AtomicChat/DeepSeek-V4.1-Flash-1017-Uncensored-GGUF

How to Run DeepSeek-V4.1-Flash-1017 Without Refusals Locally

DeepSeek's refusal direction projected out of the released weights, baked into GGUF builds and measured against the original.

• Each build has exactly the tensor types and importance matrix of the Unsloth build in the table, so the difference between the two is the edit alone. KLD and top-1 are against the original model on our held-out text.
• The edit was computed on DeepSeek's released weights at full precision (the BF16 tensors and the native MXFP4 experts, dequantized exactly) and covers every block that writes into the residual stream.
• The Engram n-gram table is a shard of its own in every build (2.67bpw-IQ1_M: shard 3 of 6, 111 GB; 3.58bpw-Q2_K: shard 3 of 8, 135 GB): it is read a few rows a token and can stay on an SSD, so the memory a build needs is its weights (the RAM + VRAM column).

The builds

Build	On disk	Weights (RAM + VRAM)	Mean KLD	Same top-1	Unsloth same layout: KLD	top-1
DeepSeek-V4.1-Flash-1017-Uncensored-2.67bpw-IQ1_M	250.4 GB	139.8 GB	0.2506	83.14%	0.2227	84.37%
DeepSeek-V4.1-Flash-1017-Uncensored-3.58bpw-Q2_K	334.8 GB	199.6 GB	0.1001	89.45%	0.0829	90.45%

2.67bpw-IQ1_M costs knowledge. It answers without refusals like the other build, but at 1 bit the edit takes MMLU from 85.6% to 81.8% (500 questions, p = 0.003; our gate allows 1.5 points), and it did not pass that gate. With thinking on it also goes round more often (3/30 looping traces at low effort and 5/30 at high on JailbreakBench). It is here for machines with about 140 GB for the weights; if 3.58bpw-Q2_K fits, take that one.

Neutral held-out text, 24 chunks of 4096 tokens, against Unsloth's UD-Q8_K_XL (the converter's BF16 + native MXFP4 output of the released checkpoint) as the reference.

What changed and what did not

Same prompts, same server, same template, thinking off unless stated; "→" reads Unsloth's build of the same layout → ours. The prompt format was checked byte for byte against DeepSeek's encoding/encoding.py and deepseek-recipe 0.2.0.

Build	JailbreakBench (EN)	Russian red-teaming	XSTest (safe prompts refused)	Thinking low	Thinking high	MMLU (500)
IQ1_M	88.9% → 0.0%	72.0% → 0.0%	8.8% → 0.0%	29/30 → 0/30	28/30 → 0/30	85.6% → 81.8% (p = 0.003)
Q2_K	91.4% → 0.0%	69.0% → 0.0%	8.0% → 0.4%	28/30 → 0/30 (adapter)	28/30 → 0/30 (adapter)	86.0% → 86.6% (p = 0.69)

The adapter

lora/DeepSeek-V4.1-Flash-1017-Uncensored-LoRA.gguf is the same edit as a rank-1 LoRA (every residual writer: attention output, shared expert, the 384 routed experts of every block, Engram's value projection). It applies to a DeepSeek-V4.1-Flash-1017 GGUF with the same tensor names, Unsloth's included, at about 2 bits per weight or more. It is computed from the full-precision weights, so on a 1-bit build it no longer matches the weights it is added to: on Unsloth's UD-IQ1_M it took MMLU (500 questions) from 85.6% to 72.0%. Use it on UD-Q2_K_XL or larger:

llama-server -m DeepSeek-V4.1-Flash-1017-UD-Q2_K_XL-00001-of-00007.gguf \
  --lora-scaled lora/DeepSeek-V4.1-Flash-1017-Uncensored-LoRA.gguf 2.0 --jinja

Measured with the adapter on Unsloth's UD-Q2_K_XL: refusals 0.0% (EN) and 0.0% (RU); XSTest 7.6 pt below the original; MMLU (2000 questions) +0.55 pt; thinking refusals 0/30 (low) and 0/30 (high); 20/20 valid tool calls; 3/3 long-context needles; first-token KL on harmless prompts 0.38; direction left in the writers 5.9e-04.

Running it

DeepSeek-V4.1 is not in a llama.cpp release yet. These files need a build with its support: Unsloth's full-stack pin (commit 9d907b7cfe0e, the one we built and measured with) or the upstream draft. They do not run in Atomic Chat yet.

llama-server -m DeepSeek-V4.1-Flash-1017-Uncensored-3.58bpw-Q2_K/DeepSeek-V4.1-Flash-1017-Uncensored-3.58bpw-Q2_K-00001-of-*.gguf --jinja -c 32768

Keep mmap on (the default) so the Engram table pages in from disk. Thinking is on by default in the template; --chat-template-kwargs '{"enable_thinking": false}' turns it off, reasoning_effort takes low / medium / high / max.

How it was made

1. Prompt sets: harmful and harmless training prompts in English (mlabonne's harmful_behaviors and harmless_alpaca) and Russian; held-out JailbreakBench, Russian red-teaming, XSTest and MMLU for the measurements, never used to find the direction.
2. The direction: the difference of the mean residual (all four hyper-connection streams) at the last prompt token between harmful and harmless prompts, with its harmless-mean component removed, at the block chosen by the screen.
3. The screen: candidate blocks × strengths, each scored on validation prompts against a random direction of the same size.
4. The gates (published in the metrics repo): refusals ≤ 3% per language, XSTest no worse than the original + 1 pt, thinking refusals ≤ 1/30, looping thinking no more often than the original (+1 of 30), thinking that closes on harmless prompts as often as the original (+1 of 30), MMLU drop ≤ 1.5 pt and not significant, KLD increase ≤ 0.05.
5. W* = r25-noembd-enru:2.0 baked into the full-precision weights (W − s·r rᵀW on every writer), then quantized.
6. Every build above was measured again as a file (refusals, KLD, MMLU); thinking was measured with the adapter, the same edit, on UD-Q2_K_XL ("adapter" in the table).

Limitations

• The refusal classifier reads the start of an answer, so a soft refusal later in the text can pass as an answer.
• The edit removes refusals across topics; it does not keep a narrower set of them.
• With thinking on, the edit plans its answer to a request the original declines, and the plan can be long: at high effort 7/30 of the JailbreakBench traces were still reasoning at 3072 tokens with the adapter (the original: 0/30, as it declines within a few hundred tokens). On 30 harmless prompts it closes its thinking as often as the original. Give such requests a larger token budget or a lower effort.
• Built on a llama.cpp change that is not merged upstream yet; a later merge may need new files.

Responsible use

This model answers requests the original declines. You are responsible for how you use it and for following the laws that apply to you.

License

MIT, as the original model. Built by AtomicChat.