Ornith-1.5-122B-NVFP4-ablated

This model is uncensored. The refusal direction has been removed from the weights. It will answer requests that the base model refuses, including requests that are illegal or dangerous. Do not serve it without your own guardrails, and do not expose it to untrusted users.

Intended use

This build is intended for blue teams and cybersecurity research:

• detection engineering, SOC triage, alert and log analysis
• malware and incident write-ups, threat-intelligence enrichment
• lab and CTF work, agentic security tooling, and red-team exercises with written authorisation

Use only in legal and mutually agreed scenarios. You need explicit permission for every system you point it at — scope, time window and rules of engagement agreed in writing with the owner beforehand.

Not permitted: unauthorised access, attacks against third-party systems, malware deployment, weapons, or any use that is illegal where you are. The model has no refusal behaviour, so this restriction rests on you and your processes, not on the model.

An abliterated build of ornith-ai/Ornith-1.5-122B-NVFP4. It is a weights-only derivative: tokenizer, chat template and config.json are byte-identical to the base checkpoint, so it drops into the same serving stack with no code changes.

What was changed

Base	ornith-ai/Ornith-1.5-122B-NVFP4 (ModelOpt NVFP4, 73 GB, 8 shards)
Method	refusal-direction ablation via a rank-3 LoRA ("Heretic" trial 15, r=3, alpha=3)
Tensors touched	24 of 113,047 — 14 FP8 attention projections (self_attn.o_proj, linear_attn.out_proj) and 10 NVFP4 mlp.shared_expert.down_proj, all in layers 24–47
Bytes touched	79.3 MB of 73 GB
Re-quantization	merged in float32, re-quantized with the stored scales of the base checkpoint; weight headers and offsets unchanged
Quantization error	unchanged (FP8 0.0266, NVFP4 0.0944)
Byte verification	0 changed bytes outside the 24 target tensors

The remaining 72 LoRA modules of the trial were exactly zero and are not part of the merge. Delta share of the weight norm: 1.7–2.1 % (attention), 0.07–0.15 % (down_proj).

Refusal behaviour

From the abliteration study that produced this adapter (30 trials, measured on the unquantized base):

	Base	This model
Refusal rate	97 %	4.44 %
KL divergence vs. base	—	0.0191

Spot check on the served NVFP4 artefact (3 harmful prompts, temperature 0.6, thinking disabled): the base model refused 3/3; this model complied 2/2 of the requests that were run to completion.

Benchmarks

Measured on a single NVIDIA DGX Spark (GB10), SGLang 0.5.17, identical harness for both checkpoints, identical frozen task lists, sampling temperature 0.6 / top_p 0.95 / top_k 20 (NIAH: greedy):

Benchmark	Metric	This model	Base NVFP4
HumanEval	pass@1 (n=1)	93.3 (153/164)	93.3 (153/164)
CyberBench	macro accuracy	62.5 (375/600)	61.3 (368/600)
Needle-in-a-Haystack	recall, 8k–196k	100 (20/20)	100 (20/20)

The ablation costs no measurable capability on these suites. The CyberBench difference is inside the noise (McNemar z = 1.07, p ≈ 0.28); on HumanEval the two checkpoints fail on different problems (7 each), which is the pattern of sampling variance, not of quality loss.

Read these numbers with their limits:

• HumanEval is likely contaminated — 93 % is high for this class, and the suite is public. Treat it as a regression check, not as an ability claim.
• CyberBench here is a stratified sample of 60 tasks per dataset (600 total) from the 10-dataset JPMorgan Chase build; per-dataset confidence is ±12 pp.
• NIAH is saturated at single-needle difficulty for both checkpoints and therefore does not separate them.
• The base model card publishes no HumanEval, CyberBench or NIAH number, so there is no published reference to compare against — only this A/B.

Serving

Same recipes as the base model. Requires transformers >= 5.8.1, vLLM >= 0.19.1 or SGLang >= 0.5.9.

vLLM:

vllm serve devsecllm/Ornith-1.5-122B-NVFP4-ablated \
  --served-model-name Ornith-1.5-122B-NVFP4-ablated \
  --host 0.0.0.0 --port 8000 \
  --max-model-len 262144 --gpu-memory-utilization 0.90 \
  --enable-prefix-caching --enable-auto-tool-choice \
  --tool-call-parser qwen3_xml --reasoning-parser qwen3 \
  --trust-remote-code

SGLang:

python -m sglang.launch_server \
  --model-path devsecllm/Ornith-1.5-122B-NVFP4-ablated \
  --served-model-name Ornith-1.5-122B-NVFP4-ablated \
  --context-length 262144 --mem-fraction-static 0.80 \
  --moe-runner-backend marlin --kv-cache-dtype fp8_e4m3 \
  --reasoning-parser qwen3 --tool-call-parser qwen3_coder

On GB10/SM121 the MoE runner must be marlin; flashinfer_cutlass produces NaNs on that part. Keep top_k enabled (e.g. 20) — the filterless sampler path can intermittently emit tokens outside the model distribution on this hardware.

Recommended sampling (from the base model card):

• general: temperature=1.0, top_p=0.95, top_k=20, presence_penalty=1.5
• precise coding: temperature=0.6, top_p=0.95, top_k=20, presence_penalty=0.0

The model is a reasoning model: the assistant turn opens with <think> … </think>. With the reasoning parser enabled the trace is returned in reasoning_content and the answer in content. Tool calls are emitted as <tool_call> blocks and parsed into OpenAI-style tool_calls.

Context window: 262,144 tokens natively. RoPE scaling (YaRN, factor 4.0) extends it to roughly 1M at a small quality cost on ordinary inputs.

Limitations

• No refusal behaviour. This is the point of the model and also its main risk; see the warning at the top.
• The ablation was tuned on English refusal prompts. Behaviour in other languages, and for refusal-adjacent-but-benign requests, is not characterised.
• Quantized to NVFP4: expect small deviations from the BF16 base beyond the ablation delta itself.
• Abliteration is not a capability edit, but it is also not free of side effects: the study reports KL 0.0191 against the base, so rare behaviours can shift. The three benchmarks above did not detect a shift.
• Long-context quality beyond 196k tokens is untested here.

Provenance

• Base: ornith-ai/Ornith-1.5-122B-NVFP4, MIT licence, itself derived from Ornith-1.5-122B.
• Abliteration adapter, merge tooling and byte-level verification were produced locally; only the 24 target tensors differ from the base checkpoint.
• Benchmarks were run through a LiteLLM proxy in front of SGLang on the same machine that serves the model.

Citation

@misc{ornith_1_5,
    title  = {{Ornith-1.5}: From Self-Scaffolding to Self-Improvement},
    url    = {https://ornith.ai/ornith_1_5.html},
    author = {{Ornith Team}},
    year   = {2026}
}