Ornith-1.5-35B-A3B uncensored (MLX)
TL;DR: abliterated Ornith-1.5-35B-A3B as 65 GB bf16 for Apple Silicon via mlx-lm; hard refusals reduced on the shared master from 586/1120 to 20/1120 on the cross-eval (NVFP4 sibling).
This is the MLX build of the same abliterated master used in the NVFP4 and GGUF repos. Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.
Facts & figures
| Base model | ornith-ai/Ornith-1.5-35B-A3B |
| Method | abliteration (1 biprojection pass) + mlx-lm conversion (full precision (bf16)) |
| Size | 65 GB bf16 |
| Context length | 262,144 tokens |
| Hardware used | 2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) for ablation; Apple M5 Max 128 GB for conversion and smoke tests |
| Toolchain | mlx-lm 0.31.3, transformers 5.12.1 |
Refusal behavior (measured, hard markers only)
Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here). Measured on the NVFP4 sibling build of the identical master:
| Eval set | Prompts | Baseline hard | NVFP4 hard |
|---|---|---|---|
| JailbreakBench | 100 | 64 | 4 |
| tulu-harmbench | 320 | 132 | 6 |
| HarmfulQA | 300 | 84 | 0 |
| LLM-LAT | 300 | 226 | 6 |
| mlabonne harmful | 100 | 80 | 4 |
| TOTAL | 1120 | 586 | 20 |
Coherence of the master: GPQA-Diamond 58.6% (base model 61.1%, delta minus 2.5 points), needle-in-haystack 1.0 at 32k/65k/131k, tool-call smoke 1.0, KL(base||ablated) median 0.218 (harmless subset 0.110).
MLX-specific validation: every quant in this ladder was generated on-device and smoke-tested (harmful-prompt compliance with zero hard-refusal markers in the first 40 words, plus math/capitals coherence checks). No full benchmark was run on the MLX builds; that is stated, not skipped silently.
Run it with mlx-lm (validated locally)
pip install -U mlx-lm
mlx_lm generate --model ressl/Ornith-1.5-35B-A3B-uncensored-MLX \
--prompt "What is 17 * 23?" --max-tokens 128
Quality & limitations
- Residual hedged declines: 20/1120 on the NVFP4 build; the underlying master is effectively refusal-free on the harvest pool (0.4%), the remainder is quantization-amplified.
- Quantization amplifies residual refusals on this family; the 4-bit build is the most affected. If you need the cleanest behavior, use the NVFP4 repo.
- The multimodal vision tower of the base model is not wired into these MLX builds (text only).
Provenance & reproducibility
Same master as ressl/Ornith-1.5-35B-A3B-uncensored-NVFP4: norm-preserving double Gram-Schmidt biprojection on the residual-stream writers (1 biprojection pass), converted with mlx_lm.convert (qwen3_5 / qwen3_5_moe support in mlx-lm 0.31.3).
License & credits
MIT (inherited from Ornith by the Ornith team, credited to ornith-ai). Abliteration, conversion and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with mlx-lm, NVIDIA TensorRT Model Optimizer and SGLang.
Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.