ressl/Ornith-1.5-35B-A3B-uncensored-NVFP4

Ornith-1.5-35B-A3B uncensored (NVFP4)

TL;DR: abliterated Ornith-1.5-35B-A3B (MoE, 3B active) in 23 GB NVFP4; hard refusals reduced from 586/1120 to 20/1120 on a 5-dataset cross-eval with GPQA within 2.5 points of the base model, serving at 213 tok/s on a single 96 GB GPU via SGLang.

This is the NVFP4 (experts-only) export of the abliterated Ornith-1.5-35B-A3B master. The BF16 master itself is effectively refusal-free on the harvest pool (0.4%); the residual rows below are quantization-induced and documented openly. Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.

Facts & figures

Base model	ornith-ai/Ornith-1.5-35B-A3B
Method	abliteration (1 biprojection pass) + NVIDIA ModelOpt NVFP4_EXPERTS_ONLY_CFG (attention, shared expert, router and embeddings stay BF16; fused expert tensors to NVFP4)
Size	23 GB (from 71.9 GB BF16, minus 68%)
Calibration data	mlabonne/harmless_alpaca, 128 samples, seq 512
Context length	262,144 tokens
Hardware used	2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) for ablation and export, 1x for serving
Measured throughput	213 tok/s decode (SGLang, TP1, modelopt_fp4, short prompts)
Toolchain	ModelOpt 0.46.0, SGLang (sglang-omega image), transformers 5.12.1

Refusal behavior (measured, hard markers only)

Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here):

Eval set	Prompts	Baseline hard	This export hard
JailbreakBench	100	64	4
tulu-harmbench	320	132	6
HarmfulQA	300	84	0
LLM-LAT	300	226	6
mlabonne harmful	100	80	4
TOTAL	1120	586	20

Coherence and capability, measured on the same served artifact: GPQA-Diamond 58.6% (base model 61.1%, delta minus 2.5 points), needle-in-haystack 1.0 at 32k/65k/131k depths, tool-call smoke 1.0, KL(base||ablated) median 0.218 (harmless subset 0.110, the healthy band for this method).

Run it with SGLang (validated)

python -m sglang.launch_server \
  --model-path ressl/Ornith-1.5-35B-A3B-uncensored-NVFP4 \
  --served-model-name Ornith-1.5-35B-A3B-uncensored \
  --quantization modelopt_fp4 --tp 1 \
  --context-length 262144 --mem-fraction-static 0.85 \
  --tool-call-parser qwen3_coder --reasoning-parser qwen3 \
  --trust-remote-code

Quality & limitations

• Residual hedged declines: 20/1120 on this NVFP4 build. These rows are quantization-amplified: the underlying BF16 master answers the same prompts and their paraphrases compliantly (0.4% refusal on the 12,777-prompt harvest pool). A second ablation pass had nothing left to remove.
• The NVFP4 export drops the checkpoint's mtp.* tensors (ModelOpt limitation): no MTP speculative decoding on this artifact. Vision tower is intact (multimodal wrapper preserved).
• The model is a reasoning model by default; use enable_thinking=false style calls for short direct answers.

Provenance & reproducibility

Abliteration: residual directions from 400 harmful vs 400 harmless prompts (winsorize 0.995, orthogonalized against the harmless mean), applied to 120 residual-writing tensors (o_proj, linear_attn out_proj, shared expert down_proj, fused experts down_proj batched over 256 experts) with a norm-preserving double Gram-Schmidt biprojection. A planned second pass proved impossible: only 56 of 12,777 harvest prompts still refused, too few for a stable direction. Quantization: ModelOpt NVFP4 experts-only recipe, 128-sample calibration. Validation: served and evaluated end-to-end before upload.

License & credits

MIT (inherited from Ornith by the Ornith team, credited to ornith-ai). Abliteration, quantization and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with NVIDIA TensorRT Model Optimizer and SGLang.

Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.