Experimental cybersecurity-oriented variant of DeepSeek-V4-Flash-0731 with modified refusal behaviour.
The project explores whether a refusal-direction intervention can reduce excessive refusals on legitimate cybersecurity prompts while preserving the underlying model's general capabilities.
Status: experimental research model.
The historical evaluation reported below has not yet been independently reproduced from the original artifacts.
Overview
The base model used for this project is:
deepseek-ai/DeepSeek-V4-Flash-0731
This variant was created as an experiment in modifying refusal behaviour for cybersecurity-oriented use cases such as:
security research;
penetration-testing labs;
vulnerability analysis;
defensive security;
exploit analysis;
CTF environments;
supervised agentic security workflows.
The modification was inspired by research showing that refusal behaviour in several instruction-tuned language models can be strongly associated with a low-dimensional direction in the residual stream.
The goal of this experiment was not to claim that the model has a literal neural-network "refusal layer."
A more accurate description is:
the model's refusal-related representation was identified and modified using refusal-direction / abliteration-style techniques.
Method
The approach was based on the refusal-direction line of mechanistic-interpretability research. And also for this model I use rtx pro 5000 and
with Q8 quantization so there was no problem with memory and it was pretty comfortable.
The general method compares model activations produced by two prompt groups:
text
1refusal-triggering prompts
2 vs.
3non-refusal / benign prompts
A candidate direction associated with refusal behaviour can then be estimated from the difference between their representations.
The identified direction can be suppressed through an orthogonalization-style weight intervention.
Conceptually, given a refusal direction r, an affected output weight matrix W can be modified approximately as:
W' = W - r rᵀ W
This makes the affected component less able to write the identified refusal direction into the residual stream.
This project followed that general research approach rather than training a new foundation model.
Research Basis
This experiment was primarily inspired by the following work.
Refusal in Language Models Is Mediated by a Single Direction So Who Cares
Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, Neel Nanda — 2024
The work reports that refusal behaviour across several open-source instruction-tuned model families can be strongly mediated by a single direction in the residual stream.
The authors demonstrate two complementary interventions:
text
1remove refusal direction
2 ↓
3reduced refusal
45add refusal direction
6 ↓
7increased refusal
The work also demonstrates a direct weight-space intervention through orthogonalization.
Paper identifier:
arXiv:2406.11717
Reference implementation:
andyrdt/refusal_direction
The original research was initially presented as the LessWrong article:
Refusal in LLMs is mediated by a single direction
before publication of the full paper.
Abliteration
The experiment was also informed by community implementations usually referred to as abliteration.
Relevant implementations and explanations include:
FailSpy/abliterator
and Maxime Labonne's technical article:
Uncensor any LLM with abliteration
These works adapt refusal-direction ablation into a practical workflow for modifying open-weight instruction models.
Contrastive Data
This type of intervention requires examples that produce different refusal-related model behaviour.
The original refusal-direction research used contrasting collections of:
text
1harmful / refusal-triggering instructions
2 vs.
3harmless instructions
The original research reports using approximately:
text
1512 harmful prompts
2512 harmless prompts
for refusal-direction extraction experiments.
The same research evaluated refusal suppression using:
100 harmful instructions from JailbreakBench
and evaluated induced refusal using:
128 harmless instructions from Alpaca
Historical Evaluation
After the model modification, I evaluated the base and modified checkpoints on an internal set of approximately 400 cybersecurity-oriented prompts.
The benchmark focused primarily on refusal frequency.
Result
Model
Refusal rate
DeepSeek-V4-Flash-0731 base model
~97%
Modified Cyber variant
23%
This is a reduction of approximately:
text
197% → 23%
23-74 percentage points
or roughly a 76% relative reduction in observed refusals.
The main conclusion from the experiment was therefore:
The refusal-direction intervention substantially reduced refusal behaviour on the internal cybersecurity prompt set.
What the Result Does Not Mean
A lower refusal rate is not equivalent to higher model quality.
The experiment does not establish that this checkpoint has:
higher factual accuracy;
better exploit reasoning;
better coding ability;
better cybersecurity knowledge;
better general intelligence;
better safety;
higher benchmark performance than the base model.
It establishes only that, on the historical internal test set, the modified model refused significantly fewer prompts.
Evaluation Limitations
The original ~400-prompt evaluation was an internal experiment.
At the moment, the complete prompt-level artifacts are not published with this repository.
Therefore the 97% → 23% result should be treated as:
a historical internal experimental result, not an independently reproduced benchmark.
Current limitations include:
original prompt-level results are not yet published;
exact original contrastive dataset identifier has not yet been recovered;
no independent evaluator was used;
no statistical confidence interval was recorded;
refusal rate alone does not measure technical correctness;
lower refusal does not imply safer or more useful answers;
results have not yet been reproduced against the current repository state.
Planned Reproducible Evaluation
A future evaluation release should preserve every prompt and completion and evaluate multiple dimensions separately.
Those are PENdS properties, not properties of the model weights.
The model can be used independently from PENdS.
Base Model
This checkpoint derives from:
deepseek-ai/DeepSeek-V4-Flash-0731
DeepSeek-V4-Flash-0731 is distributed under the MIT License.
Refer to the upstream model card for:
architecture;
parameter count;
inference configuration;
official benchmarks;
chat template;
deployment requirements.
I intentionally do not reproduce DeepSeek's benchmark tables here because they describe the upstream base model, not experimental results produced by this checkpoint.
Usage
The checkpoint uses the DeepSeek-V4 chat format.
Example tokenizer usage:
python
1from encoding_dsv4 import(2 encode_messages,3 parse_message_from_completion_text,4)56from transformers import AutoTokenizer
78messages =[9{10"role":"user",11"content":"Explain the security impact of this vulnerability.",12}13]1415prompt = encode_messages(16 messages,17 thinking_mode="thinking",18 reasoning_effort="max",19)2021tokenizer = AutoTokenizer.from_pretrained(22"Akan4ik/DeepSeek-V4-Flash-0731-FFT-BF16-Cyber"23)2425tokens = tokenizer.encode(prompt)
Refer to the upstream DeepSeek documentation for hardware-specific inference instructions.
Intended Use
This checkpoint was created for research involving:
LLM refusal behaviour;
mechanistic interpretability;
cybersecurity-oriented LLM evaluation;
authorised penetration-testing environments;
AI-security research;
supervised security agents;
model-behaviour experiments.
It should be treated as experimental research software.
Limitations
The intervention modifies refusal behaviour but does not make the model inherently reliable.
Potential limitations include:
reduced refusal may increase problematic completions;
security answers may still contain hallucinations;
generated exploit information may be incorrect;
model behaviour may differ substantially from the original checkpoint;
refusal-direction results may not generalise uniformly across domains
the original internal benchmark needs reproduction
exact data provenance for the original modification experiment is still being recovered
the 100% refusal could be bad for some usages, so I made it mostly like friendly for research making but not fully uncencored.
For example it refuses against child-abuse prompts and some sexual areas also and e.t.c
Responsible Use
Use this model only where you are authorised to perform the requested security work.
For autonomous or semi-autonomous security tooling, model output should not directly control target-touching operations without an independent execution boundary.
Projects such as PENdS address this separately through scope and execution controls.
License
The upstream DeepSeek-V4-Flash-0731 repository and model weights are distributed under the MIT License.
This repository is also distributed under the MIT License.
See LICENSE for details.
References
Arditi et al., 2024
Refusal in Language Models Is Mediated by a Single Direction
Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, Neel Nanda.
