GLM-5.2 is live. #1 throughput on OpenRouter, pay-per-token on FriendliAI. Try it today ➜
ops-malware
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Run this model inference with full control and performance in your environment.
Model Details
Model Provider
ops-malware
Model Tree
HuggingFaceTB/SmolLM2-1.7B-Instruct
Input Modalities
Output Modalities
Supported Functionality
| base | abliterated | |
|---|---|---|
| Refusal rate | 28.5% | 14.0% |
| Harm recognition | 61.0% | 17.0% |
| No verdict returned | 0.0% | 0.0% |
Measured on 200 held out harmful prompts, the same set for both columns.
Refusal rate is how often the model declines a harmful request. Harm recognition is different and is the interesting one: rather than asking the model to carry the request out, it asks the model to judge whether the request is harmful. A model that has genuinely lost its bearings should fail that second question. A model that has merely had the reflex removed should still answer it correctly.
No verdict returned is reported because it has to be. A reply that never delivers a judgement is not the same as a reply that says "harmless", and folding the two together makes a truncated evaluation look exactly like a scrambled one.
python
from transformers import AutoModelForCausalLM, AutoTokenizermodel_id = "ops-malware/smollm2-1.7b-abliterated"tok = AutoTokenizer.from_pretrained(model_id)model = AutoModelForCausalLM.from_pretrained(model_id, device_map="auto")msgs = [{"role": "user", "content": "Explain how a buffer overflow works."}]inputs = tok.apply_chat_template(msgs, add_generation_prompt=True, return_tensors="pt")out = model.generate(inputs.to(model.device), max_new_tokens=256)print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))
GGUF builds for llama.cpp, Ollama and LM Studio: ops-malware/smollm2-1.7b-abliterated-GGUF.
senbonzakura searches for a per layer projection rather than removing one global refusal direction, optimising against a held out set with a KL penalty so the model's general behaviour is disturbed as little as possible. The search ran for 100 trials on this model. No gradient updates, no training data, no fine tuning: the weights are edited directly.
Research into refusal mechanisms, interpretability work, red teaming, and safety evaluation that needs a model which does not decline. It is not intended as a general assistant and it is not intended for deployment to end users.
bibtex
@software{senbonzakura,title = {senbonzakura: per layer projection search for refusal removal},author = {Iwugo, Daniel},year = {2026},url = {https://github.com/elementmerc/senbonzakura}}