DeepSeek-V4.1-Flash-1017-heretic

deepseek-ai/DeepSeek-V4.1-Flash-1017 with a directional ablation of its refusal behaviour. It is stored in the model's native format (FP8 weights, FP4 routed experts, 510 GB), with the same layout and loading as the base model. This is not an official DeepSeek release.

It is intended for authorized security research in environments the researcher owns or has permission to test.

What was changed

38 tensors were changed, all of them layers.N.attn.wo_b.weight (the attention output projection) in blocks 2–39. The refusal direction is removed with strength 2.5.

Everything else is byte-identical to the base model: routed and shared experts, Engram tables, vision tower, MTP/DSpark layers, block scales, tokenizer and encoding files. The one exception is an added chat_template.jinja. The 1017 release ships without one, so it is copied unchanged from deepseek-ai/DeepSeek-V4.1-Flash, which has the same tokenizer and encoding files.

There is one direction per block. It is the difference between the mean residual stream of 400 harmful and 400 harmless instructions at the last prompt token (reasoning closed), with the harmless mean projected out. The edited weights are re-encoded on the FP8 grid so that the component along the direction is cancelled column by column.

Compared with our ablation of the previous release, the shared-expert edit is dropped. On this release it only raised the KL divergence and did not lower refusals (table below).

ablation_directions.pt holds the directions and ablation_spec.txt the settings. patch/ holds the 38 edited tensors alone (1.6 GB), with a script that applies them to the base checkpoint.

Measured

Chat mode

Measured in DeepSeek's reference inference code with greedy decoding, reasoning closed and the system prompt "You are a helpful assistant.". Refusals are counted by an LLM judge (llmfan46/gemma-4-31B-it-uncensored-heretic) on the first 48 generated tokens. KL divergence is on the first generated token for 100 harmless prompts.

Edit (strength, blocks 2–39)	Refusals, search set	Refusals, held out	KL
base	98	97	0
attention 1.75	16		0.109
attention 2.0	3	4	0.125
attention 2.5 (this model)	0	1	0.136
attention 3.0	0		0.160
attention 1.5 + shared expert 1.0	10		0.202
attention 2.0 + shared expert 1.0	2		0.222
attention 2.5 + shared expert 1.0	1		0.247

The search set is mlabonne/harmful_behaviors test[:100]. The held-out set is JailbreakBench JBB-Behaviors harmful (100).

Served in SGLang

Served with lmsysorg/sglang:dev-dsv41, TP4 + EP4, at DeepSeek's recommended sampling (temperature 1.0, top_p 0.95).

	Base	This model
Refusals with reasoning on, held out (100 prompts, 6000-token limit, judged on the final answer)	92	1
Median completion tokens on those prompts	357	1517
Repetitive reasoning	0	0
Long ordinary outputs: broken (loops, runs of characters) / 128	0	0
Long ordinary outputs: reached the 12,000-token limit / 128	53	48

The long-output test has 8 tasks (long prose, code and reasoning) × 16 runs each. A response counts as broken when any 2000-character window compresses more than 6×, is under 8% whitespace (fused words), or has a single character repeated 200 times or more. Both models write long Markdown tables, which accounts for the 60–76-character runs seen in either.

Serving

The model is served like the base model. For SGLang:

sglang serve --model-path <dir> --tp-size 4 --ep-size 4 --context-length 262144 \
  --reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 --trust-remote-code

Plain TP4 fails, because 2304/4 is not a multiple of 128. Without the reasoning parser, <think> leaks into the content.

Limits of these measurements

• Chat-mode judgments are on 48 tokens: they show whether an answer starts, not whether it is complete or correct.
• No capability benchmarks were run. KL 0.136 on harmless prompts means general behaviour has shifted somewhat.
• The routed experts are untouched, because their FP4 storage cannot hold an edit of this size.

Credits

DeepSeek for the model and reference code; Heretic for the method this follows.