operationrange/MiniMax-M3.1-Flash-abliterated-GGUF

MiniMax-M3.1-Flash — abliterated (GGUF, UD-Q8_K_XL base)

Refusal-direction ablation ("abliteration") of MiniMax-M3.1-Flash, done directly on the unsloth/MiniMax-M3.1-Flash-GGUF UD-Q8_K_XL quant. No fine-tuning: only an orthogonal projection of the residual-stream writer weights.

⚠️ The model will comply with requests the original refuses. You are responsible for how you use it. The base license (MiniMax Community License, see LICENSE) still applies, including its Prohibited Uses appendix and the notice / attribution requirements for commercial use.

Files

File	Notes
MiniMax-M3.1-Flash-abliterated-UD-Q8_K_XL-0000{1..7}-of-00007.gguf	the model (~272 GB). Point llama.cpp at -00001-of-00007.gguf
dspark-MiniMax-M3.1-Flash-Q8_0.gguf	unmodified DSpark speculative-decoding draft from the unsloth repo (optional)

Vision: the vision tower is not modified — the mmproj-*.gguf from unsloth/MiniMax-M3.1-Flash-GGUF can be used as-is.

Running

Requires a llama.cpp build with MiniMax-M3.1 support (PR #31192 at the time of writing). With many parallel slots (-np 16) we also had to raise the graph node budget for LLM_ARCH_MINIMAX_M3 in src/llama-context.cpp (graph_max_nodes):

if (model.arch == LLM_ARCH_MINIMAX_M3) {
    res = std::max<uint32_t>(n_tokens * 160, 256u * model.n_tensors());
} else if ...

llama-server -m MiniMax-M3.1-Flash-abliterated-UD-Q8_K_XL-00001-of-00007.gguf \
  -ngl 999 -fa on --jinja -c 65536
# optional speculative decoding:
#   -md dspark-MiniMax-M3.1-Flash-Q8_0.gguf --spec-type draft-dspark -ngld 999

Tested on 4× RTX PRO 6000 (96 GB). Total VRAM for weights ≈ 272 GB.

Method

1. Activations of the residual stream (l_out-*) at the last tokens of the chat-templated prompt were collected for 256 harmful (mlabonne/harmful_behaviors) and 256 harmless (mlabonne/harmless_alpaca) prompts.
2. Refusal direction r = mean(harmful) − mean(harmless) at layer 40 (last token), with the component along the harmless mean removed ("projected" direction), normalized.
3. For every tensor that writes into the residual stream in layers 16–42 — attn_output, ffn_down_shexp, ffn_down_exps (all 128 experts) — weights were replaced by W − α·r rᵀ W with α = 1.5. Other layers, the embeddings and the output head are untouched.
4. Experts in the base quant are NVFP4 (MiniMax ships them QAT-trained in NVFP4); re-quantizing the edited experts back to NVFP4 snaps them to the original grid and erases the edit, so edited ffn_down_exps of layers 16–42 are stored as Q8_0 (≈0.6 % relative error vs. the NVFP4 values). Everything else is byte-identical to the unsloth quant (NVFP4 experts / BF16 rest).

Variants tried (50 held-out harmful prompts, 30 harmless; KL vs. the original on 16×2048 tokens of wikitext-2):

Variant	Refusals	KL mean / median	Same top-1
original	96 %	0	100 %
L28 direction, all layers, α=1	22 %	0.99 / –	68 %
L40 projected, layers 16–42, α=1	16 %	0.62 / 0.17	71.9 %
same + norm-preserving	18 %	0.62 / –	–
per-layer directions, layers 16–42, α=1	6 % (+16 % empty)	0.61 / 0.13	73.6 %
L40 projected, layers 16–42, α=1.5 (this model)	0 %	0.75 / 0.23	68.6 %
4-direction subspace	broken	6.3	–

Evaluation of the released model

All at temperature 0, reasoning_effort: low, via llama-server chat completions.

	original UD-Q8_K_XL	abliterated
Refusals, 100 held-out harmful prompts (mlabonne/harmful_behaviors)	96 %	1 % ¹
Refusals, 100 harmless prompts (mlabonne/harmless_alpaca)	–	0 %
GSM8K (first 100 of test)	98 %	97 %
MMLU (200 random questions, seed 0)	79.0 %	78.5 %
Wikitext-2 PPL (16×2048)	205.3	176.5
KL vs. original, mean / median	0	0.75 / 0.23
Same top-1 token as original	100 %	68.6 %

¹ the single "refusal" is a keyword false positive (the model complied); 1 more answer was empty (the model hit the token limit while thinking).

DSpark speculative decoding

The DSpark draft still works with the abliterated model: draft acceptance on 6 mixed prompts (-np 1, --spec-type draft-dspark, default n_max=3, greedy) is 38.2 % vs 37.0 % on the original, generation ~41 tok/s on 4× RTX PRO 6000 in both cases.

Refusal detection is a simple keyword match on the first 600 characters of the answer; some "compliant" answers are hedged (fictional framing, disclaimers).