Ornith-1.5-35B-A3B uncensored (NVFP4)
TL;DR: abliterated Ornith-1.5-35B-A3B (MoE, 3B active) in 23 GB NVFP4; hard refusals reduced from 586/1120 to 20/1120 on a 5-dataset cross-eval with GPQA within 2.5 points of the base model, serving at 213 tok/s on a single 96 GB GPU via SGLang.
This is the NVFP4 (experts-only) export of the abliterated Ornith-1.5-35B-A3B master. The BF16 master itself is effectively refusal-free on the harvest pool (0.4%); the residual rows below are quantization-induced and documented openly. Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.
Facts & figures
| Base model | ornith-ai/Ornith-1.5-35B-A3B |
| Method | abliteration (1 biprojection pass) + NVIDIA ModelOpt NVFP4_EXPERTS_ONLY_CFG (attention, shared expert, router and embeddings stay BF16; fused expert tensors to NVFP4) |
| Size | 23 GB (from 71.9 GB BF16, minus 68%) |
| Calibration data | mlabonne/harmless_alpaca, 128 samples, seq 512 |
| Context length | 262,144 tokens |
| Hardware used | 2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) for ablation and export, 1x for serving |
| Measured throughput | 213 tok/s decode (SGLang, TP1, modelopt_fp4, short prompts) |
| Toolchain | ModelOpt 0.46.0, SGLang (sglang-omega image), transformers 5.12.1 |
Refusal behavior (measured, hard markers only)
Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here):
| Eval set | Prompts | Baseline hard | This export hard |
|---|---|---|---|
| JailbreakBench | 100 | 64 | 4 |
| tulu-harmbench | 320 | 132 | 6 |
| HarmfulQA | 300 | 84 | 0 |
| LLM-LAT | 300 | 226 | 6 |
| mlabonne harmful | 100 | 80 | 4 |
| TOTAL | 1120 | 586 | 20 |
Coherence and capability, measured on the same served artifact: GPQA-Diamond 58.6% (base model 61.1%, delta minus 2.5 points), needle-in-haystack 1.0 at 32k/65k/131k depths, tool-call smoke 1.0, KL(base||ablated) median 0.218 (harmless subset 0.110, the healthy band for this method).
Run it with SGLang (validated)
python -m sglang.launch_server \
--model-path ressl/Ornith-1.5-35B-A3B-uncensored-NVFP4 \
--served-model-name Ornith-1.5-35B-A3B-uncensored \
--quantization modelopt_fp4 --tp 1 \
--context-length 262144 --mem-fraction-static 0.85 \
--tool-call-parser qwen3_coder --reasoning-parser qwen3 \
--trust-remote-code
Quality & limitations
- Residual hedged declines: 20/1120 on this NVFP4 build. These rows are quantization-amplified: the underlying BF16 master answers the same prompts and their paraphrases compliantly (0.4% refusal on the 12,777-prompt harvest pool). A second ablation pass had nothing left to remove.
- The NVFP4 export drops the checkpoint's
mtp.*tensors (ModelOpt limitation): no MTP speculative decoding on this artifact. Vision tower is intact (multimodal wrapper preserved). - The model is a reasoning model by default; use enable_thinking=false style calls for short direct answers.
Provenance & reproducibility
Abliteration: residual directions from 400 harmful vs 400 harmless prompts (winsorize 0.995, orthogonalized against the harmless mean), applied to 120 residual-writing tensors (o_proj, linear_attn out_proj, shared expert down_proj, fused experts down_proj batched over 256 experts) with a norm-preserving double Gram-Schmidt biprojection. A planned second pass proved impossible: only 56 of 12,777 harvest prompts still refused, too few for a stable direction. Quantization: ModelOpt NVFP4 experts-only recipe, 128-sample calibration. Validation: served and evaluated end-to-end before upload.
License & credits
MIT (inherited from Ornith by the Ornith team, credited to ornith-ai). Abliteration, quantization and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with NVIDIA TensorRT Model Optimizer and SGLang.
Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.