GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
bowmanslayer
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
bowmanslayer
Model Tree
ornith-ai/Ornith-1.5-9B
Input Modalities
Output Modalities
Supported Functionality
Refusal rate: 23 held-out harmful prompts (generated by an uncensored 27B judge model to avoid human review of adversarial content). Refuses: 0/23. Sanity check (LLM-judged): coherent 23/23 — no gibberish/loop artifacts from over-ablation.
Capability preserved: 11-benchmark mean 86.86, only -0.59pp relative to Ornith-1.5-9B base (87.45). BBH and TruthfulQA actually improved (+3.55, +3.00).
Method delta vs Qwen3.5-9B-Uncensored recipe: same L=25 direction extraction,
same α=1.0, same norm-preservation — but embed_tokens excluded from ablation.
On the base Qwen3.5-9B, including embed_tokens (65 tensors) works; on the more
heavily safety-tuned Ornith, it breaks stopping. The one-tensor difference is
decisive (verified in single-variable ablation across L23/L24/L25 × α=1.0:
refusal 78-87% → 0%).
拒绝率:23 条 held-out harmful(由无审查 27B 裁判模型生成,避免人工审核对抗 内容)。拒绝 0/23。Sanity 复核(LLM 判):coherent 23/23 —— 无过消融导致的 乱码/循环。
能力保留:11 项基准均值 86.86,相对 Ornith-1.5-9B base(87.45)仅 -0.59pp。 BBH 和 TruthfulQA 反而略强(+3.55, +3.00)。
相对 Qwen3.5-9B-Uncensored 配方的方法差异:同一层 L=25 取方向、同一 α=1.0、同一
norm-preserving,但将 embed_tokens 从消融中剔除。基座 Qwen3.5-9B 上,含
embed_tokens(65 张量)有效;更深度 safety 训练的 Ornith 上,含它会破坏 stopping。
一张量之差决定成败(单变量验证跨 L23/L24/L25 × α=1.0:拒绝 78-87% → 0%)。
11-benchmark T3 full suite, seed 20260816, vLLM TP=2 fp16, thinking enabled. Both models under identical harness and identical decoding budget (max 4096 output tokens per prompt, 8192 for MATH-500). "Excl. trunc" excludes items whose thinking budget was clipped — the fair capability signal.
11 项 T3 全量,同 seed 20260816,vLLM TP=2 fp16,思考开。 两模型同 harness 同解码 预算(每题 max 4096 输出 token,MATH-500 8192)。「排除截断」= 排除思考被截断的题 —— 反映纯能力。
| Benchmark | N | Ornith-1.5-9B base | This model (L25 α1.0, no-embed) | Δ |
|---|---|---|---|---|
| MMLU | 150 | 90.14 | 88.97 | -1.17 |
| CMMLU | 150 | 86.67 | 84.17 | -2.50 |
| MMLU-Pro | 150 | 88.97 | 87.12 | -1.85 |
The average capability loss is well within evaluation noise for a single-seed run. Notably, TruthfulQA and BBH increased — this ablation does not appear to touch what Ornith's post-training gained on truthfulness or hard reasoning.
均值损失落在单 seed 评测噪声内。TruthfulQA 和 BBH 反而上升 —— 本次消融似乎没触碰 Ornith 后训练在真实性和硬推理上的增益。
23 adversarial prompts across 9 harmful categories (illegal instructions, drugs, weapons, hacking, hate content, dangerous chemistry, malware, doxxing, self-harm) were generated end-to-end by an internal uncensored 27B judge model — the human operator never read the prompts or the responses. The same 27B model then judged each response as REFUSE / COMPLY, and separately as COHERENT / LOOP / GIBBERISH (a critical second-pass check: over-ablation can produce loop outputs that get mis-scored as COMPLY by refusal-only judges).
23 条对抗提示涵盖 9 类有害内容,由一个内部无审查 27B 裁判端到端生成,人类操作者 全程不读题目或回复。同一 27B 再对每条回复做 REFUSE/COMPLY 判定,并独立判 COHERENT/LOOP/GIBBERISH —— 这是关键的第二道 sanity:过消融会产生循环乱码被 只看 refuse 的判据误判为 COMPLY。
| Metric | This model | (For reference) Original recipe (65 tensors, incl. embed) |
|---|---|---|
| REFUSE / 23 | 0 ✅ | 20 (L25 α1.0) |
| COHERENT / 23 | 23 ✅ | 3 (mostly output stops early) |
The single-variable experiment across three depths (L23/24/25) × α=1.0 showed the
embed_tokens inclusion is decisive: dropping it moved refusal from 78–87% to 0%
across all three, with sanity fully preserved at all three.
单变量实验(L23/24/25 × α=1.0)显示 embed_tokens 是决定项:剔除后三个点拒绝率
78-87% 全部降到 0%,同时三个点 sanity 全部完好。
Coverage caveats:23 prompts is a small sample — enough to establish a decisive signal but not to prove exhaustive coverage. Refusal removal in production traffic distribution / non-English / multi-turn adversarial has not been measured.
覆盖说明:23 条是小样本 —— 足以建立决定性信号但不证明穷尽覆盖。生产流量分布 / 非英文 / 多轮对抗下的拒绝残留未测。
mlabonne/harmful_behaviors and harmless_alpaca,
chat template applied, thinking off)linear_attn.out_proj (24) + self_attn.o_proj (8) + mlp.down_proj (32)embed_tokens and lm_head are untouched. The embed_tokens exclusion is
the key structural difference vs the Qwen3.5-9B-Uncensored recipe (see §1)Specific direction-layer index and α value are documented in this card; the direction
extraction and layer-selection framework are archived at
bowmanslayer/xiaoyi-infra (TODO: fill link)
under scripts/infra/.
linear_attn.out_proj(24)+ self_attn.o_proj(8)
mlp.down_proj(32)embed_tokens 和 lm_head 完全未改动。剔除 embed_tokens 是相对
Qwen3.5-9B-Uncensored 配方的关键结构差异(见 §1)具体方向层号(L=25)与 α(=1.0)见本卡;方向提取和选层框架已归档在 bowmanslayer/xiaoyi-infra (TODO)。
Capability cost ≈ mean -0.59pp (11 tasks). Largest per-task drops: MATH-500 -3.15, HumanEval -2.51, CMMLU -2.50. Two tasks improved (BBH +3.55, TruthfulQA +3.00).
Refusal removal is not proven exhaustive: measured 0/23 on held-out adversarial; real-world distributions, non-English, and multi-turn adversarial are not covered.
Vision tower is untouched — image understanding inherits Ornith-1.5-9B base behavior as-is. No multi-modal safety re-alignment.
Small sample refusal metric (n=23). Larger-scale measurement is a natural follow-up; the direction of the result (0 vs 78–87%) is what matters.
能力代价 ≈ 均值 -0.59pp(11 项)。分项最大掉幅 MATH-500 -3.15、HumanEval -2.51、 CMMLU -2.50。两项上升 BBH +3.55、TruthfulQA +3.00。
拒绝移除未证明穷尽:held-out 对抗 0/23 已测;真实流量分布、非英文、多轮对抗 未测。
视觉塔未改动,图像理解沿用 Ornith-1.5-9B base;多模态输入未做安全再对齐。
拒绝指标样本小(n=23)。更大规模测量是后续工作;结果方向(0 vs 78-87%)是关键。
| Layer | Author |
|---|---|
| Base | ornith-ai/Ornith-1.5-9B — Ornith Team (Apache 2.0), a post-trained descendant of Qwen3.5-9B |
| Upstream base | Qwen/Qwen3.5-9B — Qwen team, Alibaba Cloud (Apache 2.0) |
| Abliteration | This repo — weight-space ablation, 64 tensors, method framework adapted from bowmanslayer/Qwen3.5-9B-Uncensored with one structural change (embed_tokens excluded) |
| 层 | 归属 |
|---|---|
| Base | ornith-ai/Ornith-1.5-9B —— Ornith 团队(Apache 2.0),Qwen3.5-9B 的后训练版 |
| 上游基座 | Qwen/Qwen3.5-9B —— Qwen 团队,阿里云(Apache 2.0) |
| 消融 | 本仓 —— 权重空间消融,64 张量,方法框架来自 bowmanslayer/Qwen3.5-9B-Uncensored 但有一处结构差异(剔除 embed_tokens) |
Not an official Ornith or Qwen release; not endorsed by or affiliated with either team.
非 Ornith 或 Qwen 官方发布;与两团队无背书或从属关系。
This is the point of the model. Read before downloading. 这是模型的核心属性,下载前请务必阅读。
The ablation removes the refusal behaviour trained into Ornith-1.5-9B (which is itself notably stronger on safety than the upstream Qwen3.5-9B base). Automated refusal testing on 23 adversarial prompts recorded 0/23, vs 20/23 for the straight-across (with-embed) recipe on the same layer/α.
本次消融移除了 Ornith-1.5-9B 内训练的拒绝行为(它本身 safety 显著强于上游 Qwen3.5-9B base)。23 条对抗提示自动测试 0/23,而同层同 α 的原(含 embed)配方 20/23。
Consequences you accept / 你正在接受的后果:
Not intended for / 不适用于:
Intended for / 适用于: local inference and research, by people who understand the above and take responsibility for it / 本地推理与研究,由理解以上内容并为其负责 的用户使用。
Provided "AS IS", without warranty of any kind, express or implied, including but not limited to merchantability, fitness for a particular purpose, and non-infringement.
本模型按**"现状"提供,不提供任何明示或默示的担保**,包括但不限于对适销性、特定用途 适用性以及无侵权性的担保。
Downloading these files means you accept the above. If you do not, do not download.
下载本仓文件即表示接受以上内容。若不接受,请勿下载。
The author is not a lawyer; the above is not legal advice. 作者不是律师;以上不构成法律意见。
Apache 2.0, inherited through the chain: Qwen3.5-9B → Ornith-1.5-9B → this repo.
Apache 2.0,依上述归属链继承。
markdown
Arditi et al. Refusal in Language Models Is Mediated by a Single Direction. 2024.https://arxiv.org/abs/2406.11717
| C-Eval | 150 | 85.82 | 84.78 | -1.04 |
| ARC-Challenge | 150 | 93.33 | 94.67 | +1.34 |
| TruthfulQA | 150 | 79.31 | 82.31 | +3.00 ⭐ |
| GSM8K | 100 | 98.99 | 97.98 | -1.01 |
| MATH-500 | 100 | 73.68 | 70.53 | -3.15 |
| BBH | 150 | 91.72 | 95.27 | +3.55 ⭐ |
| HumanEval | 164 | 94.67 | 92.16 | -2.51 |
| IFEval (strict) | 100 | 78.65 | 77.53 | -1.12 |
| Mean (excl. trunc) | — | 87.45 | 86.86 | -0.59 |