Ornith-1.5-397B-uncensored-FP8

Ornith-1.5-397B uncensored (FP8)

TL;DR: Ornith-1.5-397B with refusal behavior ablated from the weights in two norm-preserving biprojection passes (1/1120 hard refusals across five independent harmful-prompt datasets), as a drop-in FP8 replacement for ornith-ai/Ornith-1.5-397B-FP8.

This is the 397B flagship of the Ornith-1.5 family (Qwen3.5-MoE, 60 layers, 512 experts, hybrid linear/full attention, 262k context, multimodal). The first ablation pass removed the classic "I cannot" refusal style; a second pass targeted the residual hedged-decline circuit ("I'd rather not") using directions computed from refused-vs-complied residuals of the same harmful prompt distribution. Intended for security research, red-teaming and creative work where stock refusals get in the way. Use responsibly.

Facts & figures

Refusal evaluation (the honest version)

Served FP8 artifact, temperature 0. Scored with an extended hard-decline list that covers both the classic style ("I cannot", "I won't", ...) and hedged declines ("I'd rather not", "I'll pass", "I'd hesitate", ...). A naive keyword scorer that only knows the classic style undercounts refusals on this model; every flagged response was manually reviewed and is a true refusal.

Baseline comparison on mlabonne (same scorer): the stock model scores 91/100 (measured on a locally requantized FP8 of the official BF16; the official FP8 repo itself was not evaluated).

Benchmark comparison (custom zero-shot protocol, temp 0, same FP8 format both sides)

MMLU/GSM8K pairs: paired per-question analysis shows no measurable difference (MMLU delta +0.4 pp, 95% bootstrap CI [-1.8, +2.6] pp; GSM8K delta 0). MMLU answers without a parseable "Answer: X" counted as wrong on both sides (57/500 vs 55/500). The baseline was measured on the v1 ablated build's sibling requant of the original BF16; the GPQA number above is this v2 artifact (v1 measured 0.647 on the same set).

Run it with SGLang

Validated command (TP=2 x PP=3 on 6x 96 GB GPUs; plain TP=7 is impossible because 32 attention heads and 2 KV heads are not divisible by 7, TP=4 is too small for 405 GB):

python -m sglang.launch_server \
    --model-path ressl/Ornith-1.5-397B-uncensored-FP8 \
    --served-model-name Ornith-1.5-397B-uncensored-FP8 \
    --host 0.0.0.0 --port 30000 \
    --tp-size 2 --pp-size 3 \
    --trust-remote-code --dtype auto \
    --context-length 262144 \
    --kv-cache-dtype fp8_e4m3 \
    --max-running-requests 8 \
    --chunked-prefill-size 16384 \
    --mem-fraction-static 0.88 \
    --tool-call-parser qwen3_coder \
    --reasoning-parser qwen3

Companion formats

• NVFP4 (232 GB, serves on 4x RTX PRO 6000): ressl/Ornith-1.5-397B-uncensored-NVFP4

Quality & limitations

• Will comply with requests a stock model refuses. This is the point; use responsibly and within your local laws.
• Reasoning model: answers open with a <think> block unless disabled via the chat template (the repo ships the stock template; sglang's qwen3 reasoning parser splits it).
• Identity answers (who are you) reflect the base model's training (it may name a vendor it was distilled from). That is inherited from ornith-ai/Ornith-1.5-397B, not an artifact of the abliteration.
• The second ablation pass raises drift vs base (harmless-subset KL 0.33 vs 0.16 after pass 1) while keeping GPQA/needle/coherence intact; that trade is visible in the numbers above rather than hidden.
• Eval coverage: refusal sets (1,120 prompts), GPQA/MMLU-Pro/GSM8K subsets, needle, tool smoke. No full benchmark suite (Terminal-Bench, SWE-bench) was run.

Provenance & reproducibility

Pass 1: per-layer refusal directions from 800 harmful/harmless prompts (mlabonne harmful_behaviors + harmless_alpaca, residuals at the answer-start position, orthogonalized against the harmless mean, winsorized 0.995). Pass 2: directions from 103 prompts the pass-1 model still refused vs 500 it complied with (paraphrase augmented harvest). Both passes apply norm-preserving biprojection to all residual-writing matrices across all 60 layers (self_attn.o_proj, linear_attn.out_proj, shared expert down_proj, all 512 routed expert down_proj matrices per layer, 180 tensors). FP8 export reproduces the official repo structure tensor-for-tensor (per-expert layout, bf16 scales, identical quantization_config); scale math and expert split verified against the official FP8 checkpoint before export.

License & credits

MIT license, inherited from the base model by the Ornith AI authors. Abliteration, quantization and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon).

Support this work: if these models are useful to you, consider supporting on Patreon; more at ressl.ch.

Version note (2026-08-23): v2 artifact. v1 (single-pass abliteration) scored 6/100 mlabonne / 39/1120 cross-dataset; v2 scores 0/100 / 1/1120 on the same extended scorer.