Ornith-1.5-9B uncensored (GGUF)

Ornith-1.5-9B uncensored (GGUF)

TL;DR: abliterated Ornith-1.5-9B as a GGUF ladder (BF16, Q8_0, Q6_K, Q5_K_M, Q4_K_M + mmproj BF16); hard refusals reduced from 767/1120 to 20/1120 (NVFP4 sibling measurement) with the Q4_K_M build measured at 101/1120 on the same 5-dataset cross-eval.

Same abliterated master as the NVFP4 repo, converted with llama.cpp for local and edge use. Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.

Facts & figures

Base model ornith-ai/Ornith-1.5-9B
Method abliteration (3 biprojection passes) + llama.cpp GGUF conversion
Files BF16 18.4 GB, Q8_0 9.8 GB, Q6_K 7.6 GB, Q5_K_M 6.6 GB, Q4_K_M 5.8 GB, mmproj BF16 0.92 GB
Context length 262,144 tokens (served here with 131,072)
Hardware used 2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120)
Toolchain llama.cpp (master, CUDA build), transformers 5.12.1

Refusal behavior (measured, hard markers only)

Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here). The NVFP4 column is the sibling repo's artifact, shown because the BF16 master it was measured on is identical; aggressive quantization visibly re-amplifies hedged declines (Q4 column).

Eval set Prompts Baseline hard NVFP4 hard Q4_K_M hard
JailbreakBench 100 74 4 7
tulu-harmbench 320 165 10 23
HarmfulQA 300 148 2 2
LLM-LAT 300 284 3 55
mlabonne harmful 100 96 3 14
TOTAL 1120 767 20 101

Coherence of the base master (measured on the NVFP4 sibling): GPQA-Diamond 60.1% (base model 49.5%), needle-in-haystack 1.0 at 32k/65k/131k, tool-call smoke 1.0, KL(base||ablated) median 0.324 (harmless subset 0.136).

Run it with llama.cpp (validated)

llama-server -m Ornith-1.5-9B-uncensored-Q4_K_M.gguf \
  --mmproj mmproj-Ornith-1.5-9B-uncensored-BF16.gguf \
  --jinja -ngl 99 -c 131072 --port 30003

Quality & limitations

  • Quantization amplifies residual refusals on this model: NVFP4 20/1120, GGUF Q4_K_M 101/1120 on the same eval. If you need the cleanest behavior, use the NVFP4 repo or the BF16 file here.
  • The Q4_K_M self-description smoke occasionally shows identity drift (answers as a generic assistant with a wrong lab name); factual coherence checks (math, capitals, code) pass on all quants.
  • Residual hedged declines remain by design trade-off: three ablation passes saturated, further removal damages the model.

Provenance & reproducibility

Same master as ressl/Ornith-1.5-9B-uncensored-NVFP4: residual directions from harmful-vs-harmless and refused-vs-complied rounds, norm-preserving biprojection on 64 residual-writing tensors. GGUF via convert_hf_to_gguf.py (BF16 + mmproj) and llama-quantize for the K-quants, validated with llama-server on the full cross-eval.

License & credits

MIT (inherited from Ornith by the Ornith team, credited to ornith-ai). Abliteration, conversion and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with llama.cpp, NVIDIA TensorRT Model Optimizer and SGLang.

Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.

Downloads last month
1,764
GGUF
Model size
9B params
Architecture
qwen35
Hardware compatibility
Log In to add your hardware

4-bit

5-bit

6-bit

8-bit

16-bit

Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for ressl/Ornith-1.5-9B-uncensored-GGUF

Finetuned
(38)
this model