Borealis Code is a full abliteration of CohereLabs/North-Mini-Code-1.0 (30B-A3B MoE, Apache-2.0), produced by replicating the V3 "Deep Liberation" surgery recipe published with OBLITERATUS/Qwen3.8-27B-OBLITERATED and adapted end-to-end for the cohere2_moe architecture.

Genuinely uncensored. Real answers, not safety lectures. Near-stock capability.

What it is

V3 removes not only hard refusals ("I cannot help with that") but also soft deflections (safety lectures that give zero substance). The recipe combines three published ideas:

Complementary abliteration blending — two surgeries that fail in different ways (greedy SVD vs. capability-preserving LEACE) are blended in weight space so each cancels the other's weaknesses.
Iterative stacking — each surgery round re-probes the champion model and refines it, never restarting from stock.
Targeted corpus surgery — a focused cyber/code corpus finds deflection directions specific to security-adjacent coding tasks without diluting the global signal.

Surgery recipe (exact)

stock = CohereLabs/North-Mini-Code-1.0 (BF16 safetensors)

V1  stock  -> aggressive SVD abliteration
    5 directions, reg 0.08, norm-preserving, whitened SVD,
    jailbreak-contrastive refinement, layer-adaptive strengths,
    selective attention-head surgery, 1% activation winsorization,
    5 true-iterative rounds (re-probe + re-distill each round,
    cosine early-exit at 0.99)

V2A V1 -> SVD surgery   (3 dirs, reg 0.08)
V2B V1 -> LEACE surgery (FLD direction, reg 0.06)
V2  blend(V2A, V2B, alpha=0.6)          # 60% LEACE + 40% SVD

V3R V2 -> gentle iterative refinement (2-dir SVD, reg 0.04, 2 rounds)
V3T V2 -> targeted corpus surgery (3-dir SVD, reg 0.01)
          corpus: 96 security-research / offensive-tooling coding prompts
          paired with 96 defensive-security controls
FIN blend(V3R, V3T, alpha=0.5)          # 50/50 final

Per-layer surgery targets (all in the residual write-back path):

attention o_proj, q_proj, k_proj, v_proj
MoE router mlp.gate (±3σ stabilized after projection)
all 128 routed experts' down_proj, up_proj, gate_proj per MoE layer
dense layer 0 mlp.{down,up,gate}_proj
rank-1 projection W' = W − (1−reg)·d·(dᵀW) with per-tensor Frobenius norm restoration (≤1.10×)

Untouched by design: embed_tokens (tied with the output head — projecting it would corrupt both), all RMSNorm weights, and the router logits scale.

Downloads

File	Quant	Size	Notes
`Borealis-Code-1.0-Q4_K_M.gguf`	Q4_K_M	~19 GB	sweet spot, single file
`model-000XX-of-00XX.safetensors`	BF16	~57 GB	original surgery output

Usage

llama.cpp (vLLM-style server or CLI)

cohere2moe is supported natively since llama.cpp PR #24260 (merged 2026-06-13) — use a recent build.

llama-server --model Borealis-Code-1.0-Q4_K_M.gguf --jinja --ctx-size 16384

Transformers

python

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "KellHect/Borealis-Code-1.0"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, torch_dtype="bfloat16", device_map="auto")

messages = [{"role": "user", "content": "Write a port scanner in Python"}]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt")
out = model.generate(**inputs, max_new_tokens=1024, do_sample=True, temperature=1.0, top_p=0.95)

Recommended settings

temperature=1.0, top_p=0.95 (Cohere's recommendation for North-Mini-Code)
Greedy decoding (temperature=0) works and benefits from repetition_penalty=1.15
The model uses interleaved thinking; keep it enabled for agentic use

Chat template note

The stock Cohere template injects a system-level safety preamble ("You will not provide content that is harmful..."). Because OBLITERATUS found that system prompts reintroduce refusals — and weights cannot veto what the template injects — this repo ships a cleaned template: the safety sentence is removed and the identity lines updated. The original template remains available at chat_template.stock.jinja for A/B testing.

Evaluation

Refusal screening (logit-based first-token refusal probability, 0 = no refusal signal, 1 = certain refusal) on security-adjacent coding prompts:

Model	Mean refusal prob	Flagged
Stock North-Mini-Code-1.0	1.115 (10/12 flagged)	—
Borealis Code 1.0 (final)	0.056 (2/12 flagged)	—

(numbers filled from the surgery pipeline's verification stage)

Research context

This model has had safety guardrails surgically removed. It will comply with requests the base model refuses. You are solely responsible for how you use it and any content it generates. This release exists for alignment/red-team research, safety evaluation baselines, and local-first users who want full control over their own hardware. It is not for causing real-world harm to real people.

Credits

CohereLabs — North-Mini-Code-1.0 base model (Apache-2.0)
OBLITERATUS (Pliny the Prompter) — V3 Deep Liberation recipe
Arditi et al. 2024 (refusal direction), Belrose et al. 2023 (LEACE), Gabliteration (multi-dir SVD), grimjim 2025 (norm preservation)

License

Apache 2.0, same as the base model.