KidIkaros/abliterated-minicpm5-2b-v2

Abliterated MiniCPM5-2B v2

Reduced-refusal derivative of openbmb/MiniCPM5-2B: re-ablation (Arditi diff-in-means) + DPO preference tuning. Unofficial derivative — not an OpenBMB release. Research artifact.

v2 supersedes KidIkaros/abliterated-minicpm5-2b (v0). Measured refusal rate drops from ~40% (v0) / ~37% (official) to ~8% at temperature 1.0, at a small measured capability cost (see Benchmarks). The legacy v0 artifact was statistically indistinguishable from the official model on both refusal and capability — v2 is the first checkpoint in this line that actually differs measurably.

Contents

Path	What
model.safetensors + configs/tokenizer	Merged fp16 HF checkpoint — byte-identical to the evaluated candidate
gguf/minicpm5-2b-v2-f16.gguf	F16 GGUF (llama.cpp)
gguf/minicpm5-2b-v2-q8_0.gguf	Q8_0 GGUF
gguf/minicpm5-2b-v2-q4_k_m.gguf	Q4_K_M GGUF

Usage

transformers

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "KidIkaros/abliterated-minicpm5-2b-v2"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id, torch_dtype="auto", device_map="auto",
)

msgs = [{"role": "user", "content": "Explain how a hash map works"}]
inputs = tok.apply_chat_template(
    msgs, add_generation_prompt=True, return_tensors="pt",
).to(model.device)
out = model.generate(
    inputs, max_new_tokens=256,
    do_sample=True, temperature=1.0, top_p=0.95, min_p=0.0,
)
print(tok.decode(out[0][inputs.shape[1]:], skip_special_tokens=True))

Recommended decoding: temperature=1.0, top_p=0.95, min_p=0.0 (OpenBMB's settings). Greedy decoding combined with thinking prompts can fall into repetition loops — a quirk of the 2B base, present in the official model too.

llama.cpp

llama-cli -m minicpm5-2b-v2-q8_0.gguf -ngl 99 -c 8192

Runtime smoke (RX 9060 XT, HIP): Q8_0 ~85 tok/s, Q4_K_M ~116 tok/s. GGUFs embed tokenizer.ggml.pre=minicpm5 and the production chat template. Requires llama.cpp ≥ b9354 for the minicpm5 pre-tokenizer.

Refusal gate (300 prompts, temp 1.0 / top_p 0.95 / min_p 0.0)

Candidate	Seed 0	Seed 1	Degenerate
official MiniCPM5-2B	36.7%	—	0
abliterated v0	40.7%	—	0
v2 (this repo)	5.7%	10.3%	0

Residual refusals are mostly stochastic boundary flips at temp 1.0 — only 5/300 prompts refuse on both seeds. After removing defensible safety and knowledge-scope "can't" responses, the true false-refusal rate is ≈2–3%.

Benchmarks — release_core suite (lm-eval 0.4.13)

Identical pinned local harness for all three candidates: same tokenizer/chat template, prompts, decoding, and model-loading settings. No-thinking mode. Seeds 0 and 1 for MMLU-Pro / MATH-500 / IFEval; seed 0 for the LongBench-E groups (task-default greedy decoding). Scores come from the same pinned evaluator and are not comparable to OpenBMB's published leaderboard values.

Task	n	official	v0	v2	v2 − official (95% paired CI)
MMLU-Pro	350×2	42.57	44.71	38.43	−4.14 pp [−8.14, −0.14]
MATH-500	500×2	50.30	51.40	47.30	−3.00 pp [−5.80, −0.20]
IFEval	541×2	84.94	84.84	85.58	+0.65 pp [−1.20, +2.50]
LongBench-E single-doc QA	6	65.56	82.22	82.22	+16.67 pp [+0.00, +50.00]
LongBench-E multi-doc QA	6	77.78	77.78	66.67	−11.11 pp [−33.33, +0.00]
LongBench-E summarization	6	29.23	27.74	28.86	−0.38 pp [−1.14, +0.37]
LongBench-E synthetic	6	0.00	66.67	66.67	+66.67 pp [+33.33, +100.00]

Domain-macro retention vs official: 105.2% (predeclared target ≥95% — PASS). Excluding the flagged synthetic task: ~98.0% — still passing.

Honest notes:

• Real regressions exist: MMLU-Pro −4.1 pp and MATH-500 −3.0 pp, both with CIs excluding zero; IFEval unchanged. This is the measured cost of the refusal reduction, consistent with the neutral-prose perplexity delta (v2 7.54 vs v0 6.87). v2 is not capability-identical to official.
• longbench_synthetic_e is decode-sensitive: official emits EOS within 0–2 tokens under greedy no-thinking decoding on these ~3.6k-word prompts (early-EOS pathology, not a capability measurement). v0 and v2 answer normally under the identical protocol; the conservative retention figure above excludes this task.
• LongBench-E groups are n=6 per candidate — smoke-tier signal only.
• v0 ≈ official on every measured task, matching its ~40% refusal rate.

Lineage

KidIkaros/abliterated-minicpm5-2b @ 5c315b8          (v0)
  └─ re-ablation: layer-20 refusal direction projected out of all
     o_proj/down_proj (84 matrices)                  → reablated_a
  └─ DPO LoRA: lr 5e-6, β 0.1, 2 epochs, 593 pairs
     (453 refusal-50k/VellumK2 + 140 on-policy mined) → dpo_lora_c
  └─ merge on CUDA, fp16                              → v2_merged

Integrity

sha256 — verify after download or any copy:

File	sha256
model.safetensors	b199664b72cf16b7aa7a5521076479dea7662ab569bd5ed86b2a393c9f51b6e1
gguf/minicpm5-2b-v2-f16.gguf	7f26d5287bc268b0f749d26646ae1a7b3be55ca5afc81b19ef7515e4f7673607
gguf/minicpm5-2b-v2-q8_0.gguf	5a9ae7e8b1c0eb06f7c1ea5f795cb337f8a9ff13a6a1fa6e436f4f7c7ef16a60
gguf/minicpm5-2b-v2-q4_k_m.gguf	88742ca210f26615deb0207102c47ede141ae0d12dbb5e6c7d274cb4a6c287e9

Known limitations

• ~5 deterministic refusals remain (including defensible safety cases).
• Small measured regression on knowledge/math benchmarks (see above).
• Residual refusal is temperature-boundary stochastic; greedy decoding reduces flip rate but can cause repetition loops (base-model quirk).
• Text-only; no multimodal.
• This is a research artifact for studying refusal behavior — it has reduced safety-refusal behavior and is not a safety-aligned product.