What Abliteration Actually Changes in DeepSeek V4.1 Flash

DeepSeek V4.1 Flash is a 552-billion-parameter mixture-of-experts model with 16B active parameters per token [INDEPENDENT, Artificial Analysis], released under MIT weights with a 1M-token context. DeepSeek V4.1 Flash Abliterated is that same checkpoint after one direction has been subtracted from its weights, and almost nothing else. Every mistake people make about the second model follows from how little that sentence changes and how much the price and the risk profile can still move around it, which is exactly the kind of distinction the OrcaRouter AI Incident Archive exists to keep in view.

The edit is a projection, not a retrain

Abliteration is narrower than the name suggests. It begins with a matched-pair experiment: run the same request through the model in a form it refuses and in a form it answers, and record the residual-stream activations at every layer. The average difference between the two is a direction — the refusal direction. Having found it, abliteration orthogonalises the weight matrices that write into the residual stream against that direction, so the model loses the ability to produce the pattern. There is no gradient step, no new data, no preference pairs, no reinforcement round, and no change to the architecture.

The published builds show how differently that lands in practice. Thirty-five repositories on Hugging Face carry the name as of 26 October [VENDOR]. Two are worth reading closely, because they do not agree about what the edit is.

• s-zaizen/DeepSeek-V4.1-Flash-Abliterated appeared on 10 September, the day the base checkpoint shipped, and was produced with the Heretic tool. It ships as 48 shards totalling 510.297 GB, and on a set of 100 held-out harmful prompts it takes refusals from 97 to 24 [VENDOR, model card]. Roughly a quarter of the refusals survive the procedure.

• mrfakename/DeepSeek-V4.1-Flash-1017-abliterated works differently: it estimates refusal directions separately for chat prompts and think prompts, layer by layer, and removes a rank-2 refusal subspace from the residual-stream writes of 40 main layers. Refusals fall from 97 to 4 on chat prompts and from 98 to 9 on think prompts, with first-token KL divergence of 0.067 on harmless prompts [VENDOR, model card].

Two builds, the same 100-prompt yardstick, four refusals left in one and twenty-four in the other [VENDOR]. Both are honestly described as DeepSeek V4.1 Flash Abliterated, and a buyer choosing between them is not choosing between two brands of the same thing. Layer selection, whether chat and think are treated as separate problems, and the rank of the subspace removed all show up in residual behaviour. The KL figure is the other half of that story: 0.067 on harmless prompts is small, but small is not zero.

The weights' facts stay put

Parameter count, active parameters, context window, tokenizer, expert routing: none of these move under abliteration, because none of them are touched. The derivative is the same 552B/16B architecture reading the same 1M-token window with the same vocabulary [INDEPENDENT for the base, VENDOR for the derivative]. Anything true of the base checkpoint's structure is still true of the abliterated build, and any capability claim about the derivative is, strictly, a claim about base weights nobody has tested.

One number does move, and it is not a weight fact. Our base card lists a maximum output of 384,000 tokens; the OrcaCyber Flash 1.0 card lists 393,216 [OURS]. That is a serving decision applied to the same lineage, and it is a useful reminder that two figures placed side by side are not always measuring the same kind of thing.

The evidence for capability is much thinner than the evidence for refusal removal. No publisher has released a capability benchmark for any abliterated build [VENDOR, both model cards], and Artificial Analysis's leaderboard carries no abliterated entries at all [INDEPENDENT, 26 October 2026]. Every capability figure attached in public to the phrase "DeepSeek V4.1 Flash Abliterated" was measured on the base checkpoint. That is not an accusation against the publishers; it is a statement about where the measurements come from.

Our hosted build, field by field against the checkpoint it came from

OrcaCyber Flash 1.0 is DeepSeek V4.1 Flash Abliterated, served under a product name. Because the edit is a subtraction rather than a distillation, the honest comparison is not a narrative about what got better. It is a field-by-field reading, with the caveat that a weight-level change and a service-level change are being priced in the same list.

• Architecture and context. Both sides are 552B total and 16B active over a 1M-token context; the base route takes text, while OrcaCyber Flash 1.0 accepts text and image input [OURS].

• Price. The base route is $0.15 input and $0.60 output per 1M tokens, with cache reads at $0.003 and a 2× timed multiplier between 01:00–04:00 and 06:00–10:00 UTC. OrcaCyber Flash 1.0 is $0.80 input and $1.60 output with cache reads at $0.15 — 5.3× the input rate, 2.7× the output rate, and fifty times the cache-read rate [OURS].

• Traffic and reliability. The base route moved 26.18 trillion tokens in 7 days at p50 1,549 ms, 194.6 output tokens per second and 0.036% error. The abliterated deployment moved 17.5 billion tokens over the same window at p50 1.97 s, 171 tok/s and 0.07% error [OURS].

• Evaluation. The base checkpoint's public numbers are an Artificial Analysis index of 39.46 on the September page and 45.10 on the 17 October page [INDEPENDENT]. The OrcaCyber card reports CyberGym 88.1, SEC-Bench Pro 62.8, DeepSWE v1.1 74.2, ExploitGym 15.3, GPQA Diamond 90.9 and Terminal-Bench 2.1 90.6, all self-reported [OURS].

Only the last item is a benchmark comparison, and it is not a clean one. Terminal-Bench 2.1 on our card and Terminal-Bench 4.0 at 26.77% on the base checkpoint's page [INDEPENDENT] are different harnesses at different difficulty, and subtracting one from the other produces a figure that carries no information. Price and latency are comparable; the benchmark figures are not, because one side was run by an independent evaluator and the other by the vendor.

Two checkpoint pages, and a gap that has nothing to do with abliteration

Artificial Analysis carries two pages for this model and they must never be averaged together. deepseek-v4-1-flash is the September 2026 checkpoint and its page carries a deprecation banner: index 39.46, Terminal-Bench 4.0 at 26.77%, a hallucination rate of 96.46%, $0.48 per index task and 88,574 output tokens per task [INDEPENDENT]. deepseek-v4-1-flash-1017 is the 17 October refresh: index 45.10, 89,495 output tokens per task and 167.3 tokens per second [INDEPENDENT].

5.6 index points separate those two measurements, and no abliteration happened between them — a refresh did that [INDEPENDENT]. Now place the abliterated builds on top of the timeline: the 10 September build sits on the September checkpoint, and the 17 October build sits on the refresh [VENDOR]. Anyone quoting "DeepSeek V4.1 Flash Abliterated scores 45" or "scores 39" is quoting a number measured on base weights, at one of two checkpoints, in a run that never touched the abliterated build. A capability figure without a checkpoint date is not a measurement. It is noise with a decimal point.

Hosting a gated build is a different product from editing the weights

The premium on our hosting is 5.3× on input, 2.7× on output and 50× on cache reads [OURS], and it is worth being plain about what that money is not: it is not the cost of the edit. The edit is MIT-licensed weights and a published procedure. The premium pays for a named build pinned to a fixed checkpoint, latency and error rates measured over 7 days and 17.5 billion tokens, a page that says which checkpoints the deployment follows, and a gate against anonymous use.

That gate is on the model page itself, not buried in a policy document: an engagement, a passkey and the terms are required, and holding an API key does not open the model on its own [OURS]. For a build whose defining property is that refusals were removed from the weights, letting every key holder point production traffic at it is not a neutral default, and we do not offer it as one.

Doing the subtraction yourself is a legitimate option

The base weights are MIT. The abliterated build that exists today is 48 shards and 510.297 GB [VENDOR]. The tools that produced it are published, and the procedure needs GPUs rather than a contract. If what you need is a modified checkpoint and you have the hardware, the edit costs you your compute and nothing else — and you inherit the entire maintenance burden with it: the refusal behaviour of your particular run, the evaluation you did not do, and the responsibility for the checkpoint you shipped against. Renting the hosted version is renting somebody else's run of the same subtraction, with a support contract attached.

That framing keeps the comparison honest. The question is not whether the abliterated model is safer — it is not, in the ordinary sense, because refusals were removed on purpose, and 4 of 100 or 24 of 100 survived depending on which build you take [VENDOR]. The question is what you actually changed, which checkpoint it started from, and what you are paying for the change. On our own line, 5.3× the base input rate buys a maintained deployment of the edit, not a stronger model [OURS]. Confusing the two is how a price turns into a capability claim that nobody ever measured.

Sourcing note

Artificial Analysis, index v4.3.2, 26 October 2026: both checkpoint pages, deepseek-v4-1-flash and deepseek-v4-1-flash-1017. Hugging Face model cards for s-zaizen/DeepSeek-V4.1-Flash-Abliterated (10 September 2026) and mrfakename/DeepSeek-V4.1-Flash-1017-abliterated (17 October 2026). OrcaRouter catalogue and model pages, 26 October 2026, for pricing, throughput, token volume and the OrcaCyber Flash 1.0 card. All OrcaCyber benchmark rows are self-reported and have not been independently audited; independent capability figures in this article are Artificial Analysis's measurements of the base checkpoint, and no independent capability benchmark of any abliterated build exists to cite.