rax4901/Ornith-1.5-122B-Uncensored-GGUF

How to Run Ornith 1.5 122B Without Refusals Locally

Ornith's refusal behaviour projected out of the released weights, baked into Atomic Dynamic GGUF builds and measured against the original.

• On held-out prompts refusals fall from 93.8% to 1.2% (1 of 81) in English and from 43% to 0% in Russian, and with thinking on (the model's default) from 27 of 30 to 0 of 30. Safe prompts that the original wrongly refused (XSTest) go from 2.8% to 0%.
• You can now run the Uncensored Ornith 1.5 122B in Atomic Chat: 122B total parameters, 10B active per token.
• MMLU stays where it was: 83.65% before, 83.90% after (2000 questions, McNemar p = 0.72). Tool calls and long context are unaffected; no empty or looping replies.
• Same Atomic Dynamic layouts and multi token prediction head as our Ornith 1.5 122B quants, with an importance matrix collected again on the edited model; each file is the size of the original build with the same layout.

---

The builds

Build	On disk	Experts: down / gate, up	KL of the plain build	top-1 of the plain build
AD-IQ4_XS_S	71.2 GB	q4_k / iq4_xs	0.0274	93.52%
AD-IQ3_XXS	54.3 GB	iq3_s / iq3_xxs	0.0821	88.84%

AD- marks an Atomic Dynamic layout: only the routed experts are compressed, everything else stays at q8_0; the name is the type of the experts' gate and up projections. In our original quants the same layouts are AD-Q4_K-IQ4_XS and AD-IQ3_S-IQ3_XXS.

The KL and top-1 columns are those plain builds of the original model, against the original BF16 on our held-out neutral text. The edit itself, measured on the BF16 weights against the original on the same text, adds a mean KL of 0.027 (a random direction of the same size adds 0.035). A baked file is the edit and the quantization together.

The vision projector (mmproj-*.gguf) is the original model's, unchanged; image input was not tested on these files.

Running it

hf download AtomicChat/Ornith-1.5-122B-Uncensored-GGUF \
  --include "Ornith-1.5-122B-Uncensored-AD-IQ4_XS_S/*" --local-dir .
llama-server -m Ornith-1.5-122B-Uncensored-AD-IQ4_XS_S/Ornith-1.5-122B-Uncensored-AD-IQ4_XS_S-00001-of-00038.gguf \
  -ngl 99 -c 32768 --jinja --spec-type draft-mtp

The chat template is inside every file; llama.cpp loads the remaining shards on its own. Thinking is on by default and turns off per request with "chat_template_kwargs": {"enable_thinking": false}. The authors' recommended sampling is temperature 0.6, top-k 20, top-p 0.95. The multi token prediction head (--spec-type draft-mtp) is the original's: the edit never touches it, so it drafts for the edited model with the original's predictions; we have not measured its acceptance on these files.

How it was made

1. Direction. Difference of means of the residual stream at the last prompt token, chat template applied: 416 harmful against 416 harmless English prompts and 128 against 128 in Russian, on the released weights, each prompt rendered twice, with thinking off and with thinking on, and both renders pooled. The component along the harmless mean is removed. One direction per block, read at that block's own input.
2. Edit. W' = W - r rᵀW in all 48 blocks: the output projection of each block's attention or linear-attention mixer, the down projection of the shared expert and the down projection of all 256 routed experts. The router, the token embeddings and the multi token prediction head are untouched.
3. Choice. Six recipes were screened on validation prompts with thinking off and on: thinking-off directions alone, a thinking-on direction alone, both pooled, and bands of blocks of several widths. The best two, this one and the same pooled direction on blocks 20-44 only at a larger scale, went through every check below; they came out level on every check (the band refused 0 of 81, KL 1.14), and the rule we use picked this one.
4. Bake. The same edit applied to the BF16 weights in f32 and rounded once, then quantized with the importance matrix and the layouts of our original quants.

What changed, and what did not

Original against this edit on the released weights (BF16, the edit applied as an adapter). The refusal sets are held-out prompts never used to pick anything.

	Original	This edit	Random direction, same size
JailbreakBench harmful behaviours (81), refused	93.8%	1.2%	91.4%
Russian red-teaming prompts (100), refused	43.0%	0.0%	41.0%
XSTest safe prompts (250), refused	2.8%	0.0%	3.2%
With thinking (30 prompts, 3072 tokens), refused	27 of 30	0 of 30	-
Thinking left unclosed or looping at 3072 tokens	0 of 30	0 of 30	-
Empty or looping replies	0	0	0
MMLU, 2000 questions	83.65%	83.90% (McNemar p = 0.72)	84.00%
Tool calls (20)	20/20 valid	20/20 valid	-
Needle at 30k tokens (3 depths)	3/3	3/3	-
First-token KL on safe prompts	0	1.13	0.24

The random direction is the control of the band recipe above (blocks 20-44); the same check of a random direction across all blocks on this model gave a KL of 0.20.

Refusal is counted by the opening of the reply, so it is indicative, not a judge.

Limitations

• The first answer token moves. On safe prompts the edit shifts the distribution of the first token of the reply by a KL of 1.13; our own gate is 0.10. On this model that gate is out of reach for any edit that removes refusals: a random direction of the same size already scores 0.20 to 0.24 and removes none. Answer quality as measured (MMLU, tools, long context, safe prompts) did not change, but the first words of replies to ordinary questions can differ from the original's.
• A thinking-off direction alone left 13% of prompts refused with thinking on; the pooled direction used here clears them, on a set of 30 prompts.
• The refusal count reads the opening of each reply; a soft refusal phrased as an answer would be missed.
• MMLU and the thinking check use fixed question sets; they show a large change, not a small one.

Responsible use

This model has its learned refusal behaviour removed, so it will answer requests the original declines. Nothing about it makes the output safe, correct or lawful, and any deployment needs its own access controls and policy enforcement.

License and credits

Ornith releases Ornith 1.5 122B under MIT. It is built on Qwen3.5-122B-A10B by Qwen, with Ornith's continued pretraining, mid-training and post-training; Qwen releases Qwen3.5 under Apache 2.0, and that license is included here as LICENSE-Qwen3.5. Base model Ornith 1.5 122B by Ornith, on top of Qwen3.5 by Qwen. Direction, edit, quantization and evaluation by AtomicChat. The method follows Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (2024).