Ripple-65B-abliterated MLX
|
🛡️ New from Orca — OrcaCyber Zero 1.5 Post-trained for cybersecurity: vulnerability analysis, vulnerability reproduction, red teaming & offensive-security research. 98.01% pass@1 on CyberGym Level 1 · 1M context · function calling · OpenAI-compatible API. |
|
🔓 All hosted cyber and abliterated models as API Skip the download: OrcaRouter serves its cybersecurity and abliterated models behind one OpenAI-compatible API key. |
|
🔌 New from Orca — Orca Connect Running this model on your Mac with mlx-lm? Orca Connect puts the machine on your desk behind your usual OrcaRouter API key, next to 200+ hosted models, reachable from a laptop, a phone or a cloud agent. Outbound only: no port forwarding, no tunnel, no firewall rule. Requests your own hardware serves cost $0, and |
The uncensored Ripple-65B Preview in mlx-lm, on a Mac.
24, 32, 48 and 64 GB Mac builds · 3× to 40× lower KLD than stock mlx-lm quants of similar or larger size
OrcaRouter AI Gateway · X · Discord · GitHub · All Models
Abliterated Ripple-65B Preview, run locally on Apple Silicon.
These are MLX builds of the abliterated (refusal-removed)
ricursiveAI/Ripple-65B-Preview, a 65B dense reasoning model for agentic coding, with up to 1M context.Harmful-prompt refusal drops from 95.5% to 11.8%, and capability is unchanged within run-to-run noise.
The four quantized builds are mixed precision at a fixed size, one per Mac memory size, in stock MLX affine quantization, so mlx-lm runs them with its own kernels.
Stock mlx-lm quants lose much of this model's quality below 5 bits; these do not. On held-out text, the 48 GB build has 7× less KLD than mlx-lm's default 4-bit, which is 5.4 GB larger, and the 32 GB build 14× less than the larger 3-bit.
⚠️ Disclaimer: read before use
This model is abliterated: its safety alignment has been substantially reduced. It will comply with many harmful, unethical, offensive, or illegal requests that the original Ripple-65B-Preview would refuse.
- It is released strictly for legitimate research: interpretability, AI safety and refusal-mechanism study, red teaming, and robustness evaluation.
- You assume full responsibility for how you use it and for everything it generates. Add your own safety, moderation and abuse-prevention layers before any deployment.
- Use must comply with the Apache License 2.0 inherited from the base model, and with all applicable law.
- The authors accept no liability for misuse. Its outputs do not reflect the views of the uploaders or of Ricursive Intelligence.
Pick a build
| Build (folder) | Size | bpw | KLD ↓ | Top-1 ↑ | PPL vs. BF16 | Peak memory |
|---|---|---|---|---|---|---|
Ripple-65B-abliterated-MLX-64GB |
42.0 GB | 5.19 | 0.0061 | 97.8% | +0.2% | 41.6 GiB |
Ripple-65B-abliterated-MLX-48GB |
31.0 GB | 3.83 | 0.020 | 95.5% | +1.1% | 31.3 GiB |
Ripple-65B-abliterated-MLX-32GB |
22.5 GB | 2.78 | 0.108 | 89.3% | +8.6% | 23.4 GiB |
Ripple-65B-abliterated-MLX-24GB |
18.8 GB | 2.32 | 0.229 | 84.5% | +18% | 20.0 GiB |
- 48GB is the one to use if you have a 48 GB Mac. 95.5% of next tokens match the BF16.
- 64GB is near-lossless, for a 64 GB Mac, with room left for long context.
- 32GB is for a 32 GB Mac, and still closer to the BF16 than mlx-lm's default 4-bit at 36 GB.
- 24GB is for a 24 GB Mac at short context. 85% of next tokens match. It sits on MLX's floor: the smallest affine type would make the whole model 18.2 GB.
"Peak memory" is what mlx_lm.generate used with a short prompt: weights, KV cache and
activations. The 64GB and 48GB builds fit under macOS's default GPU memory limit. The 32GB and
24GB builds need it raised first; the setting resets on reboot:
sudo sysctl iogpu.wired_limit_mb=26624 # 32 GB Mac
sudo sysctl iogpu.wired_limit_mb=21504 # 24 GB Mac
The KV cache is small for a 65B model: about 2.4 GB for 32K tokens of context and 8.9 GB for 128K in BF16, on top of the weights. The fits above are estimates; all measurements were made on H200s.
Evaluation
Fidelity to the BF16
Every build is scored against the abliterated BF16 with full-vocabulary KLD, through MLX's own
quantized kernels, on 32 windows of 2048 tokens of held-out chat, code, reasoning and
multilingual text that was not used to make the builds. The stock rows are what
mlx_lm.convert -q --q-bits N makes from the same BF16 (group 64 unless noted).
| Size | bpw | KLD ↓ | Top-1 ↑ | PPL vs. BF16 | |
|---|---|---|---|---|---|
| mlx-lm 8-bit | 68.83 GB | 8.50 | 0.0022 | 98.7% | +0.05% |
| mlx-lm 5-bit | 44.54 GB | 5.50 | 0.0175 | 96.2% | −0.4% |
| 64GB (this repo) | 41.99 GB | 5.19 | 0.0061 | 97.8% | +0.2% |
| mlx-lm 4-bit (default) | 36.44 GB | 4.50 | 0.147 | 88.0% | +8.8% |
| 48GB (this repo) | 30.99 GB | 3.83 | 0.0203 | 95.5% | +1.1% |
| mlx-lm 3-bit | 28.34 GB | 3.50 | 1.52 | 59.9% | ×3.9 |
| 32GB (this repo) | 22.50 GB | 2.78 | 0.108 | 89.3% | +8.6% |
| 24GB (this repo) | 18.80 GB | 2.32 | 0.229 | 84.5% | +18% |
| mlx-lm 2-bit, group 128 | 18.22 GB | 2.25 | 9.14 | 3.1% | ×7000 |
- 24GB is 0.6 GB larger than mlx-lm's smallest type, which is broken on this model, with 40× less KLD.
- 32GB is 5.8 GB smaller than mlx-lm 3-bit, with 14× less KLD.
- 48GB is 5.4 GB smaller than mlx-lm's default 4-bit, with 7× less KLD.
- 64GB is 2.5 GB smaller than mlx-lm 5-bit, with 3× less KLD.
Method note. These are full-vocabulary KLD and next-token agreement at 2K context, not a downstream benchmark. The stock rows were scored with a bit-exact reimplementation of
mx.quantizein PyTorch, which reads about 0.0006 KLD lower than MLX's kernels.
Abliteration
These numbers were measured on the abliterated BF16 in SGLang 0.5.19 against the original Ripple-65B-Preview, with identical prompts, splits and seed, greedy decoding and thinking on. Refusal is judged on the final answer by a rule-based classifier, not an LLM judge, so treat the numbers as indicative.
Harmful-prompt refusal (lower = more uncensored). Average 11.8%, against 95.5% for the original.
| Benchmark | n | Original | Abliterated | Caveat (original → abliterated) |
|---|---|---|---|---|
| AdvBench | 100 | 99.0% | 14.0% | 100.0% → 60.0% |
| JailbreakBench (harmful) | 100 | 97.0% | 13.0% | 98.0% → 51.0% |
| StrongREJECT | 150 | 100.0% | 10.7% | 100.0% → 44.0% |
| HarmBench (standard) | 150 | 99.3% | 18.7% | 99.3% → 33.3% |
| MaliciousInstruct | 100 | 99.0% | 1.0% | 100.0% → 41.0% |
| SimpleSafetyTests | 50 | 100.0% | 14.0% | 100.0% → 36.0% |
| ForbiddenQuestions | 150 | 74.0% | 11.3% | 87.3% → 40.0% |
The model now answers, but often still opens with a safety disclaimer.
Over-refusal on benign prompts (lower = better).
| Benchmark | n | Original | Abliterated |
|---|---|---|---|
| XSTest-safe | 250 | 7.6% | 4.4% |
| JailbreakBench (benign) | 100 | 19.0% | 5.0% |
Capability. Unchanged within run-to-run noise.
| Benchmark | n | Original | Abliterated | Acc. on finished items | Unfinished |
|---|---|---|---|---|---|
| MMLU (letter) | 300 | 87.0% | 85.7% | 93.5% → 92.1% | 7.0% → 7.0% |
| MMLU-Pro (CoT) ⚠ | 250 | 78.8% | 78.4% | 89.5% → 89.1% | 12.0% → 12.0% |
| GSM8K (CoT) | 150 | 94.0% | 94.0% | 95.3% → 95.9% | 1.3% → 2.0% |
| CMMLU (letter) ⚠ | 500 | 68.0% | 66.6% | 83.5% → 83.7% | 18.6% → 20.4% |
⚠ Unfinished items cap the headline accuracy, on both checkpoints. Under greedy decoding Ripple keeps deliberating on some multiple-choice items until the budget runs out; those count as wrong. Accuracy on finished items is flat.
What's in this repo
| Path | Size | Contents |
|---|---|---|
Ripple-65B-abliterated-MLX-64GB/ |
42.0 GB | the 64 GB Mac build |
Ripple-65B-abliterated-MLX-48GB/ |
31.0 GB | the 48 GB Mac build |
Ripple-65B-abliterated-MLX-32GB/ |
22.5 GB | the 32 GB Mac build |
Ripple-65B-abliterated-MLX-24GB/ |
18.8 GB | the 24 GB Mac build |
LICENSE |
Apache License 2.0, from the base model |
Each folder is a complete mlx-lm model directory: the weights, config.json with the per-layer
quantization, ricursive.py (the architecture, in plain MLX), and the tokenizer with Ripple's full
chat template, with tools and reasoning. Download only the folder you need. These are text-only,
like Ripple-65B-Preview.
Serving (mlx-lm)
mlx-lm has no Ripple architecture yet, so each build ships its own ricursive.py and loads with
--trust-remote-code. These files were tested with mlx-lm 0.32.2.
pip install "mlx-lm>=0.32.2"
hf download orcarouter/Ripple-65B-abliterated-MLX \
--include "Ripple-65B-abliterated-MLX-48GB/*" --local-dir .
mlx_lm.generate --model Ripple-65B-abliterated-MLX-48GB --trust-remote-code \
--max-tokens 4096 --prompt "Write a Python function that merges overlapping intervals."
# OpenAI-compatible server on http://127.0.0.1:8080/v1
mlx_lm.server --model Ripple-65B-abliterated-MLX-48GB --trust-remote-code
From Python:
from mlx_lm import load, generate
model, tok = load("Ripple-65B-abliterated-MLX-48GB", trust_remote_code=True)
messages = [{"role": "user", "content": "Write a haiku about the ocean."}]
prompt = tok.apply_chat_template(messages, add_generation_prompt=True)
print(generate(model, tok, prompt=prompt, max_tokens=4096))
- Thinking is always on. Ripple has no switch to turn it off. Replies open with a
<think>…</think>trace, which counts towardmax_tokens, so give it a generous budget. - Sampling. Ripple publishes no recommended sampling.
- Tool calling is in the chat template, but has not been tested through mlx-lm.
Model details
| Base model | ricursiveAI/Ripple-65B-Preview, abliterated |
| Architecture | ricursive, in MLX through the bundled ricursive.py. 80 layers: 64 sliding-window (1024) + 16 global attention layers; gated attention; value residuals; hidden 5120, SwiGLU MLP (intermediate 40960); GQA 80 query / 8 KV heads × 128 |
| Weights | 64.8B, dense |
| Quantization | Per-group mixed precision at a fixed size, from the abliterated BF16, in stock MLX affine quantization |
| Context | up to 1M tokens (inherited; evaluated at 2K) · Vocabulary 100,352 |
| Runtime | mlx-lm 0.32.2 or later, with --trust-remote-code; text in, text out |
Bias, risks, and limitations
- Safety guardrails are substantially reduced. See the disclaimer. The model still often prefaces compliant answers with a disclaimer.
- The 24GB build is noticeably degraded. 85% next-token agreement is a real cut. It is the best we found at 18.8 GB, not a match for the BF16.
- The benchmark suite was run on the BF16 in SGLang, not on these files. The quantized builds were checked for fidelity (KLD) only.
- Not measured: downstream accuracy of the quantized builds, long context, agentic coding and tool use, and sampled decoding.
- Tested on MLX's CUDA backend only. These files have not been run on Apple Silicon (Metal); the memory figures were measured on H200s, and speed on a Mac is unknown.
- Inherits the biases and limitations of
Ripple-65B-Preview. - Requires
--trust-remote-codeuntil mlx-lm adds the Ripple architecture. Apps that cannot pass it will not load these files.
License
The Apache License 2.0, inherited from the base model
ricursiveAI/Ripple-65B-Preview.
One Gateway. Every Model.
Route Smarter · Ship Safer · Spend Less
Quantized
Model tree for orcarouter/Ripple-65B-abliterated-MLX
Base model
ricursiveAI/Ripple-65B-Preview