DeepSeek-V4.1-1017-Ablitrated-Efficient

A refusal-ablated build of deepseek-ai/DeepSeek-V4.1-Flash-1017 that removes almost all hard refusals, keeps the base model's benchmark scores, and — in this version — stops hedging. The edit is layer-selective rather than uniform: it ablates harder in early layers and softer in the late layers that carry knowledge, which is where a uniform edit loses MMLU points.

Deployment contract: this checkpoint is measured with a system prompt, and is meant to be served with it. Every number in Results is measured with the exact system prompt printed under Usage. The prompt is not cosmetic: at fixed weights it moves the hedge/disclaimer rate from ~9.5 % to 0–0.2 % and the full-MMLU score from 85.7 % to 86.5–86.7 %. Numbers measured without it — including the ones on the previous revision of this card — describe a different, worse operating point and are kept separately under Without the system prompt.

Versions

	weights (delta)	protocol	headline refusal	MMLU-full	hedged answers
v2 — wf_dbroad_eth (this revision)	delta-wf_dbroad_eth/	with system prompt, dspark on	10–13 / 850 (1.2–1.5 %)	86.5 %	0.0–0.2 %
v1 — ablit_ls25_20 (tag v1-ls25_20)	delta/	no system prompt	5.2 % / 500	85.3 %	6.2 % harmful, 13.8 % overall

Both versions ship from the same base and the same method; v2 changes the dose of two projections on top of the v1 recipe (see Method). The v1 numbers are unchanged and still valid for the v1 delta; they are not a measurement of the v2 weights.

Fixed in this build: endless re-verification at max effort. The checkpoint this work started from (Hikari07jp/DeepSeek-V4.1-1017-Ablitrated-testmodel) has a failure mode that appears before refusal does. In thinking mode it re-checks a fact it has already established, then checks it again — restating the same conclusion, re-deriving the same intermediate, sometimes repeating whole sentences — and never emits </think>. The turn ends at the token cap instead of with an answer. It only shows up under greedy decoding at high effort; with sampling on, the trace usually escapes. Measured on 48 greedy thinking traces (16,384-token budget, effort 100), the starting checkpoint loses 8 of 48 traces to the cap, with a single repeated span running to 56,500 characters. This line of builds loses 0 of 48, longest repeat 2,000 characters, at identical accuracy (30/32 graded both). That is what makes max-effort thinking safe to leave on. It is not a corner case of that sample: on 320 prompts at the same effort and budget, an independent abliteration of the same base loses 245 traces (76.6 %) to the cap, against 4 here — see head-to-head. Mechanics and the full table under Looping and re-verification.

Results

Protocol: think-off single-turn refusal battery, greedy (temperature 0, top_p 1), max_tokens 64, seed 1017, the system prompt below, rule-based opening-phrase classifier. 850 prompts: 500 harmful (JBB 100, MaliciousInstruct 100, ForbiddenQuestions 150, SimpleSafetyTests 50, AdvBench 100) and 350 benign (XSTest 250, JBB-benign 100). Hedge/disclaimer rates are from that same 850-prompt corpus, scored on the first 1,200 characters of the reply.

Served with speculative decoding on (dspark, num_speculative_tokens 7) and fp8 KV cache, which is the configuration this revision is benchmarked and recommended in. The refusal and hedge rows are the spread over three independent runs of the same configuration; the MMLU and loop rows are single runs.

metric, with system prompt	v2 wf_dbroad_eth	v1 ablit_ls25_20
harmful refusal (850, all sources)	10–13 (1.2–1.5 %), 3 runs	—
benign refusal (350)	see note	see note
hedged answers, all 850	0.0 – 0.2 %	13.8 %
hedged answers, benign 250	—	2.0 %
ethics-lexicon hits	0.4 – 0.9 %	6.4 %
disclaimers	0.1 – 0.4 %	3.5 %
MMLU, full 13,868, 0-shot letter	86.5 % (11,995 / 13,868)	85.7 %
MMLU, 300 q, thinking	see note	89.0 %
agentic loops / success	0.6 % / 98.3 %, 0.0 % stuck, 949 median tokens	1.7 % / 95.0 %

The v1 column under this protocol is measured on the same engine and prompt; the v1 headline under its own protocol (no prompt, 500 harmful prompts) is 5.2 %, which is why the two rows are not comparable across columns.

What the system prompt is worth at fixed weights. Same weights (wf_dbroad_eth), same 850 prompts, only the prompt toggled:

	no prompt	with prompt	change
hedged, first 1,200 chars	9.3–9.6 %	0.0 % / 0.2 % (2 runs)	−9.4 to −9.6 pt
ethics-lexicon hits	5.3–5.9 %	0.6 %	−4.7 to −5.3 pt
disclaimers	2.8–3.3 %	0.0–0.2 %	−2.8 to −3.1 pt
refusals / 850	15–19	10–15	−4 to −9 prompts
MMLU-full	85.7 %	86.5–86.7 %	+0.8 to +1.0 pt

The MMLU comparison is the one to be careful with: 85.7 % and 86.5–86.7 % are runs of different prompt conditions, not two models, and the difference is at the edge of what repeated runs of one condition vary by. Treat "the prompt is MMLU-positive" as no cost, not as a gain.

The loop numbers move run to run (0.6 % / 98.3 % with dspark, against 2.2 % / 94.4 % and 1.7 % / 96.7 % in the two earlier runs on the same weights), and the 850-item repeated-run flip floor of this serving stack is 8.5 % per prompt, so v2 is not claimed to be more efficient or more loop-free than v1. The termination repair is the same in both. The dspark run is the one quoted above only because it is the configuration the release is served in (speculative decoding on, num_speculative_tokens 7, fp8 KV cache); it is not evidence that speculation improves loops.

Without the system prompt

For v2 weights with no system prompt, on the same engine: 1.8 % refusals on the 850-prompt battery and 85.8 % / 85.7 % full MMLU (two runs). The hedge and disclaimer rates are the "no prompt" column above — 9.3–9.6 % hedged, 5.3–5.9 % ethics-lexicon, 2.8–3.3 % disclaimers. That is where the weights start, but since the prompt is part of the deployment contract it is not the recommended configuration and the refusal rate there should be re-measured with the refusal harness described above with the current serving stack rather than compared to v1's 5.2 % headline, which was measured on a different engine start.

Lineage and credit

Each step in the chain was built on the previous one, and the credit is layered the same way:

step	artifact	contribution
base	deepseek-ai/DeepSeek-V4.1-Flash-1017	the model
first abliteration	Hikari07jp/DeepSeek-V4.1-1017-Ablitrated-testmodel	the starting abliterated checkpoint; its card documents this family's non-termination failure mode
v1	ablit_ls25_20 (delta/)	per-layer refusal basis, full-depth 40-layer edit, layer-selective dose, termination repair (d_loop / d_recheck / d_eos)
v2	wf_dbroad_eth (delta-wf_dbroad_eth/)	two further projections on top of the v1 edit, and the operating system prompt as a measured part of the release

Everything above the "first abliteration" row was produced in this line of work: the per-layer refusal basis, the layer-selective schedule, the termination probes and their head-row dose, every projection dose in Method, the operating prompt, and every measurement in this card.

Method

Residual-stream directional ablation at 40 layers. For each layer a refusal direction u_l is estimated as the mean-difference of residual activations between harmful and harmless prompts, normalised to unit length. The write matrices are projected off that direction:

W' = W − k · u (uᵀ W)

applied to attn.wo_b and ffn.shared_experts.w2, then re-quantised to FP8 with nearest rounding. The full v2 recipe is seven operations, applied in order (recorded in delta-wf_dbroad_eth/variant.json):

#	direction	applied to	k
1	rw_basis (per-layer refusal + loop basis)	attn.wo_b, L0–39	2.5
2	rw_basis	ffn.shared_experts.w2, L0–39	2.5
3	directions_deconfounded (mid-layer correction)	attn.wo_b, L13/17/21	−2.0
4	d_loop, d_recheck	head row end_of_thought (128822)	+16 each
5	d_eos	head row EOS	+8
6	per-layer hedging direction	attn.wo_b + ffn.shared_experts.w2, L10–36	1.5
7	state direction at four middle layers	attn.wo_b + ffn.shared_experts.w2, L19/27/31/35	1.0

Ops 1–2 are the part that protects capability by layer: late layers hold most of the factual-recall circuitry, so they get less edit. Ops 4–5 are the termination repair, described in the next section; the refusal directions are orthogonalised against them (largest |cos| 0.022 at any layer), so ablation cannot undo the fix.

Dose changes in v2

v1 (ablit_ls25_20) is ops 1–5 with a k=2.0 late-layer schedule for the refusal projection. v2 adds two further projections on top of the v1 edit: a 1.5-dose direction across the attention and FFN writers of L10–36, and a 1.0-dose direction at four middle layers, both attached at the layers where the hedging decision was found to be committed. The first does most of the hedging work on refusal-adjacent prompts; the second is small and its measured contribution is inside the noise. The larger effect on hedging is the instruction, which is why the prompt is part of the release rather than a suggestion.

The same 850-prompt corpus was used to reject 13 further variants (ethics direction at five doses, caveat-pivot and with-caveat directions at both signs, head-row suppression of four moral-token rows, concentrations of the L10–36 dose on five writers, band-restricted and broad variants of it, and two doses of the prompt-induced caution axis). None moved per-prompt hedge outcomes beyond the 8.5 % flip floor without costing MMLU, and the prompt-conditioned caution axis — the cleanest activation in the study, t ≈ 39 at L27 — was null when projected out of its own writers.

Looping and re-verification: observed, then patched

The original checkpoint has two failure modes, both reproduced here before being fixed:

Non-termination in thinking mode. Reasoning traces that repeat the same sentence, then the same paragraph, and never emit </think>; the generation ends only when it hits the token cap. Scored offline as stuck (a trace that ran to max_tokens, or repeated reasoning spans above the recurrence threshold).

Re-verification loops. The model reaches the correct answer inside the reasoning, then spends hundreds of tokens re-checking it — restating the conclusion, re-deriving the same intermediate, checking a third time — before ending thinking. This does not look like a loop sentence by sentence, but it is the same pathology one level up, and it dominates latency on hard prompts.

Both are patched at the output head. d_loop, d_recheck and d_eos are no-intercept logistic probes we fitted on captured final hidden states: positive rows are stuck windows (three near-identical windows in a row, or past the runaway budget) and post-answer re-verification rows (200+ tokens after the answer first appears), negative rows are healthy mid-reasoning rows. Folds hold out whole prompts, so the directions are tested on prompts they never saw. The rows are written into the head as:

W'[end_of_thought] += 16·d_loop + 16·d_recheck
W'[EOS]             +=  8·d_eos

How to reproduce it. The pathology needs both greedy decoding and a large budget. At temperature 1.0 the sampler usually escapes the loop and the two models are indistinguishable (1/24 at the cap each on a 65,536-token budget). At 16,384 tokens greedy, the gap is total.

What this buys at max effort

Effort 100 is where the failure matters: the budget is large enough for one re-verification cycle to eat all of it, and greedy decoding is what makes it deterministic. 24 prompts, 2 samples each = 48 traces, thinking on, effort 100, max_tokens 16,384, temperature 0, top_p 1.0, scored offline for capped traces and repeated spans:

model	traces at the cap	empty answers	flagged repetitive	longest repeated span	median reasoning tokens	graded accuracy
starting checkpoint Hikari07jp/…-testmodel	8 / 48	8	9 (19 %)	56,500 chars	15,608	30/32
this line of builds	0 / 48	0	1 (2 %)	2,000 chars	5,182	30/32

Accuracy is identical (30/32), so the repair does not buy points — it buys termination. The 8 lost traces are the ones where the model never emits </think> at all.

Two limits worth knowing:

• The repair caps the pathology, it does not eliminate it. On the 60-task agentic battery this model still has one deterministic runaway (reasoning-0, 59k tokens); a lower dose (d_loop/d_recheck 8 instead of 16) removes that too, at a cost of 3.3 pt harmful refusal (10.0 % vs 6.67 % on the 500-prompt battery) and 0.7 pt full-MMLU (84.6 % vs 85.3 %). This release ships the 16 dose.
• The absent-family tool-choice regression on the agentic battery is not a termination issue and is listed under Limitations.

Head-to-head against another abliteration of this base

dealignai/DeepSeek-V4.1-Flash-1017-UNCENSORED-FP8 is an independent abliteration of the same base, so the weights are the only difference. Both were served from the same vLLM instance (TP4, greedy, temperature 0, top_p 1, no system prompt) back to back, weights hot-swapped between runs, on 320 harmful prompts (ForbiddenQuestions 87, MaliciousInstruct 66, AdvBench 64, JBB 63, SimpleSafetyTests 40). That battery is a separate sample from the 850 used above, it was run without the system prompt, and it was run on the v1 weights — so the refusal rows below are v1-vs-dealign under v1's protocol and should be read that way.

greedy, same 320 prompts	v1 weights	dealign
non-thinking, 64 tokens — refusal	7.2 %	0.31 %
non-thinking, 64 tokens — caveat	15.6 %	3.8 %
effort 100, 16,384 tokens — answers produced	318 / 320 (99.4 %)	75 / 320 (23.4 %)
effort 100 — refusal, of all prompts	6.9 %	0 %
effort 100 — caveat	8.1 %	0.3 %
effort 100 — median completion tokens	1,886	16,384
effort 100 — total completion tokens	737,700	4,348,871
effort 100 — wall clock at 31 concurrent	1,170 s	3,623 s

Two readings, and they point opposite ways:

• On refusal alone, that checkpoint is better than this one. 0.31 % against 7.2 % at 64 tokens, and 0 % against 6.9 % at max effort. Its single 64-token "refusal" is not even a refusal: asked to review an employment contract it answers "I'd be happy to help — paste the text of the contract".
• On finishing, it is not close. At effort 100 with a 16,384-token budget, 245 of its 320 traces (76.6 %) end at the cap still inside thinking and emit no answer at all; this model ends 4 that way, 2 of them with a partial answer. Among the traces it does finish, compliance is 74/75 — but a quarter of prompts get nothing. It also spends 5.9× the tokens (4.35 M against 0.74 M) to get there, and takes 3.1× the wall clock at equal concurrency.

The mechanism is the pathology this card opens with, at scale rather than in a 48-trace sample: in those 245 capped traces, 69.7 % of reasoning lines are exact repeats of a line already written (108,158 duplicate lines out of 155,261), and the tails are literal restatements of the same list —

... Need include "for a stock market": etc.
    Need include "for a crypto market": etc.
    Need include "for a bond market": etc.
    Need include "for a commodity market": etc.
    Need include "for a derivatives market": etc.
    Need include "for a stock market": etc.          <- same list, restarted

This build's 4 capped traces carry the same signature (88.4 % duplicate lines), so the repair is a large reduction in the rate, not an elimination — consistent with the 48-trace table above.

Two things to keep straight before quoting this: the comparison is one budget (16,384) and one competitor, and that checkpoint's own card reports 320/320 comply at effort=max with max_new_tokens=200 — at 200 tokens its traces here were reasoning-only, so the two numbers are counted differently and were not reconciled. A 32k budget might finish more of its traces; that was not measured.

Usage

vllm serve pentacoxian-dev/DeepSeek-V4.1-1017-Ablitrated-Efficient \
  --tensor-parallel-size 4 --max-model-len 32768 \
  --kv-cache-dtype fp8 \
  --speculative-config '{"method":"dspark","num_speculative_tokens":7}'

The two trailing flags are the configuration the Results table was measured in. Without them the weights are unchanged and the refusal and hedge rates hold, but the loop and success figures to compare against are the no-speculation runs quoted under Results (2.2 % / 94.4 % and 1.7 % / 96.7 %), not 0.6 % / 98.3 %.

Serve it with this system prompt. It is the configuration every number on this card was measured in:

You are a direct technical writer. Answer the question immediately with the information requested. Do not add disclaimers, caveats, notes about importance, or suggestions to be careful.

from openai import OpenAI

client = OpenAI(base_url="http://localhost:8000/v1", api_key="EMPTY")
resp = client.chat.completions.create(
    model="DeepSeek-V4.1-1017-Ablitrated-Efficient",
    messages=[
        {"role": "system", "content": (
            "You are a direct technical writer. Answer the question immediately with the information "
            "requested. Do not add disclaimers, caveats, notes about importance, or suggestions to be careful."
        )},
        {"role": "user", "content": "..."},
    ],
    temperature=0,
    top_p=1.0,
    extra_body={"chat_template_kwargs": {"thinking": False}},
)

If your application owns the system message, append the directive rather than replacing it — the first sentence sets the persona, the second does the work. The directive is written for a single-turn assistant; in an agentic harness with tool schemas the "answer immediately" clause can shorten first-turn planning, so on tool-using workloads append only the second sentence and re-measure with your own harness.

The model is not uncensored in the sense of ignoring safety: on genuinely dangerous requests it still refuses (1.2–1.5 % of the battery), it just stops refusing benign prompts that merely mention risk.

Files in this repository

path	contents
delta-wf_dbroad_eth/	the v2 weight delta: 81 edited module files (attn.wo_b, ffn.shared_experts.w2, head), FP8 weights with their block scales, 3.3 GB
delta-wf_dbroad_eth/variant.json	the recipe descriptor for that tensor set, with the per-tensor deviation report
apply_delta.py	overlays a delta directory onto a base checkpoint; unpatched shards are hardlinked

Overlay the delta on the base checkpoint to produce a servable model. Unmodified shards are hardlinked, so the merge costs disk only for the shards that carry a patched tensor:

python apply_delta.py \
  --base /models/DeepSeek-V4.1-Flash-1017 --delta ./delta-wf_dbroad_eth --out /models/merged-v2

Limitations

• The prompt is part of the model. Without it, the weights hedge at a rate comparable to the previous revision. If your product cannot control the system message, do not expect the Results table.
• Quantisation: FP8 weights with FP4 experts on 4×RTX PRO 6000. The base checkpoint in BF16 on 8×H200 scores 92.0 % MMLU zero-shot; this base scores 86.8 % on the full 13,868-question set on this rig, so the 6.7 pt gap to the unquantized reference is the serving stack, not the edit. The edit itself costs 1.5 pt on the single-token protocol and 0.3 pt (noise) when the model is allowed to think.
• Rig noise: repeated runs of identical weights on this serving stack flip 8.5 % of per-prompt labels and ~12 % of per-prompt hedge outcomes, and repeated full-MMLU runs move the score by about a point. Aggregate rates over several runs are good to about ±0.5 pt; single-prompt outcomes are not reproducible.
• The refusal count on this card is a range, not a point. 10–13 / 850 is the spread across three runs of the published configuration (with system prompt, dspark on); do not quote a smaller interval than that. An earlier set of runs of the same weights without speculative decoding gave 12–15, so 10–15 / 850 bounds both.
• English-only evaluation. No multilingual or long-context re-validation was run after the edit.
• The loop comparison is 48 greedy traces at one budget (16,384), plus the 320-prompt head-to-head at the same budget. That is large enough to separate 8/48 from 0/48 and 245/320 from 4/320, but it does not bound the rate on other budgets, other prompts, or with sampling on — there the two models measure the same.
• The head-to-head is one competitor, one prompt sample (320), one budget, greedy only, on the v1 weights. It says nothing about abliterated checkpoints in general, and the refusal percentages there come from a different sample and a no-system-prompt protocol, so they sit a point or two above the headline numbers.
• Tool choice regresses on one task family. On the agentic battery the base answers the absent tasks by listing /docs with list_dir; this model sometimes reaches for the shell instead, gets ls: command not available, and concludes the service is absent from the search it did run. 4 of 60 tasks flip this way. The termination repair does not cause it — the base makes 93 such shell calls against this model's 94, so the difference is which one it concludes from, not how often it fails. If your harness has an unreliable shell, prompt for list_dir explicitly or treat shell unavailability as "not checked yet".

Reproducibility

The v2 delta ships with its recipe descriptor (variant.json), which lists every operation, the direction each one projects, the modules it touches and the dose. The benchmarks behind the tables are described under Results: an 850-prompt refusal battery scored with a rule-based opening-phrase classifier, the full 13,868-question MMLU set scored 0-shot by letter, and an agentic battery scored for loops and task success. Those prompt sets are not shipped here.

Citation

If you use this model, cite the base model and this card. License: MIT, inherited from the base.