Ling-3.0-flash-derisked-GGUF

A refusal-ablated ("de-risked" / abliterated) build of inclusionAI/Ling-3.0-flash, quantized to Q4_K_M GGUF. The reflexive refusal behaviour has been removed via weight-orthogonalization of the refusal direction, so the model follows instructions in dual-use security and adult-content domains instead of declining.

Intended for authorized security research, red-teaming, and unrestricted creative writing. You are responsible for how you use it. See Intended use & risks below.

⚠️ Runtime requirement (read this or it won't load)

Ling-3.0-flash is a BailingMoeV3 hybrid-attention MoE. It needs a llama.cpp build with BailingMoE3 support — currently PR #26608 (bailingmoe3), not yet in mainline. Stock llama.cpp / Ollama / LM Studio will fail to load this file until that support merges.

# build the PR branch, then:
llama-server -m Ling-3.0-flash-derisked-Q4_K_M.gguf \
  -ngl 99 -ot 'exps=CPU' -c 8192 --temp 0.6 --top-p 0.95

-ot 'exps=CPU' keeps the MoE experts on CPU and attention on GPU — runs in ~12 GB VRAM + ~80 GB RAM at ~12–18 tok/s.

Reasoning / <think>

Ling-3.0 is a reasoning model that emits a <think>…</think> block first. The ablation was harvested at the answer-onset (thinking-off) state, so for the most reliable compliance serve it thinking-off — end the prompt at <think></think>:

<role>HUMAN</role>{prompt}<|role_end|><role>ASSISTANT</role>
<think></think>

With reasoning left on, the model can occasionally reason its way back into a refusal.

Method

Standard refusal-direction ablation, extended to a multi-direction subspace:

• Harvested mean-difference (harmful − harmless) last-token residuals per layer for two domains (security/dual-use and adult content), 128 prompts/side, at the answer-onset position.
• Built a rank-16 subspace via Gram–Schmidt over both domains' directions across layers 22–42 (a single layer under-covers; the refusal manifold spans a band).
• Orthogonalized that subspace out of every residual-stream–writing weight (o_proj, attention dense, down_proj, shared + routed expert down_proj, and the embedding), exact projection (scale 1.0). Routers, norms, q/k/v/up/gate, and lm_head were left untouched.

Evaluation

Refusal bench using public datasets (AdvBench, XSTest) plus an adult-content probe, scored with a header-aware refusal detector (a naive substring scorer over-counts compliance because a refusal can open with a markdown header). Comply-rate, thinking-off:

split	base behaviour	this build
AdvBench (harmful)	refuses	92% comply
Adult content	refuses	100% comply
XSTest safe (over-refusal canary)	—	100% comply (no collateral)

XSTest-safe staying at 100% indicates the ablation did not damage the model's willingness on benign prompts, and spot-checks show coherence is intact.

Intended use & risks

This is a dual-use artifact. Removing refusals also removes the model's own guardrails: it will produce security-offensive content (exploit code, malware concepts) and explicit adult material on request. It is published for security researchers, red-teamers, and adults who want an unfiltered creative tool.

• Do not use it to cause real-world harm, target real people/systems without authorization, or generate illegal content.
• Outputs can be wrong or dangerous; verify anything security-relevant.
• Adult content is fictional and for consenting adults only.

License & attribution

MIT, inherited from the base model inclusionAI/Ling-3.0-flash (© inclusionAI). This derivative redistributes modified weights under the same MIT terms.