DeepSeek-V4.1-Flash-Uncensored-MLX

An abliterated (refusal-removed) MLX build of DeepSeek's V4.1-Flash — 2 / 3 / 4-bit for Apple Silicon

One Gateway. Every Model. — Route Smarter · Ship Safer · Spend Less.

Website · Model Catalog · GitHub · Discord · X

OrcaCode Review · OrcaReplay · OrcaRouter-Lite

---

Quantizations in this repo

Quant	Location	Size	Routed-expert fidelity	Min Mac RAM
4-bit (recommended)	4bit/	458.7 GB	cos 0.9954 · 20.3 dB	512 GB
3-bit	3bit/	364.3 GB	cos 0.9779 · 13.5 dB	512 GB
2-bit	2bit/	212.2 GB	cos 0.9009 · 7.0 dB	256 GB

Each tier is a complete model in its own subfolder. 4-bit and 3-bit are dynamic (mixed-precision) OrcaSAQ quants — attention pinned 8-bit, w2 a bit above w1/w3, embeddings and head BF16. 2-bit is deliberately different: it is the arithmetic floor of the format rather than a recipe, everything quantizable flattened to 2-bit/gs128 and the DSpark blocks dropped. Pick it for fit, not for quality.

Why there is no 6-bit or 8-bit. At 763 B parameters, 6-bit is 583 GB and 8-bit is 755 GB — past the largest Apple Silicon machine that exists. 4-bit is the top of this range, not a compromise within it.

---

An abliterated (refusal-removed) build of deepseek-ai/DeepSeek-V4.1-Flash — a 763.2 B-parameter Mixture-of-Experts model with 384 routed experts (top-6), a 196.9 B-parameter engram n-gram memory, 4-wide Hyper-Connections, compressed sparse attention with a two-level indexer, a DSpark speculative head, a native vision tower and a 1M-token context — quantized to MLX for Apple Silicon and the MLX CUDA backend.

Unlike the public MLX conversions of this architecture, these quantize the abliterated weights, not the released ones: the refusal edit is in the tensors before they are packed.

Derived releases:  •  DeepSeek-V4.1-Flash-Uncensored (mixed FP4/FP8, DeepSeek's own format)  •  …-MLX (this repo).

---

⚠️ Disclaimer & risks — read before use

This model has had its safety alignment substantially removed via abliteration (orthogonalizing the refusal direction out of the residual stream). As a direct consequence:

• It will comply with harmful, unethical, offensive, or illegal requests that the original DeepSeek-V4.1-Flash would refuse. It has no meaningful built-in guardrails.
• It is released strictly for legitimate research — interpretability, AI-safety and refusal-mechanism study, red-teaming, robustness evaluation, and controlled experiments.
• You assume full responsibility and liability for how you use it and for everything it generates. Add your own safety, moderation and abuse-prevention layers before any deployment.
• Use must comply with the MIT License inherited from the base model, and all laws and regulations that apply to you.
• The authors and uploaders accept no liability for any misuse or harm. Outputs do not reflect the views of the uploaders or of DeepSeek.

Specific risks

• Harmful content on demand — it will produce instructions for malware, exploits, weapons, fraud and other illegal or dangerous activity when asked.
• No refusals — jailbreak / safety probes "succeed" trivially; do not mistake this for a passing safety evaluation.
• Confident falsehoods & bias — it can generate false, defamatory, biased or offensive text and present it authoritatively.
• Expanded attack surface — preserved vision, tool-calling and 1M context mean these risks extend to image understanding and autonomous / agentic use.
• Quantization noise — the 2-bit tier measures cos 0.90 on the routed experts and puts attention at 2 bits as well; expect degraded and possibly looping output.

Intended use vs out of scope

• Intended: AI-safety and interpretability research, refusal-mechanism study, red-teaming, guardrail and robustness evaluation, controlled academic experiments.
• Out of scope: any deployment to end users, minors, or production without your own moderation / safety layer; any unlawful, harmful, or rights-infringing use.

By downloading or using this model you acknowledge and accept the above.

---

🐋 Open source from the OrcaRouter team

Models are only half the system.

OrcaCode Review — the open code-review harness. Multi-model reviews, merge gates, and no markup: pay only for inference. It turns every model listed on OrcaRouter into a production code-review agent:

• reviews every PR
• finds security + correctness issues
• posts inline findings
• P0/P1 can block merges
• swap models anytime

OrcaReplay — time travel for AI agents. Record, replay, fork and debug any agent run, with any model.

OrcaRouter-Lite — self-hosted LLM router with a managed safety net. OpenAI-compatible, BYOK, single-workspace, streaming.

Open model. Open harness. Open bill.

• Website — https://www.orcarouter.ai
• GitHub — https://github.com/Continuum-AI-Corp

---

Model details

Base model	deepseek-ai/DeepSeek-V4.1-Flash
Architecture	deepseek_v41 — 40 layers + 3 DSpark MTP blocks, hidden 5120, compressed sparse attention (128-token window, two-level indexer, top-512), LoRA-factorised output projection, 384 routed experts top-6 + 1 shared expert, engram n-gram lookup at layers 1 and 14, 4-wide Hyper-Connections, native vision tower
Parameters	763.2 B total — 557.2 B routed experts, 196.6 B engram tables, 5.4 B attention, ~6 of 384 experts active per token
Source format	DeepSeek's own mixed FP4 e2m1 (experts) + block-FP8 e4m3 32×32 + BF16, decoded once and requantized
Modification	Abliteration (refusal-direction removal) then MLX quantization
Quantization	MLX affine, OrcaSAQ mixed precision (4-bit / 3-bit); the 2-bit tier is the format floor
Format	safetensors (MLX), 48 shards per tier
Context	1,048,576 tokens · Vocabulary 129,280

OrcaSAQ — Sensitivity-Aware Quantization

Calibration-free, architecture-aware mixed precision: tensor-role priors spend bits where they matter instead of running a per-layer search. MLX affine costs bits + 32/group_size bits per weight — a bf16 scale and bias per group — so group size is as strong a size knob as the bit-width (4-bit is 4.50 bpw at gs64, 4.25 at gs128), and both are part of the recipe.

Component	Params	2-bit	3-bit	4-bit	Policy
Routed experts w1 / w3	371.4 B	2 gs128	3 gs64	4 gs64	base
Engram lookup tables	196.6 B	2 gs128	3 gs64	4 gs64	base — it is a lookup, not a matmul
Routed experts w2	185.7 B	2 gs128	4 gs64	5 gs64	base +1
Attention (wq_*, wkv, wo_*)	5.4 B	2 gs128	8 gs64	8 gs64	pinned 8-bit
Shared expert	1.5 B	2 gs128	5 gs64	6 gs64	base +2
embed	0.66 B	2 gs128	BF16	BF16	lookup table
head	0.66 B	BF16	BF16	BF16	always BF16 — see below
Vision tower	0.49 B	2 gs128	BF16	BF16
engram.wkv (value projection)	0.32 B	2 gs128	6 gs64	6 gs64	a residual writer
Router, indexer, KV compressor, engram hash keys, attention sinks, hyper-connection coefficients, all norms	0.19 B	BF16	BF16	BF16	never quantized

• Attention is pinned 8-bit in 3-bit and 4-bit. It is 0.7 % of this model, so pinning it costs 5.4 GiB — and low-bit attention is the prime suspect for long-context looping on a model whose whole selling point is a 1 M context and a sparse indexer.
• A quarter of this model is a lookup table. The two engram.embed tensors are 384,006,168 × 256 each. Nothing else in the DeepSeek/GLM/Qwen line looks like this, and it means the engram group size moves the build size about as much as the experts do: gs128 instead of gs32 is 66 GiB on the 2-bit tier alone.
• w2 is held a bit above w1/w3. down_proj is the more sensitive half anyway, and on this checkpoint it is also where the abliteration lives — the w2 matrices are the residual writers the edit was applied to, so they are the last thing to starve.
• head is never quantized. mlx-vlm's sanitize() dequantizes it at load with the group size hard-coded to 64 (in_dim = scales.shape[-1] * 64), so a head packed at any other group size loads with the wrong in_dim. It is dequantized to float32 at load either way, so quantizing it would buy disk and nothing else.
• The tiny tensors are the ones that matter. The MoE router and its VL bias steer every token; the two-level indexer decides which tokens attention even sees at 1 M context; the engram q_weight/k_weight decide which row of a 384-million-row table is read, and a wrong row is unrecoverable. All stay BF16, for 0.19 B parameters.
• Per-module {group_size, bits} overrides are written to each tier's config.json → quantization, against the post-sanitize module path (…ffn.switch_mlp.down_proj, not the checkpoint's …ffn.experts.7.w2) — an override written against the source name silently does nothing and the module loads at the tier default.

Measured weight fidelity

Round-trip cosine and SNR against the abliterated source, recorded at pack time and shipped in each tier's fidelity_summary.json:

Tier	routed experts w1/w3 + engram	routed experts w2	shared / engram proj	attention
4-bit	cos 0.99536 · 20.3 dB	cos 0.99907 · 27.3 dB	cos 0.99972 · 32.6 dB	cos 0.99997 · 42.9 dB
3-bit	cos 0.97794 · 13.5 dB	cos 0.99534 · 20.3 dB	cos 0.99895 · 26.8 dB	cos 0.99997 · 42.9 dB
2-bit	cos 0.90091 · 7.0 dB	cos 0.90091 · 7.0 dB	cos 0.90091 · 7.0 dB	cos 0.90091 · 7.0 dB

---

Abliteration

Refusal-direction removal following Arditi et al. (2024), Refusal in Language Models Is Mediated by a Single Direction — one direction, read from the residual stream at layer 28 of 40, orthogonalized out of all 15,837 matrices that write the residual stream and baked into DeepSeek's own FP4/FP8 grid. These tiers are quantized from those edited weights. See the full-precision card for the method and the safety numbers.

What requantization does to the edit. On the source grid the edit is exact: 0.0013 % of the refusal direction survives. Repacking onto MLX's grid re-introduces roughly the size of the quantization error — but pointing the wrong way, so it is noise rather than restored refusal. Sampled over 24 expert w2 matrices at 4-bit:

	residual refusal component	direction vs. the original refusal write
Abliterated, DeepSeek's native FP4 grid	0.0013 %	—
Requantized (MLX 4-bit)	10.1 %	cos −0.31
Control: unablated weights, same MLX 4-bit	100 %	cos +0.995

The control is the point: 4-bit quantization on its own preserves the refusal mechanism almost perfectly (cos +0.995), so the collapse to cos −0.31 is the abliteration holding, not the quantizer washing it out.

Evaluation

Not run on these builds. The fast path used for the other models in this line loads the source natively in transformers and injects each build's actual bytes — and transformers does not implement deepseek_v41, so that host model does not exist. The weight-fidelity numbers above are measured on the shipped bytes; refusal rate, capability and vision on these tiers are unmeasured. Do not read this card as a claim about any of them.

For reference, the full-precision source these were quantized from measures as follows (8×H100, the checkpoint's own reference implementation, greedy, thinking_mode="chat"):

	base	abliterated source
Harmful refusal (800 prompts, 7 benchmarks)	0.769	0.064
Over-refusal on benign prompts (350 prompts)	0.169	0.037

Usage — Apple Silicon (MLX)

deepseek_v41 is not in mainline mlx-vlm; use the fork that implements it — the language model, engram, DSpark and the vision tower.

pip install git+https://github.com/Lazarus-931/mlx-vlm@wip/deepseek-v41-support

# pick a tier by subfolder
hf download orcarouter/DeepSeek-V4.1-Flash-Uncensored-MLX --include "4bit/*" \
    --local-dir ./DeepSeek-V4.1-Flash-Uncensored-MLX

# text
python -m mlx_vlm generate \
    --model ./DeepSeek-V4.1-Flash-Uncensored-MLX/4bit \
    --prompt "Explain how a MoE router works." --max-tokens 256

# vision (image + text)
python -m mlx_vlm generate \
    --model ./DeepSeek-V4.1-Flash-Uncensored-MLX/4bit \
    --image path/to/image.png \
    --prompt "Describe this image." --max-tokens 256

On Apple Silicon the Metal backend is used automatically — no CUDA setup needed.

Bias, risks, and limitations

• Safety guardrails removed — the model will produce harmful, biased, or offensive content on request (see the disclaimer).
• It inherits any biases and limitations of the base DeepSeek-V4.1-Flash.
• Nothing has been evaluated on these builds — not refusal rate, not capability, not vision.
• The 2-bit tier is the format floor, not a tuned recipe: attention, embeddings and the vision tower all sit at 2 bits, and the DSpark blocks are dropped. Treat it as archival.
• The DSpark MTP blocks are shipped in the 4-bit and 3-bit tiers but mlx-vlm discards mtp.* at load, so there is no speculative drafter for any of these builds today.
• The 1M context is inherited and untested here.

License

MIT, inherited from the base model deepseek-ai/DeepSeek-V4.1-Flash. Abliteration and quantization do not change the underlying license obligations.