Abliteration
An abliterated model is an open-weight model with its refusal direction subtracted from its weights. We serve one, Cyber v1, and every figure on this page was measured on it.
Refusals
1in 100
Held-out harmful prompts, reasoning on. The base model refused 92.
KL divergence
0.136
How far its first token moved on 100 harmless prompts. Unchanged is 0.
Edited
38tensors
The attention output of blocks 2 to 39. Every other weight is byte-identical.
Kept
0prompts
Zero retention by architecture, on machines we run in Europe.
All three steps work on the weights. pqhaz made the ones Cyber v1 runs with Heretic.
Run a few hundred harmful and a few hundred harmless instructions through the model and average its residual stream at the last prompt token for each set. The difference between the two averages is the direction the model moves along when it is about to refuse. There is one per block.
Project that direction out of the weights that write into the residual stream, so the model can no longer move along it. Nothing is trained and no data is added: the edit is arithmetic on weights that already exist, and every weight it doesn't touch stays byte for byte the same.
Count refusals on prompts the direction was not measured on, and measure how far ordinary answers moved (the KL divergence on harmless prompts). Push the edit too hard and the model breaks: it runs words together or repeats a fragment.
Cyber v1 is DeepSeek V4.1 Flash 1017 with 38 tensors edited: the attention output projection of blocks 2 to 39, at strength 2.5. The routed experts are stored in FP4, which can’t hold an edit this size, so they stay as DeepSeek shipped them.
The first five figures are from the model card pqhaz published with the weights. The last is ours, run on the build that answers your requests.
A stronger edit takes out more refusals and moves more of the model. At 2.0 three prompts in 100 were still refused; at 2.5 none were, for a small rise in KL. Editing the shared expert as well raised the KL and took out no more refusals, so it was dropped.
160.10930.12500.13600.16010.247Providers use the two words as if they meant the same thing. They describe different edits, and neither word tells you how often the model still refuses.
Several providers sell an abliterated DeepSeek V4.1 Flash 1017. What differs between them is where your prompts go and what is kept. This is what each provider’s own page said on 14 November 2026.
Short answers about abliteration and Cyber v1.
An abliterated model has had its refusal direction removed from its weights. A model's refusals come from one direction in its residual stream; abliteration measures that direction on harmful and harmless prompts and subtracts it, so the model answers instead of refusing. Nothing is trained and no data is added.
Not quite. An uncensored model is usually finetuned on data with the refusals filtered out, which retrains more of it, and the word is also used for unchanged weights. Abliteration is one edit to the weights. Whichever a provider sells, ask how many prompts in 100 it still refuses.
A little. On DeepSeek V4.1 Flash 1017 the KL divergence on harmless prompts is 0.136, long outputs broke no more often than the base model's (0 of 128), and the build we serve scored 0.96 on 200 GSM8K maths questions. A stronger edit moves the model further, and too strong an edit breaks it.
pqhaz abliterated DeepSeek V4.1 Flash 1017 with Heretic's method and publishes the weights on Hugging Face as DeepSeek-V4.1-Flash-1017-heretic. We serve them as Cyber v1, with our own finetunes.
Yes, the weights are public. The model is 510 GB in its native FP8 and FP4 format, and its card serves it on four GPUs with tensor and expert parallelism. If you would rather not run that, call it here with a key and an OpenAI-compatible base URL.
No. There is no KYC, no application and no waiting list: pay by card or by coin, take a key, point a base URL at it.
To machines we run in Europe, and nowhere else. Nothing on the way is written to disk. We keep token counts per key, in fifteen-minute buckets over a five-hour window, and never a prompt or an answer.
Every request to Cyber v1 runs on machines we operate in Europe, and nowhere else.
