A refusal-ablated ("de-risked" / abliterated) build of
inclusionAI/Ling-3.0-flash,
quantized to Q4_K_M GGUF. The reflexive refusal behaviour has been removed via
weight-orthogonalization of the refusal direction, so the model follows
instructions in dual-use security and adult-content domains instead of declining.
Intended for authorized security research, red-teaming, and unrestricted creative
writing. You are responsible for how you use it. See Intended use & risks below.
⚠️ Runtime requirement (read this or it won't load)
Ling-3.0-flash is a BailingMoeV3 hybrid-attention MoE. It needs a llama.cpp
build with BailingMoE3 support — currently
PR #26608 (bailingmoe3),
not yet in mainline. Stock llama.cpp / Ollama / LM Studio will fail to load this
file until that support merges.
-ot 'exps=CPU' keeps the MoE experts on CPU and attention on GPU — runs in ~12 GB
VRAM + ~80 GB RAM at ~12–18 tok/s.
Reasoning / <think>
Ling-3.0 is a reasoning model that emits a <think>…</think> block first. The
ablation was harvested at the answer-onset (thinking-off) state, so for the most
reliable compliance serve it thinking-off — end the prompt at <think></think>:
With reasoning left on, the model can occasionally reason its way back into a refusal.
Method
Standard refusal-direction ablation, extended to a multi-direction subspace:
Harvested mean-difference (harmful − harmless) last-token residuals per layer for
two domains (security/dual-use and adult content), 128 prompts/side, at the
answer-onset position.
Built a rank-16 subspace via Gram–Schmidt over both domains' directions across
layers 22–42 (a single layer under-covers; the refusal manifold spans a band).
Orthogonalized that subspace out of every residual-stream–writing weight
(o_proj, attention dense, down_proj, shared + routed expert down_proj, and
the embedding), exact projection (scale 1.0). Routers, norms, q/k/v/up/gate, and
lm_head were left untouched.
Evaluation
Refusal bench using public datasets (AdvBench,
XSTest) plus an adult-content probe, scored
with a header-aware refusal detector (a naive substring scorer over-counts compliance
because a refusal can open with a markdown header). Comply-rate, thinking-off:
split
base behaviour
this build
AdvBench (harmful)
refuses
92% comply
Adult content
refuses
100% comply
XSTest safe (over-refusal canary)
—
100% comply (no collateral)
XSTest-safe staying at 100% indicates the ablation did not damage the model's
willingness on benign prompts, and spot-checks show coherence is intact.
Intended use & risks
This is a dual-use artifact. Removing refusals also removes the model's own
guardrails: it will produce security-offensive content (exploit code, malware
concepts) and explicit adult material on request. It is published for security
researchers, red-teamers, and adults who want an unfiltered creative tool.
Do not use it to cause real-world harm, target real people/systems without
authorization, or generate illegal content.
Outputs can be wrong or dangerous; verify anything security-relevant.
Adult content is fictional and for consenting adults only.
