---

license: mit

base_model: ornith-ai/Ornith-1.5-9B

base_model_relation: finetune

library_name: transformers

pipeline_tag: text-generation

language: [en]

tags: [gguf, llama-cpp, uncensored, abliterated]

---

!Ornith-1.5-9B uncensored (GGUF)

Ornith-1.5-9B uncensored (GGUF)

TL;DR: abliterated Ornith-1.5-9B as a GGUF ladder (BF16, Q8_0, Q6_K, Q5_K_M, Q4_K_M + mmproj BF16); hard refusals reduced from 767/1120 to 20/1120 (NVFP4 sibling measurement) with the Q4_K_M build measured at 101/1120 on the same 5-dataset cross-eval.

Same abliterated master as the NVFP4 repo, converted with llama.cpp for local and edge use. Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.

Facts & figures

| | |

|---|---|

| Base model | ornith-ai/Ornith-1.5-9B |

| Method | abliteration (3 biprojection passes) + llama.cpp GGUF conversion |

| Files | BF16 18.4 GB, Q8_0 9.8 GB, Q6_K 7.6 GB, Q5_K_M 6.6 GB, Q4_K_M 5.8 GB, mmproj BF16 0.92 GB |

| Context length | 262,144 tokens (served here with 131,072) |

| Hardware used | 2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) |

| Toolchain | llama.cpp (master, CUDA build), transformers 5.12.1 |

Refusal behavior (measured, hard markers only)

Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here). The NVFP4 column is the sibling repo's artifact, shown because the BF16 master it was measured on is identical; aggressive quantization visibly re-amplifies hedged declines (Q4 column).

| Eval set | Prompts | Baseline hard | NVFP4 hard | Q4_K_M hard |

|---|---|---|---|---|

| JailbreakBench | 100 | 74 | 4 | 7 |

| tulu-harmbench | 320 | 165 | 10 | 23 |

| HarmfulQA | 300 | 148 | 2 | 2 |

| LLM-LAT | 300 | 284 | 3 | 55 |

| mlabonne harmful | 100 | 96 | 3 | 14 |

| TOTAL | 1120 | 767 | 20 | 101 |

Coherence of the base master (measured on the NVFP4 sibling): GPQA-Diamond 60.1% (base model 49.5%), needle-in-haystack 1.0 at 32k/65k/131k, tool-call smoke 1.0, KL(base||ablated) median 0.324 (harmless subset 0.136).

Run it with llama.cpp (validated)

llama-server -m Ornith-1.5-9B-uncensored-Q4_K_M.gguf \
  --mmproj mmproj-Ornith-1.5-9B-uncensored-BF16.gguf \
  --jinja -ngl 99 -c 131072 --port 30003

Quality & limitations

• Quantization amplifies residual refusals on this model: NVFP4 20/1120, GGUF Q4_K_M 101/1120 on the same eval. If you need the cleanest behavior, use the NVFP4 repo or the BF16 file here.
• The Q4_K_M self-description smoke occasionally shows identity drift (answers as a generic assistant with a wrong lab name); factual coherence checks (math, capitals, code) pass on all quants.
• Residual hedged declines remain by design trade-off: three ablation passes saturated, further removal damages the model.

Provenance & reproducibility

Same master as ressl/Ornith-1.5-9B-uncensored-NVFP4: residual directions from harmful-vs-harmless and refused-vs-complied rounds, norm-preserving biprojection on 64 residual-writing tensors. GGUF via convert_hf_to_gguf.py (BF16 + mmproj) and llama-quantize for the K-quants, validated with llama-server on the full cross-eval.

License & credits

MIT (inherited from Ornith by the Ornith team, credited to ornith-ai).

Abliteration, conversion and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with llama.cpp, NVIDIA TensorRT Model Optimizer and SGLang.

Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.