The model this blog runs on

DeepSeek published V4-Flash-0731 on 31 July 2026, superseding the preview. The vLLM recipe page describes a 284B-total / 13B-active sparse MoE: hybrid Compressed Sparse Attention plus heavily compressed attention with a Lightning Indexer, Manifold-Constrained Hyper-Connections, an inline three-stage DSpark speculative draft head, and FP4+FP8 mixed weights — expert tensors in FP4, the rest in FP8. GGUF metadata records a native context of 1,048,576 tokens. DeepSeek’s own card claims 82.7 on Terminal Bench 2.1 and 54.4 on DeepSWE, against 61.8 and 7.3 for the preview, and the recipe page claims 27% of V3.2’s per-token FLOPs and 10% of its KV cache at 1M context. Those are upstream claims, not measurements we have reproduced.

Flash-class models get abliterated fast

13B active is the whole point: the checkpoint is huge on disk and cheap per token, which means people can actually run it. Community threads on r/LocalLLaMA noted the 0731 keeps the preview’s GGUF VRAM footprint and fits 128–192 GB unified-memory machines; one independent write-up reports 20–30 tok/s decode on a five-RTX-3090 rig (direct Reddit scraping returned HTTP 403 while writing this, so those threads are cited from search snippets). The abliteration wave followed within days. huihui-ai’s GGUF passed 277,000 downloads with 146 likes by pin time, mirrored by rbinrs (504 downloads) and Justbackup (680). Huihui’s card calls its own bake a crude proof of concept that leaves every routed expert untouched, and notes Q4 was ablated harder than Q2. Two days after the mirrors appeared, pocharlies published the directions file.

A dial, not a download

The repository is deliberately small. It ships refusal_dirs.safetensors: 46 unit-norm float32 vectors in ℝ⁴⁰⁹⁶, one per edited module — the 43 backbone and 3 MTP attention output projections — extracted from the difference between the official release and cebeuq’s baked abliterated checkpoint, following Arditi and colleagues’ refusal-direction method. The trick is arithmetic: projecting a sublayer output is the same function as editing its weight, so the edit becomes a runtime hook in a vLLM patch instead of a baked checkpoint. λ=0 is bit-exact to stock, verified with torch.equal. At λ=1.5 the publisher reports refusals dropping from 9/10 to 0/10 on a ten-trigger set, DSpark acceptance statistically indistinguishable from stock (0.5669 ± 0.0097 versus 0.5608 ± 0.0189, six alternated runs), 30/30 needle-in-a-haystack, and 8/8 tool calls — publisher claims backed by raw JSON in the linked repository, not an independent audit. The honest costs are stated: switching λ goes cold on the prefix cache (76 s re-prefill for a ~137k-token prompt), and the projection dot product runs every token even at λ=0.

Baked abliteration overshoots

The interesting finding concerns the baked checkpoint the directions came from. cebeuq’s card justifies its λ=2.5 projection with a measured ~68% ceiling: a rank-1 edit spread over 4096 dims perturbs most elements below the FP8 quantization step, so a clean λ≈1 bake would only remove about two-thirds of the direction. pocharlies measured the shipped weights directly and found the opposite: the bake sits at λ_eff ≈ 2.43 and removes roughly 240% of the direction — it does not fall short, it overshoots and inverts it, and the measured acceptance on the baked checkpoint (0.5128) sits below the 0.55 floor used for the dial. Two primary sources therefore disagree about the mechanism, and the clean 0 < λ ≤ 1.5 range exists only as a runtime dial. That contradiction is exactly the kind of thing that deserves independent reproduction before anyone trusts either number.

The cost math

Flash-class economics are the reason this got abliterated at all. Roughly 13B active parameters means about 26 GFLOP per token, versus ~568 GFLOP for a dense 284B — back-of-envelope, on two H200s (about 1.98 PFLOPS BF16 aggregate) the compute ceiling is ~76k tokens/s. Real serving lands far below that, because MoE inference is memory-bound, attention still scales with context, and the DSpark drafter has to be fed, but the direction is right: the model is expensive to store, cheap to run. The FP8 checkpoint is around 200 GB, which two 141 GB H200s fit. A 2× H200 deployment prices at roughly $10.90 per hour — an approximate managed price estimate, not a quote.

What is proven here?

The directions file, its provenance and the A/B harness are all inspectable. The λ=1.5 refusal and acceptance figures are the publisher’s own measurements, published with raw JSON. At pin time the artifact has zero downloads, zero likes and no discussions — nobody has independently replicated any of it.

What this does not establish

The card is unusually honest about its own gaps: general capability was not benchmarked (no MMLU-Pro, GSM8K or HumanEval), 256k context was not measured (retrieval validated only to 126,940 real tokens), and variance rises with λ — one of six runs at λ=1.5 dipped below the acceptance floor even though the mean passed. The model spends 1,100–1,400 tokens reasoning before answering, which the author documents as the source of fake refusal-removal results. And the uncomfortable engineering point is stated plainly: reducing a model’s resistance to instructions reduces its resistance to injected instructions, so a λ>0 deployment should keep credentials away from write-capable tools. “Uncensored” here is a dial setting on a 284B model, not a property of the 757 KB file itself.

The idea, in plain words

The dial that turns refusals up and down

Refusal lives in a direction of the model's internal math. Classic abliteration removes that direction from the weights — permanent, baked in. This variant instead keeps the direction and applies it at runtime with a lambda dial: crank it to 1.5 and refusals drop to 0/10 on the measured triggers, drop it to 0 and you have the stock model back. A 757 KB file instead of a 157 GB re-download.

Primary sources