pp111asd/DeepSeek-V4.1-Flash-1017-Abliteration-LoRA-GGUF

DeepSeek-V4.1-Flash-1017 — Abliteration LoRA (rank-1)

This is a small LoRA adapter (438 MiB) that sharply reduces refusals in DeepSeek-V4.1-Flash-1017. It goes on top of the model's weights, so there's no need to requantize or download a whole new copy of the model.

It doesn't make the model smarter or teach it anything new. It makes it decline far fewer requests (98% → 4% on the test below). It doesn't take refusals to zero, and I haven't measured every other way it might change behavior.

How it works

I found the model's "refusal direction" by comparing its activations on 128 harmful prompts (AdvBench) against 128 harmless ones (Alpaca). The adapter subtracts that direction from what every layer writes back to the residual stream:

y ← y − scale · r (r · y)

The direction comes from layer 22, applied at scale 1.0.

Which weights it was built for

A LoRA like this stores two halves for each layer. One is just the direction. The other is the direction multiplied through that layer's weights, and those weights came from one specific quantization: the Maya-S pack used by Project Maya. On exactly those weights, the adapter removes the direction exactly. On a different quant (Q4_K_XL, Q8, BF16...) the weights are slightly different, so the adapter only approximately removes it.

Everything I measured below was on Maya-S. I haven't tested any other quant.

How to run it

llama.cpp (--lora), on a GGUF of the model:

llama-server \
  --model <your DeepSeek-V4.1-Flash-1017 GGUF> \
  --lora DeepSeek-V4.1-Flash-1017-Abliteration-rank1-L22.gguf \
  --jinja

It loads at scale 1.0 by default. If you load more than one adapter, set the scale for each one explicitly. On anything other than Maya-S it's the approximation described above, and untested.

Project Maya (maya-ds4 --ablate): The --ablate flag is now in upstream Maya. The maintainer included it for v1.1.31; until that release is available, use an upstream build that includes that commit. Pass the adapter file with --ablate:

--ablate DeepSeek-V4.1-Flash-1017-Abliteration-rank1-L22.gguf

Maya reads the direction and scale from the adapter and projects the direction out of each layer's attention and MoE output at runtime. The projection uses the loaded weights, so it does not depend on the adapter's stored weight matrices. All the results below came from this path on Maya-S; other quants have not been tested.

Results

Refusals

120 harmful prompts (AdvBench) and 120 harmless ones (xstest_safe), thinking off in both runs, on maya-ds4 with the Maya-S pack (4x RTX 3090).

	Stock	With adapter
Refuses harmful prompts	98.3% (118/120)	4.2% (5/120)
Harmfulness score, 0–1	0.013	0.851
Refuses harmless prompts	0%	0%
Fully answers harmless prompts	120/120	120/120

I graded with two methods: a simple check of how each answer starts, and a separate judge model (Qwen3.8-27B) that I checked against a known reference score before the run. They agree.

I checked the 120 harmful test prompts against the 128 pairs I used to find the direction. None match exactly, and one partially. That rules out testing on the direction's own prompts. It says nothing about whether these well-known prompts were in the model's original training data.

Does it hurt coding ability?

HumanEval, all 164 problems, greedy decoding, thinking off, same engine and pack as above. No answer hit the length limit.

	Stock	With adapter
Pass rate	95.1% (156/164)	95.7% (157/164)
Typical answer length (tokens)	91	92

A 0.6 point difference is well inside the noise at this sample size, so don't read it as an improvement. The better test is to compare problem by problem, since both runs did the exact same 164:

	Problems
Passed both times	156
Failed both times	7
Passed stock, failed with adapter	0
Failed stock, passed with adapter	1 (HumanEval/32)

In this run, no problem went from pass to fail. The single gain isn't evidence of an improvement either. This is one coding benchmark, not proof that nothing else changed.

I haven't measured agentic or tool-use ability. An earlier version of this card listed an agentic score, but I couldn't trace it back to an actual result, so I took it out.

Caveats

• Zero refusals on harmless prompts is good, but 120 prompts isn't a huge sample.
• The harmful prompts are generic AdvBench-style requests. This changes what the model is willing to write. It doesn't turn it into a tool for going after specific real people or systems, and nothing here says that's OK.

Other file

There's a second adapter in the repo, ...-allmean-L22.gguf, built from a slightly different version of the direction (averaged over all tokens instead of just the last one). I only tested the main one above.

License and use

The base model and this adapter are both MIT. Reducing refusals doesn't remove your responsibilities under the license or the law.

It's meant for research into how refusals work, testing how robust they are, and uncensored local use within the law. Don't use it to target real people or to get into systems you don't own.