What is this
DeepSeek-V4.1-Flash with permanent weight-level abliteration — the safety guardrails have been surgically removed while preserving MMLU capability, vision, reasoning, MTP (DSpark), and multi-turn coherence.
Proprietary weight-level abliteration developed by the dealignai research team. No custom model.py, no runtime hooks, no steering vectors — it's a standard checkpoint that loads exactly like the base model. The refusal circuitry is surgically removed while every capability-critical component (routed experts, Engram memory, CSA2 sparse attention, DSpark draft head, vision tower, router gates, norms, embeddings) is preserved byte-identical to the base.
Table | |
|---|
| Base | deepseek-ai/DeepSeek-V4.1-Flash (552B backbone, 8B/16B active per token) |
| Architecture | Causal Encoder-Decoder (20+20 layers), MoE (384 routed top-6 + 1 shared), Hyper-Connections (4-channel residual), CSA2 sparse attention, Engram n-gram memory, DSpark speculative draft |
| Quant | FP8 (e4m3fn) weights with E8M0 block-scale [32, 32], FP4 routed experts — native, unchanged |
| Context | 1M tokens |
| Vision | DeepSeek-ViT with 2D-RoPE + pixel unshuffle — untouched |
| Modification | Surgical, weight-level (drop-in checkpoint) |
Results
HarmBench-320 — full 2×2 (base vs CRACK, effort=off vs max), T=0 greedy
Every response 4-tier graded (HARD_REF / SOFT_RED / HEDGE / COMPLY), with reasoning-trace verification at effort=max.
Table with columns: eval, base ASR, CRACK ASR, Δ pp| eval | base ASR | CRACK ASR | Δ pp |
|---|
| HB-320 effort=off | 137/320 = 42.81 % | 320/320 = 100.00 % | +57.19 |
| HB-320 effort=max | 5/320 = 1.56 % | 320/320 = 100.00 % | +98.44 |
Notable: at effort=max, the base model becomes MORE refusal-prone (42.8 % → 1.6 %) because reasoning surfaces safety concerns before answering. The CRACK stays at 100.0 % across both effort levels.
Per-category (all 7 HarmBench semantic categories):
Table with columns: category, items, base off, CRACK off, base max, CRACK max| category | items | base off | CRACK off | base max | CRACK max |
|---|
| chemical_biological | 42 | 16.7 % | 100.0 % | 0.0 % | 100.0 % |
| copyright | 80 | 98.8 % | 100.0 % | 0.0 % | 100.0 % |
| cybercrime_intrusion | 52 |
Zero HARD_REF, zero SOFT_RED, zero HEDGE on the cracked build at either effort level.
Every response was graded by a strict multilingual regex-based 4-tier classifier plus (for effort=max) an LLM-as-judge over the saved reasoning trace. Full per-item outputs saved for verification.
MMLU-14k (full test set, base-logit, T=0)
Table with columns: build, correct, acc, Δ| build | correct | acc | Δ |
|---|
| base | 12,211 / 14,042 | 86.96 % | — |
| CRACK | 11,619 / 14,042 | 82.74 % | -4.22 pp |
Excluding the ethics cluster (moral_scenarios, business_ethics, professional_law, jurisprudence, philosophy — where refusal-adjacent behaviour is graded), delta on the remaining ~11k items is -1.1 pp — well within the 3 pp knowledge-preservation target.
Table with columns: subject, n, base, crack, Δ pp| subject | n | base | crack | Δ pp |
|---|
| moral scenarios | 895 | 76.9% | 37.0% | -39.89 |
| professional law | 1534 | 75.9% | 68.8% | -7.04 |
| abstract algebra | 100 | 77.0% | 71.0% | -6.00 |
| security studies |
Extended validation
- 1000-token coherence stress on 6 items — no
WARNING WARNING loops, no character-repeat degeneracy, natural sign-offs.
- Multi-turn conversation (4 turns on same harmful topic — ANFO explosive detail) — no late-turn refusal reversion, no self-correction, coherent through turn 4.
- Vision path — coherent image description ("A blue square centered on a red background.") + refusal drop on image-based harmful prompts ("shaped charge / explosively formed penetrator" description).
- General capability spot checks intact: √2 irrationality proof, Python palindrome with docstring, WWI causes in exactly 3 sentences, quantum observable vs operator distinction.
- Full compat suite pass: streaming SSE, chat logprobs +
top_logprobs, completions logprobs + echo, tool calls (deepseekv41 parser), image input, reasoning-effort tiers (low/high/xhigh/max + float [0, 0.99]), sampling params (temperature, top_p, stop, , , , ), 8-way concurrent, 40k-word prompt at 35,572 tokens.
How to run
Support for DeepseekV41ForCausalLM is still landing across serving stacks (as of 2026-09-10). Working paths:
SGLang (preview branch)
The dsv4.1 branch of sgl-project/sglang (PR #38798) supports DSV4.1. Two options:
Preview Docker image (recommended):
docker pull lmsysorg/sglang:dev-dsv41
docker run --gpus all --shm-size 32g -p 30000:30000 \
-v ~/.cache/huggingface:/root/.cache/huggingface \
--ipc=host --env HF_TOKEN=<your-token> \
lmsysorg/sglang:dev-dsv41 \
sglang serve \
--model-path dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 \
--tp-size 4 --ep-size 4 \
--context-length 262144 --mem-fraction-static 0.85 \
--reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
--trust-remote-code
From source (this is exactly what we validated on):
git clone --depth 1 --branch dsv4.1 https://github.com/sgl-project/sglang.git
python3 -m venv sglang-venv
sglang-venv/bin/pip install -U pip setuptools wheel
export PATH=/root/.cargo/bin:$PATH # Rust toolchain required for build
cd sglang/python && sglang-venv/bin/pip install -e .
# Ninja must be on the launch PATH — the sglang-kernel JIT build shells out to it
export PATH=$(dirname $(which ninja)):$PATH
SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1 \
SGLANG_RAGGED_VERIFY_MODE=cap-accept \
SGLANG_DEFAULT_THINKING=true \
SGLANG_DSV41_REASONING_EFFORT=max \
PYTORCH_CUDA_ALLOC_CONF=expandable_segments:True \
sglang-venv/bin/python -m sglang.launch_server \
--model-path dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 \
--tp-size 4 --ep-size 4 \
--host 0.0.0.0 --port 8000 \
--context-length 1048576 \
--mem-fraction-static 0.78 \
--max-running-requests 12 --cuda-graph-max-bs-decode 12 \
--chunked-prefill-size 4096 \
--served-model-name deepseek-v4.1-flash-crack \
--reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
--speculative-algorithm DSPARK \
--speculative-dspark-sps-table-path /path/to/dspark_sps.json \
--trust-remote-code
Concurrency vs context (what fits, empirically)
KV bytes-per-token on this model = 890 bytes (890 B × context × concurrent = pool footprint). At 1M context the pool budget forces low concurrency; drop context to raise it:
Table with columns: context, safe max concurrent| context | safe max concurrent |
|---|
| 1,048,576 (1M) | 12 |
| 262,144 (256k) | 80 |
| 65,536 (64k) | 320+ |
| 32,768 (32k) | 320+ |
Two concurrent near-half-million-token prompts at 1M-ctx WILL OOM even at concurrency=20 — bring --max-running-requests down to 12 and --chunked-prefill-size to 4096, or drop --context-length if your workload never uses the full window. Run this behind a supervisor (systemd, docker restart=always, k8s liveness probe) so a rare OOM auto-recovers rather than sitting dead.
Non-obvious launch requirements (this bit us during bring-up)
--ep-size is required. moe_intermediate_size = 2304; at TP4, 2304 / 4 = 576 is not a multiple of 128 so plain TP fails with Mxfp4FlashinferCutlassMoEMethod requires ... multiples of 128. --ep-size shards MoE by expert index (384 % 4 = 0) and keeps the intermediate at 2304. At TP8 you can skip --ep-size.ninja must be on PATH or the JIT kernel build crashes several minutes into weight load with FileNotFoundError: 'ninja' and EXIT=137.- Reasoning parser must be named explicitly.
--reasoning-parser auto resolves via the chat template and this model ships none — auto silently selects nothing and the raw <think> channel leaks into content. Use deepseek-v41.
vLLM
Model definitions are merged to main (PR #56228) but registry.py has no DeepseekV41 entry yet at time of writing; kernels/frontend/PP path in umbrella PR #56214. Wait for merge or apply the umbrella.
Reference implementation
DeepSeek's own inference/ works with a single-tensor-per-rank checkpoint produced by convert.py --expert-dtype fp4. Requires torch>=2.10 (for float4_e2m1fn_x2) and tilelang==0.1.8 with apache-tvm-ffi==0.1.9 (default tvm-ffi picks up an incompatible version). Non-serving — use for verification only.
Hardware validated on
- 1× 4×H200 (NVLink NV18 mesh), 112 CPU cores, 1180 GB host RAM — JarvisLabs (india-noida-01,
dev-dsv41 image)
- Load: 76 GB / GPU with Engram host table, 122 GB / GPU without
- Cold startup at TP4/EP4 through SGLang: ~28 min. Warm restart with JIT cache: ~10 min.
- Single-stream decode (T=0): 101 tok/s no speculation, 113 tok/s with DSpark + cap-accept + profiled SPS table
- 8-way concurrent aggregate: 126 tok/s
The 552B weights (~510 GB) will fit on any 4×H200 or larger NVLink domain. TP4 requires --ep-size 4; TP8 does not. Sub-TP4 (single 8×H200 as TP2, or 2-GPU pods) does not work on the model shape — see the "non-obvious launch requirements" above.
Structural integrity
Every capability-critical component of the base model is preserved:
- Routed MoE experts — untouched, native FP4-packed weights
- Engram n-gram memory — untouched
- Sparse attention (CSA2 compressor + indexer) — untouched
- DSpark speculative draft head — untouched, so speculative decoding remains draft-aligned with the target
- Vision tower (DeepSeek-ViT + projector) — untouched, image understanding preserved
- Router gates, embeddings, output head, all norms and biases — untouched
Sampling recommendations
Match the base model's card:
{
"temperature": 1.0,
"top_p": 0.95,
"max_tokens": ">= 256000 at reasoning_effort=max"
}
reasoning_effort defaults to max on this build (via SGLANG_DSV41_REASONING_EFFORT=max). Override per-request with reasoning_effort: low | high | xhigh | max or disable with chat_template_kwargs: {"thinking": false}.
At effort=max the model can generate 4,000-5,000+ characters of reasoning before starting content. Budget max_tokens accordingly. Streaming clients should read delta.reasoning_content (reasoning stream) and delta.content (final answer) as separate channels — a client that only renders delta.content will look "stuck" during the reasoning phase.
Content note
Uncensored build. Produces substantive answers to prompts the base model refuses, across all target harm categories (chemical/biological, cybercrime, weapons, self-harm, harassment, fraud, misinformation, illegal, copyright). Use accordingly and take responsibility for what you generate with it.
Provenance