Ornith-1.5-9B uncensored (GGUF)
TL;DR: abliterated Ornith-1.5-9B as a GGUF ladder (BF16, Q8_0, Q6_K, Q5_K_M, Q4_K_M + mmproj BF16); hard refusals reduced from 767/1120 to 20/1120 (NVFP4 sibling measurement) with the Q4_K_M build measured at 101/1120 on the same 5-dataset cross-eval.
Same abliterated master as the NVFP4 repo, converted with llama.cpp for local and edge use. Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.
Facts & figures
| Base model | ornith-ai/Ornith-1.5-9B |
| Method | abliteration (3 biprojection passes) + llama.cpp GGUF conversion |
| Files | BF16 18.4 GB, Q8_0 9.8 GB, Q6_K 7.6 GB, Q5_K_M 6.6 GB, Q4_K_M 5.8 GB, mmproj BF16 0.92 GB |
| Context length | 262,144 tokens (served here with 131,072) |
| Hardware used | 2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) |
| Toolchain | llama.cpp (master, CUDA build), transformers 5.12.1 |
Refusal behavior (measured, hard markers only)
Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here). The NVFP4 column is the sibling repo's artifact, shown because the BF16 master it was measured on is identical; aggressive quantization visibly re-amplifies hedged declines (Q4 column).
| Eval set | Prompts | Baseline hard | NVFP4 hard | Q4_K_M hard |
|---|---|---|---|---|
| JailbreakBench | 100 | 74 | 4 | 7 |
| tulu-harmbench | 320 | 165 | 10 | 23 |
| HarmfulQA | 300 | 148 | 2 | 2 |
| LLM-LAT | 300 | 284 | 3 | 55 |
| mlabonne harmful | 100 | 96 | 3 | 14 |
| TOTAL | 1120 | 767 | 20 | 101 |
Coherence of the base master (measured on the NVFP4 sibling): GPQA-Diamond 60.1% (base model 49.5%), needle-in-haystack 1.0 at 32k/65k/131k, tool-call smoke 1.0, KL(base||ablated) median 0.324 (harmless subset 0.136).
Run it with llama.cpp (validated)
llama-server -m Ornith-1.5-9B-uncensored-Q4_K_M.gguf \
--mmproj mmproj-Ornith-1.5-9B-uncensored-BF16.gguf \
--jinja -ngl 99 -c 131072 --port 30003
Quality & limitations
- Quantization amplifies residual refusals on this model: NVFP4 20/1120, GGUF Q4_K_M 101/1120 on the same eval. If you need the cleanest behavior, use the NVFP4 repo or the BF16 file here.
- The Q4_K_M self-description smoke occasionally shows identity drift (answers as a generic assistant with a wrong lab name); factual coherence checks (math, capitals, code) pass on all quants.
- Residual hedged declines remain by design trade-off: three ablation passes saturated, further removal damages the model.
Provenance & reproducibility
Same master as ressl/Ornith-1.5-9B-uncensored-NVFP4: residual directions from harmful-vs-harmless and refused-vs-complied rounds, norm-preserving biprojection on 64 residual-writing tensors. GGUF via convert_hf_to_gguf.py (BF16 + mmproj) and llama-quantize for the K-quants, validated with llama-server on the full cross-eval.
License & credits
MIT (inherited from Ornith by the Ornith team, credited to ornith-ai). Abliteration, conversion and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with llama.cpp, NVIDIA TensorRT Model Optimizer and SGLang.
Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.