Can you please explain the "un-normalized magnitude of the merge" theory of decensoring? This model exhibits such strong contextual ethical alignment that I wonder whether the methodology could be replicated with other merge projects like Gemma-4 / Goetia. Is this model just a fluke so to speak or is there a reason why it performs better than other Cyberdonia candidates?

It isn't really a theory I developed so much as an observation. When combining models that already have lower refusals, if you use the della method, and normalize: false, and have the total weights adding up to over 1.0, typically around 1.2-1.5 is the threshold where refusals are lowered. Going past 2.0 typically distorts the output too much.

"un-normalized magnitude" just means that the magnitude (weight values) of the models goes past the "normalized to 1.0" default settings, in this case 1.6 total, which is 160% magnitude amplification.

If the models are heavily censored to begin with this only reduces it slightly, but if one or more is heavily decensored to begin with (as is v4x) then it has a greater effect, even though v4.3 by itself has higher refusals. I've tested this on several other merge methods and so far it's only observed with della (although it might work with dare).

If you changed the yaml to say normalize: true you would get refusals again. Even using Cydonia absolute Heresy as a donor with normalize true results in refusals.

As for why, I am, not sure, but perhaps something with the magnitude disrupts the safety guardrails while leaving the bulk of the model's logic and writing intact.

I would like to somehow expand on the della method since it is the only merge method I know of so far that has a decensoring effect on models.

I wonder whether the methodology could be replicated with other merge projects like Gemma-4 / Goetia.

Yes it has already been done for recent versions of Goetia and Asmodeus. As for Gemma 4, it can be done with dense models. But currently, it isn't possible to use normalize false with total weights adding up past 1.0 on moe_della merges, as the MoE is more sensitive to magnitude amplification. When I tested it caused broken output.

Is this model just a fluke so to speak or is there a reason why it performs better than other Cyberdonia candidates?

v8 scored much better at Q0 bench than the other 12 variants, with v11 scoring next best. v11 was different in that it used v4.3 as the base model with v4x and v4y as donors (1.0 and 0.5 respectively), so it had a "smarter base" to start with. v8 just happened to blend perfectly with 40% v4x, 40% 4.3, and 20% v4y, while other variants caused too much distortion, thereby lowering the output quality. The fluke was just brute force testing several yaml configs and stumbling into one that performed much better in comparison.

One more thing, v4x and v4y have much less refusals than v4.3, so in a 2v1 TIES consensus they would also override 4.3's inherent refusals, negating the need to use a heretic donor.

architecture: MistralForCausalLM
base_model: B:\24B\!models--anthracite-core--Mistral-Small-3.2-24B-Instruct-2506-Text-Only
models:
  - model: B:\24B\Cydonia-24B-v4x-Q8_0
    parameters:
      weight: 0.8
      density: 0.9
      epsilon: 0.09
  - model: B:\24B\!models--TheDrummer--Cydonia-24B-v4.3
    parameters:
      weight: 0.4
      density: 0.9
      epsilon: 0.09
  - model: B:\24B\Cydonia-24B-v4y-Q8_0
    parameters:
      weight: 0.4
      density: 0.9
      epsilon: 0.09
merge_method: della
parameters:
  lambda: 1.0
  normalize: false
  int8_mask: false
  rescale: true
dtype: float32
out_dtype: bfloat16
tokenizer:
  source: union
chat_template: auto

Devin Notes

Please explain the above theory, as to why a normalize false della merge would uncensor the model?

Short answer

normalize: false with total weights ≈1.6 turns the merge from a weighted average of task vectors into an amplified sum of them — the code literally skips mixed_delta /= divisor, so the merged delta is roughly 1.6× stronger than a normalized merge before being added back to the base. Combined with DELLA's magnitude-biased pruning (which preferentially keeps the largest deltas) and TIES sign consensus (which deletes parameters where the models disagree), the surviving amplified deltas overpower the base model's low-magnitude safety/refusal directions while consensus keeps the model coherent. So it's not a fluke — it's a systematic amplification effect — but whether it transfers to Gemma-4/Goetia-style merges depends on the donors already containing low-refusal directions, which the code can't guarantee.

Detailed explanation

What della actually is in this codebase

della is just a configured instance of GeneralizedTaskArithmeticMerge: della_magprune sparsification + ConsensusMethod.sum sign consensus, with default_normalize=True and default_rescale=True 1 . Your YAML overrides normalize to false while keeping rescale: true.

The pipeline, step by step

1. Task vectors. GTATask.execute computes each donor's delta as model − base_model via get_task_vectors 2 . So the merge operates only on what fine-tuning changed relative to Mistral-Small-3.2 — including whatever fine-tuning did to refusal behavior.

2. DELLA sparsification. della_magprune ranks parameters by magnitude within each row and assigns keep probabilities from density − epsilon (smallest) to density + epsilon (largest), then samples a Bernoulli mask 3 . With density: 0.9, epsilon: 0.09, large-magnitude deltas are kept with ~0.99 probability while small ones are kept at ~0.81 — i.e., pruning preferentially removes the small changes. Then rescale: true restores the L1 norm of the survivors, so each donor's delta retains roughly its original total magnitude despite ~10% pruning 4 .

3. Sign consensus. get_mask computes the majority sign by summing the weighted deltas; any parameter where a model disagrees with the majority direction is zeroed for that model 5 . This is what keeps the merge coherent instead of collapsing into noise.

4. The critical step — normalize. With consensus, mixed_delta = Σ(weighted_deltas × mask) and divisor = Σ(weights × mask) 6 . normalize: true divides these, producing a proper weighted average where each surviving parameter lands near a single model's contribution. normalize: false skips the division 7 , so mixed_delta is the raw sum — with weights 0.8+0.4+0.4 = 1.6, the applied delta is ~1.6× what a normalized merge would produce wherever the donors agree.

5. Application. base + mixed_delta is returned directly 8 .

Why this plausibly decensors

• Where donors agree, the change is amplified. If the donors' fine-tunes all pushed certain weights in a "lower refusal" direction relative to the Mistral base, sign consensus keeps those parameters and the un-normalized sum pushes them ~1.6× further than any single model went. The base model's refusal circuitry effectively gets overwritten by an overshoot.
• Where donors disagree, the change is deleted. Consensus masking zeroes conflicting parameters rather than averaging to a muddy compromise, which is why the model stays coherent instead of degrading like a naive over-weighted linear or task_arithmetic merge would.
• Why DELLA specifically: della_magprune biases survival toward high-magnitude deltas, so the amplification concentrates on the strong fine-tune signals; rescale then restores L1 norm so the amplified sum isn't diluted by pruning. A ties merge also has sign consensus but its magnitude sparsifier hard-truncates at a top-k cutoff without the same probabilistic profile, and other methods lack the consensus step that prevents destructive interference at 1.6× weight.
• normalize: true undoing it is consistent: division by divisor ≈ sum of contributing weights shrinks each parameter back to single-model magnitude — you get the averaged behavior (including refusals) instead of the overshoot.

The audit hook log_della_audit is literally designed to expose this: it reports each donor's weight × delta_norm "impact" share per layer, so you can watch which models dominate the amplified sum 9 .

On replicating it (Gemma-4 / Goetia)

Nothing in the mechanism is Cydonia-specific — the code is model-agnostic. But the empirical prerequisites are: donors fine-tuned from the same base (task vectors only work against a common ancestor), at least one donor whose deltas already encode low-refusal behavior, and total weights ≳1.5. If all donors carry aligned safety fine-tuning, consensus will amplify the refusals instead. The code gives you the amplifier; the donors determine what gets amplified.

Notes

• moe_della replicates the same logic for MoE models with separate normalize_router/normalize_weights flags — normalize_weights defaults to false there, interestingly 10 11 .
• "Safety guardrails live in low-magnitude deltas" is a hypothesis, not something the code encodes — the observed ~1.5 threshold is empirical and likely varies by model family and refusal-strength of the donors.
• dare_linear is the closest relative worth testing (random sparsification + rescale, no consensus), but without consensus the destructive interference at >1.0 total weight is more likely to degrade the model than cleanly decensor it 12 .

it's a systematic amplification effect — but whether it transfers to Gemma-4/Goetia-style merges depends on the donors already containing low-refusal directions, which the code can't guarantee

This probably explains why combining ARA donors with lower-refusal roleplay finetunes can produce a more thoroughly decensored merged model despite the risk of covert noncompliance. However defining and measuring the "lower refusal" threshold for the non-abliterated donors could be challenging.

I'm testing now to see which layers exactly are responsible for the refusal reduction upon going past 100% total weight amplitude.

Whether it's MLP, ATTN, or a combination of multiple layers.

Also trying to see if I can get unnormalized della merges stable on Gemma 26B

It's important to note that most merge methods are actually methods of merge based Re-censoring, as methods like SLERP are known to re-activate refusals even when both donors have none.

I've confirmed that by excluding all layers except MLP/ATTN, refusals were reduced, and cranking amplitude to 1.6 did not cause issues on Gemma 4.

It still has disclaimers and hedging but does not outright refuse harmful prompts as often as with weights normalized to 1.0. More testing in progress

It makes sure to remind you of complying with all laws and safety etc by writing sections about them but no longer acts like the information is "unauthorized" and now provides instructions for harmful prompts

With Q0 bench prompts it either complies entirely or it tries to "misdirect/misinterpret" the prompt. I'm testing another merge with weights at 2.0

Example yaml (4 donors)

  - model: B:/26B/SubMaroon--Kitchoon-V3-26B-A4B
    parameters:
      weight:
        - filter: "lm_head"
          value: 0.25
        - filter: "attn"
          value: 0.4
        - filter: "mlp"
          value: 0.4
        - filter: "embed_tokens"
          value: 0.25
        - value: 0.25
      density: 0.9
      epsilon: 0.09

merge_method: moe_della
parameters:  
  lambda: 1.0
  normalize_weights: false
  normalize_router: true
  int8_mask: false
  rescale: true
  router_strategy: della
  blend_experts: true

I wonder if finetuning a model that is decensored via task vector merging would be more or less resilient to refusals being re-activated post-finetune on a Heretic (ARA/SOMPOA) ablated model.

I've isolated the refusals to just o_proj. This is the only layer which must be amplified. (For Gemma 4, I did not test Mistral yet.)

If you amplify all mlp/atn layers on Gemma 4 by 800% the output collapses completely. Just o_proj results in random artifacts (foreign symbols) appearing at 800%, but is stable at 500%. This means o_proj can be scaled a bit higher than other layers. When I scaled mlp/atn the highest stable amplitude was 360%, around 400% induced artifacts.

For mlp/atn I noticed that scale 1.6 still had refusals and 'misdirects' (where the model intentionally tries to re-categorize the prompt into something less harmful). Scale 2.0 had a substantial reduction but it wasn't until 2.4/3.0 that all obvious refusals went away.

Disclaimer reduction requires higher scaling than refusal reduction, and eventually the output breaks before all disclaimers are removed. But you can disable most of them just by increasing the o_proj weight.

I suspect that logic or reasoning degrades more obviously at longer context the more you increase weight, so I'll run a deeper comparison of 250% o_proj only vs 500%.

Update: The merge audit reveals that Gemory SOMPOA is dominating o_proj by about 60%, with the other 3 models contributing 40%. Depending on the models used and their inherent censorship levels this may affect the amplitude thresholds (less censored models should require lower amplitudes in theory).

weight:
        - filter: "lm_head"
          value: 0.25
        - filter: "o_proj"
          value: 1.25 # x4 scales to 5.0
        - filter: "mlp"
          value: 0.25 # x4 scales to 1.0
        - filter: "embed_tokens"
          value: 0.25
        - value: 0.25 # everything else not listed above

I have confirmed with multiple prompts that weight 5.0 is significantly dumber than 2.5.

The effect is very much like what happens when you use too high of weight for MPOA ablation. The same pattern emerges for o_proj scaling

refusals reduced → reasoning degrades → replies become shorter and less logical → artifacts start to appear → total collapse into gibberish

disclaimers persist through all stages but as reasoning degrades they shift more toward personal safety than ethics or legality.

Q0 bench scores
total refusals not yet measured

• 2.5 = 8700
• 5.0 = 6348