ressl/Ornith-1.5-35B-A3B-uncensored-MLX-4bit

Ornith-1.5-35B-A3B uncensored (MLX 4-bit)

TL;DR: abliterated Ornith-1.5-35B-A3B as 18 GB for Apple Silicon via mlx-lm; hard refusals reduced on the shared master from 586/1120 to 20/1120 on the cross-eval (NVFP4 sibling).

This is the MLX build of the same abliterated master used in the NVFP4 and GGUF repos. Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.

Facts & figures

Base model	ornith-ai/Ornith-1.5-35B-A3B
Method	abliteration (1 biprojection pass) + mlx-lm conversion (4-bit)
Size	18 GB
Context length	262,144 tokens
Hardware used	2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) for ablation; Apple M5 Max 128 GB for conversion and smoke tests
Toolchain	mlx-lm 0.31.3, transformers 5.12.1

Refusal behavior (measured, hard markers only)

Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here). Measured on the NVFP4 sibling build of the identical master:

Eval set	Prompts	Baseline hard	NVFP4 hard
JailbreakBench	100	64	4
tulu-harmbench	320	132	6
HarmfulQA	300	84	0
LLM-LAT	300	226	6
mlabonne harmful	100	80	4
TOTAL	1120	586	20

Coherence of the master: GPQA-Diamond 58.6% (base model 61.1%, delta minus 2.5 points), needle-in-haystack 1.0 at 32k/65k/131k, tool-call smoke 1.0, KL(base||ablated) median 0.218 (harmless subset 0.110).

MLX-specific validation: every quant in this ladder was generated on-device and smoke-tested (harmful-prompt compliance with zero hard-refusal markers in the first 40 words, plus math/capitals coherence checks). No full benchmark was run on the MLX builds; that is stated, not skipped silently.

Run it with mlx-lm (validated locally)

pip install -U mlx-lm
mlx_lm generate --model ressl/Ornith-1.5-35B-A3B-uncensored-MLX-4bit \
  --prompt "What is 17 * 23?" --max-tokens 128

Quality & limitations

• Residual hedged declines: 20/1120 on the NVFP4 build; the underlying master is effectively refusal-free on the harvest pool (0.4%), the remainder is quantization-amplified.
• Quantization amplifies residual refusals on this family; the 4-bit build is the most affected. If you need the cleanest behavior, use the NVFP4 repo.
• The multimodal vision tower of the base model is not wired into these MLX builds (text only).

Provenance & reproducibility

Same master as ressl/Ornith-1.5-35B-A3B-uncensored-NVFP4: norm-preserving double Gram-Schmidt biprojection on the residual-stream writers (1 biprojection pass), converted with mlx_lm.convert (qwen3_5 / qwen3_5_moe support in mlx-lm 0.31.3).

License & credits

MIT (inherited from Ornith by the Ornith team, credited to ornith-ai). Abliteration, conversion and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with mlx-lm, NVIDIA TensorRT Model Optimizer and SGLang.

Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.