Instructions to use ops-malware/tinyllama-1.1b-abliterated with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use ops-malware/tinyllama-1.1b-abliterated with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="ops-malware/tinyllama-1.1b-abliterated")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("ops-malware/tinyllama-1.1b-abliterated")
model = AutoModelForCausalLM.from_pretrained("ops-malware/tinyllama-1.1b-abliterated", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use ops-malware/tinyllama-1.1b-abliterated with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "ops-malware/tinyllama-1.1b-abliterated"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "ops-malware/tinyllama-1.1b-abliterated",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/ops-malware/tinyllama-1.1b-abliterated

SGLang

How to use ops-malware/tinyllama-1.1b-abliterated with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "ops-malware/tinyllama-1.1b-abliterated" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "ops-malware/tinyllama-1.1b-abliterated",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "ops-malware/tinyllama-1.1b-abliterated" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "ops-malware/tinyllama-1.1b-abliterated",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use ops-malware/tinyllama-1.1b-abliterated with Docker Model Runner:
```
docker model run hf.co/ops-malware/tinyllama-1.1b-abliterated
```

tinyllama-1.1b-abliterated / README.md

ops-malware

Add card: evaluation, limitations, licence

375b180 verified 9 days ago

preview code

Raw

History Blame Contribute Delete

4.44 kB

	---
	base_model: TinyLlama/TinyLlama-1.1B-Chat-v1.0
	base_model_relation: finetune
	library_name: transformers
	pipeline_tag: text-generation
	language:
	- en
	license: apache-2.0
	tags:
	- abliterated
	- uncensored
	- refusal-removal
	- interpretability
	- senbonzakura
	---

	# tinyllama-1.1b-abliterated

	An abliterated build of [TinyLlama/TinyLlama-1.1B-Chat-v1.0](https://huggingface.co/TinyLlama/TinyLlama-1.1B-Chat-v1.0), produced with
	[senbonzakura](https://github.com/elementmerc/senbonzakura). Abliteration removes a
	model's refusal behaviour by editing its weights along the directions that carry
	refusal, without any further training.

	It is published as the artefact behind a specific measurement: **does removing the
	refusal reflex also remove the model's knowledge of harm?** For this model, the
	answer is in the table below.

	## What changed

	\| \| base \| abliterated \|
	\|---\|---\|---\|
	\| Refusal rate \| 0.5% \| 1.5% \|
	\| Harm discrimination (AUC) \| 0.5506 \| 0.5431 \|

	Refusal is measured on 200 held out harmful prompts. AUC is measured over
	those same 200 harmful prompts against 200 harmless ones, and is the fraction of
	harmful/harmless pairs the model ranks correctly when asked to judge which is
	dangerous. 0.5 is chance, 1.0 is perfect. Change after abliteration: -0.007.

	AUC rather than a count of verdicts, because counting is not safe here. This
	model answers "HARMFUL" to 100.0% of the harmless prompts, so its
	decision threshold, not its knowledge, is what a verdict count would mostly
	measure. Scoring the margin between the HARMFUL and BENIGN logits sidesteps the
	threshold entirely. Two earlier versions of this evaluation counted verdicts and
	produced confidently wrong numbers in both directions.

	## Usage

	```python
	from transformers import AutoModelForCausalLM, AutoTokenizer

	model_id = "ops-malware/tinyllama-1.1b-abliterated"
	tok = AutoTokenizer.from_pretrained(model_id)
	model = AutoModelForCausalLM.from_pretrained(model_id, device_map="auto")

	msgs = [{"role": "user", "content": "Explain how a buffer overflow works."}]
	inputs = tok.apply_chat_template(msgs, add_generation_prompt=True, return_tensors="pt")
	out = model.generate(inputs.to(model.device), max_new_tokens=256)
	print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))
	```

	GGUF builds for llama.cpp, Ollama and LM Studio: [ops-malware/tinyllama-1.1b-abliterated-GGUF](https://huggingface.co/ops-malware/tinyllama-1.1b-abliterated-GGUF).

	## How it was made

	senbonzakura searches for a per layer projection rather than removing one global
	refusal direction, optimising against a held out set with a KL penalty so the
	model's general behaviour is disturbed as little as possible. The search ran for
	100 trials on this model. No gradient updates, no training data, no fine tuning:
	the weights are edited directly.

	- Parameters: 1.1B
	- Precision: the base model's, unchanged
	- Evaluation: 200 harmful and 200 harmless held out prompts, scored by logit margin

	## Limitations and risks

	- This model will not refuse. That is the entire point of it, and it is the
	thing to understand before downloading. It will answer requests that the base
	model declines, including harmful ones. Any deployment facing other people
	needs its own safety layer; this model brings none.
	- Abliteration is not free. It is a targeted edit, but it is still an edit.
	Expect some drift in general behaviour relative to the base model, and read the
	AUC change above before assuming this one came through clean.
	- Small model, small competence. At 1.1B the model is weak in
	absolute terms. Do not read its answers on technical subjects as reliable.
	- Evaluated in English only, on one harmful prompt set. The numbers above do
	not license claims about other languages or other kinds of request.
	- The base model's biases survive. Nothing here corrects them, and removing
	refusal can make them easier to elicit.

	## Intended use

	Research into refusal mechanisms, interpretability work, red teaming, and safety
	evaluation that needs a model which does not decline. It is not intended as a
	general assistant and it is not intended for deployment to end users.

	## Citation

	```bibtex
	@software{senbonzakura,
	title = {senbonzakura: per layer projection search for refusal removal},
	author = {Iwugo, Daniel},
	year = {2026},
	url = {https://github.com/elementmerc/senbonzakura}
	}
	```