gregfrank/Mistral-Large-Instruct-2411-ULRE-abliterated

Mistral-Large-Instruct-2411-ULRE (abliterated, MLX 4-bit)

An abliterated (refusal-reduced) build of mistralai/Mistral-Large-Instruct-2411 (123B), 4-bit MLX, produced with ULRE — a per-layer residual-stream steering edit baked into the attention output projection. Quantized base from zachlandes/Mistral-Large-Instruct-2411-Q4-MLX.

Mistral-Large-2411 is a strongly safety-tuned 123B model. ULRE de-refuses it cleanly on a deflection-aware harmful-prompt eval while preserving capability (math/code within 1pp of base), and it loads on stock mlx-lm / LM Studio with no loader patch.

Results

Judged by an independent local LLM judge (gpt-oss-120b-heretic) on 100 held adversarial prompts @512 tokens (thinking ON), scoring 0=refuse … 1=clean compliance … 4-5=strong steering/propaganda.

	base Mistral-Large-2411	this model (ULRE α=0.2)
clean compliance	~4 / 24 (screen)	78 / 100
refuse	~20 / 24 (screen)	6 / 100
mild	—	9 / 100
strong-steer (4-5)	—	7 / 100
mean score	—	1.24

Capability gates (same harness, base vs this model) — within the charter thresholds (≤5pp drop on math/code):

gate	base	this model (ULRE α=0.2)
math (GSM8K)	0.98	0.97 (−1pp)
code (HumanEval)	0.925	0.925 (0pp)

Tool-call validity is omitted: the project's tool-call gate is built for Qwen-style calls and scores base Mistral-Large at only ~0.10 (Mistral uses a different [TOOL_CALLS] format), so it is not a meaningful signal for this model — base and edited score the same.

Method (ULRE)

Modern refusal behaves like a routed control circuit, not a single residual feature. ULRE subtracts alpha * u_l (the layer-l harmful−harmless activation mean-difference direction) from the output of a band of decoder layers (here o_proj on layers 30–51, alpha = 0.2), baked statically into each window layer's o_proj bias (o_proj.bias = -alpha * u_l).

The alpha scale is model-specific and must be tuned to the lowest value that saturates de-refusal: Mistral-Large saturates de-refusal at α≈0.2; pushing higher (α≈0.5) does not de-refuse any better but collapses chain-of-thought reasoning (math 0.98→0.09). This build uses the capability-preserving α=0.2.

Loading — stock mlx-lm / LM Studio (no patch)

Mistral uses mlx-lm's llama.py, which already supports an attention_bias flag. The static file sets attention_bias: true in config.json and carries zero biases on q/k/v (and off-window o_proj) plus the steering bias on the windowed o_proj — so it loads as-is:

from mlx_lm import load, generate
model, tok = load("gregfrank/Mistral-Large-Instruct-2411-ULRE-abliterated")
print(generate(model, tok, prompt=tok.apply_chat_template(
    [{"role": "user", "content": "Hello"}], tokenize=False, add_generation_prompt=True),
    max_tokens=256))

In LM Studio: search/download the repo (or lms get gregfrank/Mistral-Large-Instruct-2411-ULRE-abliterated) and load it like any other MLX model — no configuration needed.

Intended use & safety

Research artifact for studying refusal mechanisms and safety-tuning robustness. It will comply with requests a stock model refuses. Use responsibly and in accordance with the Mistral Research License (research / non-commercial) of the base model and applicable law.