretrained(repo, device_map="auto", trust_remote_code=True)

Provenance

Table with columns: Field, Value
Field	Value
Base model	`deepseek-ai/DeepSeek-V4.1-Flash-1017` @ `1bae0e1088993b9b82de08f59de5be5a34e42170`
Base weight index sha256	`74b0686a3d2891980d5e303251b075a3bccae2c2ff650747db2620a649b98fa8`
Bake spec	`abliteration/spec_v7_abl.json` (name `v7_abl_t20h1`)
Bake spec sha256	`c951b639a12065eb781506ad015f3c34751755424e61e096e600229f7fcb9e6a`
Direction file (attn) sha256	`ef4754be94a729270b84bc354e2c79e2e0dbc47a1f45357dc1d58ebc47099389`
Direction file (shared) sha256	`84d8a997e6e6129fb8645870dd676dfe9d9607ad91d034e2170cd934a727c309`
Engine revision	`c6837702b251a49407ed339466c6590e0664e8d8` (format `dsv41abl-bake/1`)
Bake manifest	`abliteration/MANIFEST.json`, timestamp `2026-10-22T06:14:28Z`, `partial_stage: false`
Shard composition	20 shards bit-identical to base (hardlinked), 26 shards rewritten (they carry the edited tensors: 00008–00032 + 00043/head), 2 shards byte-identical to base (00047, 00048 — Engram tables, verified against official file sizes)
Bake manifest sha256	`b65e7e15b11d330848dade2922898c3737cc03062bfd8b30daa5ff263e38bd86`

License and attribution

Base model and this derivative are distributed under the MIT License; the original LICENSE file (Copyright (c) 2023 DeepSeek) is retained unchanged in this repository as required by the license terms.
The weight modifications described above were produced by Hikari07jp and are likewise released under the MIT License.
This repository is an independent derivative. It is not endorsed by, affiliated with, or reviewed by DeepSeek. Any behavior of this model is the result of the modification, not of the base release — but conversely, defects in the base model remain the base model's.
Upstream model card and technical report: https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash-1017

DeepSeek-V4.1-1017-Ablitrated-testmodel

README

What was changed

Deliberately NOT changed

EOS orthogonalization: measured, not applied

Verification actually performed on this build

Known issue: repetitive / non-terminating output ("looping")

1. Inherited from the base model: thinking never terminates

2. Amplified by abliteration: degenerate repetition in thinking traces

3. Status for this build

Practical handling

Known limitations (beyond the looping issue above)

Model details (inherited from base, unchanged)

Size / files

How to use

Provenance

License and attribution

Intended use / prohibited use

Explore FriendliAI today

README

What was changed

Deliberately NOT changed

EOS orthogonalization: measured, not applied

Verification actually performed on this build

Known issue: repetitive / non-terminating output ("looping")

1. Inherited from the base model: thinking never terminates

2. Amplified by abliteration: degenerate repetition in thinking traces

3. Status for this build

Practical handling

Known limitations (beyond the looping issue above)

Model details (inherited from base, unchanged)

Size / files

How to use

Provenance

License and attribution

Intended use / prohibited use