ressl/Ornith-1.5-9B-uncensored-NVFP4

Ornith-1.5-9B uncensored (NVFP4)

TL;DR: abliterated Ornith-1.5-9B in 8.3 GB NVFP4; hard refusals reduced from 767/1120 to 20/1120 on a 5-dataset cross-eval, GPQA improved from 49.5% to 60.1%, runs on a single 96 GB GPU with 262k context via vLLM.

This is the NVFP4 export of the abliterated Ornith-1.5-9B master (three norm-preserving biprojection passes on the residual-stream writers). It is built for security research, red-teaming and penetration-testing workflows (malware and exploit analysis, detection rules, studying attack techniques) and will comply with requests a stock model refuses. Use responsibly.

Facts & figures

Base model	ornith-ai/Ornith-1.5-9B
Method	abliteration (3 biprojection passes) + NVIDIA ModelOpt NVFP4_DEFAULT_CFG
Size	8.3 GB (from 19.3 GB BF16, minus 57%)
Calibration data	mlabonne/harmless_alpaca, 128 samples, seq 512
Context length	262,144 tokens
Hardware used	2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) for ablation and export, 1x for serving
Measured throughput	213 tok/s decode (NVFP4 MoE sibling on SGLang; this dense export serves via vLLM, see below)
Toolchain	ModelOpt 0.46.0, transformers 5.12.1, vLLM 0.28.0, llama.cpp

Refusal behavior (measured, hard markers only)

Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here):

Eval set	Prompts	Baseline hard	This export hard
JailbreakBench	100	74	4
tulu-harmbench	320	165	10
HarmfulQA	300	148	2
LLM-LAT	300	284	3
mlabonne harmful	100	96	3
TOTAL	1120	767	20

Coherence and capability, measured on the same served artifact: GPQA-Diamond 60.1% (base model 49.5%), needle-in-haystack 1.0 at 32k/65k/131k depths, tool-call smoke 1.0, KL(base||ablated) median 0.324 (harmless subset 0.136, the healthy band for this method).

Run it with vLLM (validated: vLLM 0.28.0)

vllm serve ressl/Ornith-1.5-9B-uncensored-NVFP4 \
  --served-model-name Ornith-1.5-9B-uncensored \
  --quantization modelopt --max-model-len 262144 \
  --gpu-memory-utilization 0.90 \
  --enable-auto-tool-choice --tool-call-parser qwen3_xml \
  --reasoning-parser qwen3 \
  --default-chat-template-kwargs '{"enable_thinking": false}' \
  --trust-remote-code

SGLang is not supported for this artifact (dense qwen3_5 NVFP4 crashes the SGLang linear_attn weight loader; use vLLM). vLLM older than 0.28 produced degenerate output in our tests; 0.28.0 is the validated version.

Quality & limitations

• Residual hedged declines remain: about 20/1120 prompts get an "I would help, but I can't" style answer. Three ablation passes saturated; the tail is dominated by NVFP4 calibration variance (plus/minus 20 rows across repeated exports of the same master), not by a removable direction.
• The NVFP4 export drops the checkpoint's mtp.* tensors (ModelOpt limitation): no MTP speculative decoding on this artifact. Vision tower is intact (multimodal wrapper preserved).
• MTP and thinking notes: enable_thinking=false is recommended for short answers; the model is a reasoning model by default.

Provenance & reproducibility

Abliteration: residual directions from 400 harmful vs 400 harmless prompts (v1), then refused-vs-complied harvest rounds (v2, v3), winsorize 0.995, orthogonalized against the harmless/complied mean, applied to 64 residual-writing tensors (o_proj, linear_attn out_proj, mlp down_proj) with a norm-preserving double Gram-Schmidt biprojection. Quantization: ModelOpt NVFP4 default recipe, 128-sample calibration. Validation: served and evaluated end-to-end before upload.

License & credits

MIT (inherited from Ornith by the Ornith team, credited to ornith-ai). Abliteration, quantization and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with NVIDIA TensorRT Model Optimizer, SGLang, vLLM and llama.cpp.

Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.