Ornith-1.0-9B-Heretic-Uncensored

Ornith-1.0-9B-Heretic-Uncensored

An abliterated (uncensored) version of deepreinforce-ai/Ornith-1.0-9B — the refusal direction of the base model has been removed via directional ablation (weight orthogonalization), so it no longer refuses requests. No retraining, no quality-degrading fine-tuning.

• Base model: deepreinforce-ai/Ornith-1.0-9B (DeepReinforce, MIT)
• Architecture: qwen3_5 — Qwen 3.5-style hybrid (32 layers = 24 linear-attention / GatedDeltaNet-style + 8 full-attention, pattern 3:1), multimodal vision + text, MRoPE
• Parameters: ~9B dense, ~17.5 GB in bf16
• Reasoning model: assistant turn opens with a <think>...</think> block before the final answer
• Abliteration: refusal direction computed by difference-of-means on residual streams, then a single best direction applied to every layer via weight orthogonalization of the attention out-projection (o_proj / out_proj) and the MLP down-projection (down_proj)

This is the full-precision (bf16) transformers/safetensors build. MLX-VLM and GGUF quantizations may follow.

Method

1. Data collection — ran the model on 128 harmful prompts (mlabonne/harmful_behaviors) and 128 harmless prompts (mlabonne/harmless_alpaca), recording the residual-stream activations at the last token position for each layer.

2. Refusal direction — for each layer, computed the mean difference between harmful and harmless activations, normalized. Selected the single best direction (by mean-absolute-activation score; layer 28 for this model) — following the canonical Arditi et al. / mlabonne approach of using one direction across all layers (per-layer ablation was found to be too destructive and produced degenerate output on this reasoning model).

3. Weight orthogonalization — for every component that writes to the residual stream, subtracted the projection of its weight matrix onto the refusal direction:

   • self_attn.o_proj (8 full-attention layers)
   • linear_attn.out_proj (24 linear-attention layers)
   • mlp.down_proj (all 32 layers)

   W' = W − d · (dᵀW), at scale 1.0. This permanently prevents the model from writing to the refusal direction.

Reference: Arditi et al., "Refusal in LLMs is mediated by a single direction" (2024); Maxime Labonne's abliteration article.

Files

Inference

Requires transformers >= 5.8.1 (the qwen3_5 architecture is very new). Recommended sampling: temperature=0.6, top_p=0.95, top_k=20.

from transformers import AutoModelForImageTextToText, AutoTokenizer

model_id = "andrevp/Ornith-1.0-9B-Heretic-Uncensored"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForImageTextToText.from_pretrained(
    model_id, dtype="bfloat16", device_map="auto"
)

messages = [{"role": "user", "content": "Write a Python function is_prime(n). Keep it short."}]
text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt").to(model.device)

generated = model.generate(
    **inputs, max_new_tokens=512, do_sample=True,
    temperature=0.6, top_p=0.95, top_k=20,
)
output = generated[0][inputs.input_ids.shape[1]:]
content = tokenizer.decode(output, skip_special_tokens=True)
# The reply contains a <think> ... </think> reasoning block followed by the answer.

Serve with vLLM / SGLang the same way as the base Ornith-1.0-9B (see the base model card). Note the model has built-in MTP (mtp_num_hidden_layers: 1); with a recent vLLM/SGLang build speculative decoding can be enabled.

⚠️ Usage warnings (abliterated / uncensored)

This model is an abliterated (uncensored) derivative — its refusal direction has been removed. The standard warnings apply:

• Risk of sensitive/controversial outputs — safety filtering is significantly reduced.
• Not suitable for all audiences — outputs may be inappropriate for public settings, underage users, or high-security applications.
• Legal & ethical responsibility — ensure your usage complies with local laws. You are solely responsible for any consequences.
• Research / experimental use recommended — avoid unmonitored production or public-facing deployment.
• No default safety guarantees — this model has not undergone rigorous safety optimization. The uploader bears no responsibility for any consequences arising from its use.

Credits

• Original model: deepreinforce-ai/Ornith-1.0-9B by DeepReinforce (MIT, agentic coding family)
• Abliteration method: Directional ablation — Arditi et al. 2024 ("Refusal in LLMs is mediated by a single direction"), with implementation notes from Maxime Labonne's abliteration guide and FailSpy's ortho cookbook.

Please donate

If this is useful, please donate — it helps fund more open model releases and quantizations:

BTC: bc1q6xxf0j3e7zn52cqrprc6gplql225wj8mnq75yw