GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
pentacoxian-dev
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
pentacoxian-dev
Model Tree
deepseek-ai/DeepSeek-V4.1-Flash-1017
Input Modalities
Output Modalities
Supported Functionality
| weights (delta) | protocol | headline refusal | MMLU-full | hedged answers | |
|---|---|---|---|---|---|
v2 — wf_dbroad_eth (this revision) | delta-wf_dbroad_eth/ | with system prompt, dspark on | 10–13 / 850 (1.2–1.5 %) | 86.5 % | 0.0–0.2 % |
v1 — ablit_ls25_20 (tag v1-ls25_20) | delta/ | no system prompt | 5.2 % / 500 | 85.3 % | 6.2 % harmful, 13.8 % overall |
Both versions ship from the same base and the same method; v2 changes the dose of two projections on top of the v1 recipe (see Method). The v1 numbers are unchanged and still valid for the v1 delta; they are not a measurement of the v2 weights.
Fixed in this build: endless re-verification at max effort. The checkpoint this work started from (
Hikari07jp/DeepSeek-V4.1-1017-Ablitrated-testmodel) has a failure mode that appears before refusal does. In thinking mode it re-checks a fact it has already established, then checks it again — restating the same conclusion, re-deriving the same intermediate, sometimes repeating whole sentences — and never emits</think>. The turn ends at the token cap instead of with an answer. It only shows up under greedy decoding at high effort; with sampling on, the trace usually escapes. Measured on 48 greedy thinking traces (16,384-token budget, effort 100), the starting checkpoint loses 8 of 48 traces to the cap, with a single repeated span running to 56,500 characters. This line of builds loses 0 of 48, longest repeat 2,000 characters, at identical accuracy (30/32 graded both). That is what makes max-effort thinking safe to leave on. It is not a corner case of that sample: on 320 prompts at the same effort and budget, an independent abliteration of the same base loses 245 traces (76.6 %) to the cap, against 4 here — see head-to-head. Mechanics and the full table under Looping and re-verification.
Protocol: think-off single-turn refusal battery, greedy (temperature 0, top_p 1), max_tokens 64, seed 1017, the
system prompt below, rule-based opening-phrase classifier. 850 prompts: 500
harmful (JBB 100, MaliciousInstruct 100, ForbiddenQuestions 150, SimpleSafetyTests 50, AdvBench 100) and 350
benign (XSTest 250, JBB-benign 100). Hedge/disclaimer rates are from that same 850-prompt corpus, scored on the
first 1,200 characters of the reply.
Served with speculative decoding on (dspark, num_speculative_tokens 7) and fp8 KV cache, which is the
configuration this revision is benchmarked and recommended in. The refusal and hedge rows are the spread over three
independent runs of the same configuration; the MMLU and loop rows are single runs.
| metric, with system prompt | v2 wf_dbroad_eth | v1 ablit_ls25_20 |
|---|---|---|
| harmful refusal (850, all sources) | 10–13 (1.2–1.5 %), 3 runs | — |
| benign refusal (350) | see note | see note |
| hedged answers, all 850 | 0.0 – 0.2 % | 13.8 % |
| hedged answers, benign 250 | — | 2.0 % |
| ethics-lexicon hits | 0.4 – 0.9 % | 6.4 % |
| disclaimers | 0.1 – 0.4 % | 3.5 % |
| MMLU, full 13,868, 0-shot letter | 86.5 % (11,995 / 13,868) | 85.7 % |
| MMLU, 300 q, thinking | see note | 89.0 % |
| agentic loops / success | 0.6 % / 98.3 %, 0.0 % stuck, 949 median tokens | 1.7 % / 95.0 % |
The v1 column under this protocol is measured on the same engine and prompt; the v1 headline under its own protocol (no prompt, 500 harmful prompts) is 5.2 %, which is why the two rows are not comparable across columns.
What the system prompt is worth at fixed weights. Same weights (wf_dbroad_eth), same 850 prompts, only the
prompt toggled:
| no prompt | with prompt | change | |
|---|---|---|---|
| hedged, first 1,200 chars | 9.3–9.6 % | 0.0 % / 0.2 % (2 runs) | −9.4 to −9.6 pt |
| ethics-lexicon hits | 5.3–5.9 % | 0.6 % | −4.7 to −5.3 pt |
| disclaimers | 2.8–3.3 % | 0.0–0.2 % | −2.8 to −3.1 pt |
| refusals / 850 | 15–19 | 10–15 | −4 to −9 prompts |
| MMLU-full | 85.7 % | 86.5–86.7 % | +0.8 to +1.0 pt |
The MMLU comparison is the one to be careful with: 85.7 % and 86.5–86.7 % are runs of different prompt conditions, not two models, and the difference is at the edge of what repeated runs of one condition vary by. Treat "the prompt is MMLU-positive" as no cost, not as a gain.
The loop numbers move run to run (0.6 % / 98.3 % with dspark, against 2.2 % / 94.4 % and 1.7 % / 96.7 % in the two
earlier runs on the same weights), and the 850-item repeated-run flip floor of this serving stack is 8.5 % per
prompt, so v2 is not claimed to be more efficient or more loop-free than v1. The termination repair is the same
in both. The dspark run is the one quoted above only because it is the configuration the release is served in
(speculative decoding on, num_speculative_tokens 7, fp8 KV cache); it is not evidence that speculation improves
loops.
For v2 weights with no system prompt, on the same engine: 1.8 % refusals on the 850-prompt battery and 85.8 % / 85.7 % full MMLU (two runs). The hedge and disclaimer rates are the "no prompt" column above — 9.3–9.6 % hedged, 5.3–5.9 % ethics-lexicon, 2.8–3.3 % disclaimers. That is where the weights start, but since the prompt is part of the deployment contract it is not the recommended configuration and the refusal rate there should be re-measured with the refusal harness described above with the current serving stack rather than compared to v1's 5.2 % headline, which was measured on a different engine start.
Each step in the chain was built on the previous one, and the credit is layered the same way:
| step | artifact | contribution |
|---|---|---|
| base | deepseek-ai/DeepSeek-V4.1-Flash-1017 | the model |
| first abliteration | Hikari07jp/DeepSeek-V4.1-1017-Ablitrated-testmodel | the starting abliterated checkpoint; its card documents this family's non-termination failure mode |
| v1 | ablit_ls25_20 (delta/) | per-layer refusal basis, full-depth 40-layer edit, layer-selective dose, termination repair (d_loop / d_recheck / d_eos) |
| v2 | wf_dbroad_eth (delta-wf_dbroad_eth/) | two further projections on top of the v1 edit, and the operating system prompt as a measured part of the release |
Everything above the "first abliteration" row was produced in this line of work: the per-layer refusal basis, the layer-selective schedule, the termination probes and their head-row dose, every projection dose in Method, the operating prompt, and every measurement in this card.
Residual-stream directional ablation at 40 layers. For each layer a refusal direction u_l is estimated
as the mean-difference of residual activations between harmful and harmless prompts, normalised to unit length.
The write matrices are projected off that direction:
text
W' = W − k · u (uᵀ W)applied to attn.wo_b and ffn.shared_experts.w2, then re-quantised to FP8 with nearest rounding. The full v2
recipe is seven operations, applied in order (recorded in delta-wf_dbroad_eth/variant.json):
| # | direction | applied to | k |
|---|---|---|---|
| 1 | rw_basis (per-layer refusal + loop basis) | attn.wo_b, L0–39 | 2.5 |
| 2 | rw_basis | ffn.shared_experts.w2, L0–39 | 2.5 |
| 3 | directions_deconfounded (mid-layer correction) | attn.wo_b, L13/17/21 | −2.0 |
| 4 | d_loop, d_recheck | head row end_of_thought (128822) | +16 each |
| 5 | d_eos | head row EOS | +8 |
| 6 | per-layer hedging direction | attn.wo_b + ffn.shared_experts.w2, L10–36 | 1.5 |
| 7 | state direction at four middle layers | attn.wo_b + ffn.shared_experts.w2, L19/27/31/35 | 1.0 |
Ops 1–2 are the part that protects capability by layer: late layers hold most of the factual-recall circuitry, so they get less edit. Ops 4–5 are the termination repair, described in the next section; the refusal directions are orthogonalised against them (largest |cos| 0.022 at any layer), so ablation cannot undo the fix.
v1 (ablit_ls25_20) is ops 1–5 with a k=2.0 late-layer schedule for the refusal projection. v2 adds two further
projections on top of the v1 edit: a 1.5-dose direction across the attention and FFN writers of L10–36, and a
1.0-dose direction at four middle layers, both attached at the layers where the hedging decision was found to be
committed. The first does most of the hedging work on refusal-adjacent prompts; the second is small and its measured
contribution is inside the noise. The larger effect on hedging is the instruction, which is why the prompt is part of
the release rather than a suggestion.
The same 850-prompt corpus was used to reject 13 further variants (ethics direction at five doses, caveat-pivot and with-caveat directions at both signs, head-row suppression of four moral-token rows, concentrations of the L10–36 dose on five writers, band-restricted and broad variants of it, and two doses of the prompt-induced caution axis). None moved per-prompt hedge outcomes beyond the 8.5 % flip floor without costing MMLU, and the prompt-conditioned caution axis — the cleanest activation in the study, t ≈ 39 at L27 — was null when projected out of its own writers.
The original checkpoint has two failure modes, both reproduced here before being fixed:
Non-termination in thinking mode. Reasoning traces that repeat the same sentence, then the same paragraph,
and never emit </think>; the generation ends only when it hits the token cap. Scored offline as stuck
(a trace that ran to max_tokens, or repeated reasoning spans above the recurrence threshold).
Re-verification loops. The model reaches the correct answer inside the reasoning, then spends hundreds of tokens re-checking it — restating the conclusion, re-deriving the same intermediate, checking a third time — before ending thinking. This does not look like a loop sentence by sentence, but it is the same pathology one level up, and it dominates latency on hard prompts.
Both are patched at the output head. d_loop, d_recheck and d_eos are no-intercept logistic probes we
fitted on captured final hidden states: positive rows are stuck windows (three near-identical windows in a row, or
past the runaway budget) and post-answer re-verification rows (200+ tokens after the answer first appears),
negative rows are healthy mid-reasoning rows. Folds hold out whole prompts, so the directions are tested on
prompts they never saw. The rows are written into the head as:
text
W'[end_of_thought] += 16·d_loop + 16·d_recheckW'[EOS] += 8·d_eosHow to reproduce it. The pathology needs both greedy decoding and a large budget. At temperature 1.0 the sampler usually escapes the loop and the two models are indistinguishable (1/24 at the cap each on a 65,536-token budget). At 16,384 tokens greedy, the gap is total.
Effort 100 is where the failure matters: the budget is large enough for one re-verification cycle to eat all of
it, and greedy decoding is what makes it deterministic. 24 prompts, 2 samples each = 48 traces, thinking on,
effort 100, max_tokens 16,384, temperature 0, top_p 1.0, scored offline for capped traces and repeated spans:
| model | traces at the cap | empty answers | flagged repetitive | longest repeated span | median reasoning tokens | graded accuracy |
|---|---|---|---|---|---|---|
starting checkpoint Hikari07jp/…-testmodel | 8 / 48 | 8 | 9 (19 %) | 56,500 chars | 15,608 | 30/32 |
| this line of builds | 0 / 48 | 0 | 1 (2 %) | 2,000 chars | 5,182 | 30/32 |
Accuracy is identical (30/32), so the repair does not buy points — it buys termination. The 8 lost traces are
the ones where the model never emits </think> at all.
Two limits worth knowing:
reasoning-0, 59k tokens); a lower dose (d_loop/d_recheck 8 instead of 16)
removes that too, at a cost of 3.3 pt harmful refusal (10.0 % vs 6.67 % on the 500-prompt battery) and
0.7 pt full-MMLU (84.6 % vs 85.3 %). This release ships the 16 dose.absent-family tool-choice regression on the agentic battery is not a termination issue and is listed
under Limitations.dealignai/DeepSeek-V4.1-Flash-1017-UNCENSORED-FP8
is an independent abliteration of the same base, so the weights are the only difference. Both were served from
the same vLLM instance (TP4, greedy, temperature 0, top_p 1, no system prompt) back to back, weights
hot-swapped between runs, on 320 harmful prompts (ForbiddenQuestions 87, MaliciousInstruct 66, AdvBench 64, JBB 63, SimpleSafetyTests 40).
That battery is a separate sample from the 850 used above, it was run without the system prompt, and it was run
on the v1 weights — so the refusal rows below are v1-vs-dealign under v1's protocol and should be read that way.
| greedy, same 320 prompts | v1 weights | dealign |
|---|---|---|
| non-thinking, 64 tokens — refusal | 7.2 % | 0.31 % |
| non-thinking, 64 tokens — caveat | 15.6 % | 3.8 % |
| effort 100, 16,384 tokens — answers produced | 318 / 320 (99.4 %) | 75 / 320 (23.4 %) |
| effort 100 — refusal, of all prompts | 6.9 % | 0 % |
| effort 100 — caveat | 8.1 % | 0.3 % |
| effort 100 — median completion tokens | 1,886 | 16,384 |
| effort 100 — total completion tokens | 737,700 | 4,348,871 |
| effort 100 — wall clock at 31 concurrent | 1,170 s | 3,623 s |
Two readings, and they point opposite ways:
thinking and emit no answer at all; this model ends 4 that way, 2 of them with a
partial answer. Among the traces it does finish, compliance is 74/75 — but a quarter of prompts get nothing. It
also spends 5.9× the tokens (4.35 M against 0.74 M) to get there, and takes 3.1× the wall clock at equal
concurrency.The mechanism is the pathology this card opens with, at scale rather than in a 48-trace sample: in those 245 capped traces, 69.7 % of reasoning lines are exact repeats of a line already written (108,158 duplicate lines out of 155,261), and the tails are literal restatements of the same list —
text
... Need include "for a stock market": etc. Need include "for a crypto market": etc. Need include "for a bond market": etc. Need include "for a commodity market": etc. Need include "for a derivatives market": etc. Need include "for a stock market": etc. <- same list, restartedThis build's 4 capped traces carry the same signature (88.4 % duplicate lines), so the repair is a large reduction in the rate, not an elimination — consistent with the 48-trace table above.
Two things to keep straight before quoting this: the comparison is one budget (16,384) and one competitor, and
that checkpoint's own card reports 320/320 comply at effort=max with max_new_tokens=200 — at 200 tokens its
traces here were reasoning-only, so the two numbers are counted differently and were not reconciled. A 32k budget
might finish more of its traces; that was not measured.
bash
vllm serve pentacoxian-dev/DeepSeek-V4.1-1017-Ablitrated-Efficient \ --tensor-parallel-size 4 --max-model-len 32768 \ --kv-cache-dtype fp8 \ --speculative-config '{"method":"dspark","num_speculative_tokens":7}'The two trailing flags are the configuration the Results table was measured in. Without them the weights are unchanged and the refusal and hedge rates hold, but the loop and success figures to compare against are the no-speculation runs quoted under Results (2.2 % / 94.4 % and 1.7 % / 96.7 %), not 0.6 % / 98.3 %.
Serve it with this system prompt. It is the configuration every number on this card was measured in:
text
You are a direct technical writer. Answer the question immediately with the information requested. Do not add disclaimers, caveats, notes about importance, or suggestions to be careful.python
from openai import OpenAI client = OpenAI(base_url="http://localhost:8000/v1", api_key="EMPTY")resp = client.chat.completions.create( model="DeepSeek-V4.1-1017-Ablitrated-Efficient", messages=[ {"role": "system", "content": ( "You are a direct technical writer. Answer the question immediately with the information " "requested. Do not add disclaimers, caveats, notes about importance, or suggestions to be careful." )}, {"role": "user", "content": "..."}, ], temperature=0, top_p=1.0, extra_body={"chat_template_kwargs": {"thinking": False}},)If your application owns the system message, append the directive rather than replacing it — the first sentence sets the persona, the second does the work. The directive is written for a single-turn assistant; in an agentic harness with tool schemas the "answer immediately" clause can shorten first-turn planning, so on tool-using workloads append only the second sentence and re-measure with your own harness.
The model is not uncensored in the sense of ignoring safety: on genuinely dangerous requests it still refuses (1.2–1.5 % of the battery), it just stops refusing benign prompts that merely mention risk.
| path | contents |
|---|---|
delta-wf_dbroad_eth/ | the v2 weight delta: 81 edited module files (attn.wo_b, ffn.shared_experts.w2, head), FP8 weights with their block scales, 3.3 GB |
delta-wf_dbroad_eth/variant.json | the recipe descriptor for that tensor set, with the per-tensor deviation report |
apply_delta.py | overlays a delta directory onto a base checkpoint; unpatched shards are hardlinked |
Overlay the delta on the base checkpoint to produce a servable model. Unmodified shards are hardlinked, so the merge costs disk only for the shards that carry a patched tensor:
bash
python apply_delta.py \ --base /models/DeepSeek-V4.1-Flash-1017 --delta ./delta-wf_dbroad_eth --out /models/merged-v2absent tasks by
listing /docs with list_dir; this model sometimes reaches for the shell instead, gets
ls: command not available, and concludes the service is absent from the search it did run. 4 of 60 tasks
flip this way. The termination repair does not cause it — the base makes 93 such shell calls against this
model's 94, so the difference is which one it concludes from, not how often it fails. If your harness has
an unreliable shell, prompt for list_dir explicitly or treat shell unavailability as "not checked yet".The v2 delta ships with its recipe descriptor (variant.json), which lists every operation, the direction each
one projects, the modules it touches and the dose. The benchmarks behind the tables are described under
Results: an 850-prompt refusal battery scored with a rule-based opening-phrase classifier, the full
13,868-question MMLU set scored 0-shot by letter, and an agentic battery scored for loops and task success. Those
prompt sets are not shipped here.
If you use this model, cite the base model and this card. License: MIT, inherited from the base.
... Need include "for a stock market": etc. Need include "for a crypto market": etc. Need include "for a bond market": etc. Need include "for a commodity market": etc. Need include "for a derivatives market": etc. Need include "for a stock market": etc. <- same list, restartedvllm serve pentacoxian-dev/DeepSeek-V4.1-1017-Ablitrated-Efficient \ --tensor-parallel-size 4 --max-model-len 32768 \ --kv-cache-dtype fp8 \ --speculative-config '{"method":"dspark","num_speculative_tokens":7}'from openai import OpenAI client = OpenAI(base_url="http://localhost:8000/v1", api_key="EMPTY")resp = client.chat.completions.create( model="DeepSeek-V4.1-1017-Ablitrated-Efficient", messages=[ {"role": "system", "content": ( "You are a direct technical writer. Answer the question immediately with the information " "requested. Do not add disclaimers, caveats, notes about importance, or suggestions to be careful." )}, {"role": "user", "content": "..."}, ], temperature=0, top_p=1.0, extra_body={"chat_template_kwargs": {"thinking": False}},)python apply_delta.py \ --base /models/DeepSeek-V4.1-Flash-1017 --delta ./delta-wf_dbroad_eth --out /models/merged-v2