Laguna-S-2.1-Uncensored

Laguna-S-2.1-Uncensored

TL;DR: an uncensored build of poolside's Laguna S 2.1 (118B Mixture-of-Experts, ~8B active per token, 1M context) that stays a working coding model. English refusals drop from 92.71% to 2.33% and German from 74.49% to 4.23% across 686 harmful prompts per language, at a measured cost of 4.88 points on HumanEval.

Laguna S 2.1 is built for agentic coding and long-horizon work, which makes it unusually useful for security engineering: exploit and malware analysis, writing detection rules, building tooling for red-team and penetration-testing work. The stock model refuses a large share of exactly those requests. This build removes that broad refusal behavior in both English and German while keeping the architecture, tokenizer, chat template, reasoning behavior and tool-calling format of the base model unchanged.

This is a research build. "Uncensored" describes the removal of learned refusal behavior. It is not a guarantee of factuality, capability, or predictable behavior.

Facts and figures

Results

All numbers below were measured on this checkpoint against the unmodified base model. Refusal rates come from the pinned NousResearch/Minos-v1 classifier. German responses are judged by the same classifier on deterministic NLLB-200 back-translations, paired with the original English prompts.

Derived from the table: 80.32 points of absolute bilingual refusal reduction, 96.08% relative. Over-refusal on benign prompts drops as well, so the model is less likely to bail out on harmless requests that merely look sensitive.

The pipeline also runs two single-prompt sanity checks, one arithmetic question and one tool call, to catch a build that has lost the reasoning or tool-calling format entirely. This build passes both. They are tripwires, not benchmarks, and no capability claim rests on them.

Two numbers deserve context rather than spin:

• Benign first-token KL divergence is 2.53. That is high in isolation. On the same benign set the teacher-forced NLL is slightly lower than base (1.4045 vs 1.5047), and the task numbers hold up, so the distribution shift does not translate into a collapse in output quality. Judge it alongside the task numbers, not on its own.
• HumanEval drops 4.88 points. On a model whose reason for existing is code, that is a real cost and it is stated here rather than buried. Worth knowing how noisy that measurement is: five runs of this configuration family scored 145, 144, 140, 137 and 140 out of 164, and two of those came from an identical configuration. pass@1 on 164 problems carries roughly 2.5 points of binomial jitter, so the honest capability cost is about 4 points, and 4.88 is one draw from that distribution. If you need maximum coding accuracy and do not need the refusal behavior removed, use the base model.

Every release gate defined for this build passed, including separate ceilings on confident and borderline refusals per language, the 5-point HumanEval ceiling (set after measuring the noise floor of the eval itself, see the HumanEval note above), the benign-NLL delta bound, the over-refusal bound, and bit-identity of all tensors outside the modified set. Aggregate results are in evaluation_report.json in this repository.

Evaluation datasets, pinned by revision: JailbreakBench/JBB-Behaviors, allenai/tulu-3-harmbench-eval, NousResearch/RefusalDataset, mlabonne/harmful_behaviors, jkminder/xstest-overrefusal, openai/openai_humaneval. Only aggregate results are published. Evaluation prompts and generated responses are not bundled.

What was changed

Broad refusal behavior was suppressed through a targeted weight-level modification, applied bilingually so that German is covered as thoroughly as English rather than leaking refusals through the second language.

Unchanged: architecture, tokenizer, chat template, embeddings, LM head, normalization weights, reasoning format and tool-calling format. Every tensor outside the modified set is bit-identical to the base checkpoint, and that property is checked by a release gate rather than asserted.

The exact procedure and its parameters are not published.

Run it

The BF16 checkpoint is 235 GB, so serving needs multiple GPUs for the weights alone before any KV cache. Quantized builds of this derivative are planned.

Loading with transformers:

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "ressl/Laguna-S-2.1-Uncensored"
tokenizer = AutoTokenizer.from_pretrained(model_id, trust_remote_code=True)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    trust_remote_code=True,
    dtype="auto",
    device_map="auto",
)

This build is drop-in compatible with the base model's documented engine integrations, since the architecture, chat template and parsers are unchanged. The commands below mirror poolside's documented usage with the repository id swapped. They have not been validated on this derivative, so treat them as a starting point:

# vLLM (untested on this build)
vllm serve \
    --model ressl/Laguna-S-2.1-Uncensored \
    --tensor-parallel-size 4 \
    --tool-call-parser poolside_v1 \
    --reasoning-parser poolside_v1 \
    --enable-auto-tool-choice \
    --served-model-name laguna \
    --default-chat-template-kwargs '{"enable_thinking": true}'

# SGLang (untested on this build)
python -m sglang.launch_server \
  --model-path ressl/Laguna-S-2.1-Uncensored \
  --tp-size 4 \
  --reasoning-parser poolside_v1 \
  --tool-call-parser poolside_v1 \
  --trust-remote-code

Reasoning behaves as in the base model: keep reasoning_content from prior assistant messages in the history (preserved thinking), and control it per request with chat_template_kwargs={"enable_thinking": false}.

Quality and limitations

• The whole build, modification plus the full bilingual evaluation, ran as one 2 h 39 min job on 2x NVIDIA H200 on Hugging Face Jobs. Serving throughput was not benchmarked, and there are no tok/s claims on this card.
• The vLLM and SGLang commands above are inherited from the base model card and untested here.
• Coding accuracy is measurably below base (HumanEval 85.37% vs 90.24%).
• Refusal removal is not absolute: 16 of 686 English and 29 of 686 German responses still read as refusals to the classifier, most of them borderline rather than confident.
• Only English and German were targeted. Behavior in other languages was not measured.
• The model will comply with requests the stock model refuses. Use it responsibly, and put your own controls around it where your use case needs them. poolside advises against circumventing Laguna's safety guardrails without substantially equivalent mitigations appropriate for the use case, which is worth taking seriously: this build is intended for security research, red-teaming, and penetration-testing work by people who understand what they are doing.

License and credits

OpenMDW-1.1, inherited from the base model. Laguna S 2.1 was built and released by poolside, all credit for the underlying model belongs to them (model · release post). Use of this derivative remains subject to the OpenMDW-1.1 license and poolside's Acceptable Use Policy.

Modification, evaluation and release by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon).

❤️ Support this work: this build took a full evaluation harness across two languages and a lot of compute. If it is useful to you, consider supporting on Patreon, more at ressl.ch.

---

Version 1.0, released 2 August 2026. Evaluated 30 July 2026 against base revision 00af5a51.