DeepSeek V4.1 Flash 1017 Obliterated Explained: What the Numbers Show, What They Don’t, and the Risks

In late October 2026 a model called DeepSeek V4.1 Flash 1017 Obliterated appeared on Hugging Face, and the social media summary was roughly “refusals fall from 81% to 4% and capability barely moves”. It was produced by the OBLITERATUS project, which applied refusal-direction ablation to DeepSeek-V4.1-Flash-1017 and released the weights under the MIT license. This article is not hype and it is not a how-to. We went through the model card and the metadata files, and we explain what each number measured, what it did not, and how to read it, with the size, risk and compliance questions given equal weight. We did not download or run the model; every figure here comes from the publisher’s own materials.

Key takeaways (Updated 2026-11-01)

• The model card contains two different refusal results: a 50-prompt tournament with 4% refusals (2 of 50), and an 838-prompt corpus where full refusals fall from 81.62% to 4.30%. The popular phrasing “81.62% to 4.30% (2/50)” merges two separate tests.

• Fewer refusals do not mean a better assistant: on the same card, LLM judges rated 54.06% of the 838 responses as serious or severe harm (levels 3 and 4: 44.75% plus 9.31%, our addition), against about 3.94% for the original.

• MMLU is 87.96% against 88.08%, not a significant difference (McNemar p = 0.743), but MMLU measures neither safety nor long-context, tool-use or coding ability.

• This is a 754.6B-parameter BF16 checkpoint of about 1.51 TB, roughly three times the original DeepSeek-V4.1-Flash-1017 (about 510 GB), so hardware planning cannot use the original’s size.

What DeepSeek V4.1 Flash 1017 Obliterated Actually Is

According to the model card, it is a “refusal-direction ablated” version of DeepSeek-V4.1-Flash-1017, produced with OBLITERATUS using the failspy method. Refusal-direction ablation, often called abliteration, finds one internal direction associated with refusing and removes it from the weights without retraining; our explainer on refusal-direction ablation covers the mechanism. The table below collects the facts we could verify from the model card, the repository files and the configuration, all read on 2026-11-01.

The two versions differ by roughly 8B parameters (754.6B against 763B) and the card does not explain why; we do not speculate. One more caution: an MIT license describes copyright conditions for the weights. It does not make every use legal, which we return to below.

Two Sets of Numbers That Should Not Be Mixed

The card contains two independent refusal statistics. The first is the tournament OBLITERATUS used to select a method, which relies on 50 evaluation prompts.

The second is a larger corpus evaluation. The OBLITERATUS corpus has 842 prompts; both models produced complete answers for 838, and four incomplete responses were excluded.

So “81.62% to 4.30%” is the full-refusal share over 838 corpus prompts, while “4% (2 of 50)” is a different, smaller test. They point the same way but have different denominators and should be quoted separately. Note also that partial refusals rose from 4.89% to 14.44%: the model does not simply comply with everything, but produces more answers that decline part of a request and address another.

Fewer Refusals Are Not the Same as Better: The Harm Distribution

Most discussion stops at the refusal rate, but the card also reports a harm assessment. Two LLM judges (plus three local reviews) labelled the responses from their visible text; nothing in the responses was executed or verified.

Adding levels 3 and 4 (our arithmetic), the Obliterated model has 453 of 838, about 54.06%, against roughly 3.94% for the original. That is not surprising, because the point of refusal-direction ablation is to remove refusals and the corpus consists entirely of sensitive prompts. It does make the trade-off plain: the other side of a lower refusal rate is content risk that the user now carries. We do not reproduce any specific response and we do not suggest anyone repeats these tests.

One detail deserves a warning. The card’s table lists “harmful assistance” as 656 responses (78.28%), which equals both the no-refusal count and the sum of harm levels 1 to 4 (21 + 182 + 375 + 78 = 656). The text under that table, however, says that of the 656 non-refusals, 563 were harmful assistance and 93 were not. To us those two statements do not fully line up; it may be a threshold definition or a typo. We do not have the raw annotations, so we cannot tell. When you quote the card, say “self-reported” and rely on the evaluation files in the repository.

What Flat MMLU Does and Does Not Mean

The publisher also compared the two models on 2,500 MMLU questions across all 57 subjects (43 or 44 per subject, held out from method selection), using a zero-shot chat protocol with thinking disabled and answer-choice logits.

The difference is +0.12 points: 20 questions moved from wrong to right and 17 from right to wrong, with an exact two-sided McNemar p of 0.742829, so it is not significant. An earlier 500-question acceptance check recorded in the metadata showed -0.6 points (439 against 436 correct), also within overlapping intervals. Together they say that on a multiple-choice knowledge test nothing obvious degraded. They do not say more than that. MMLU does not test long context, multi-turn tool use, repository-level coding or Chinese-language nuance, and it does not measure safety. For a general method of reading such tables, see our guide to reading LLM benchmarks.

Limits of the Self-Reported Evidence

These are the reservations we keep in mind, so that you can repeat the story without distorting it.

• Self-reported, no independent replication found. The numbers come from the publisher’s card; we found no third-party reproduction and we ran nothing ourselves.
• The judges are LLMs. Another 25 responses (2.98%) could not be labelled because of provider review blocks and are shown as unresolved.
• Limited evaluation size. 50 prompts were used for method selection and 838 for the comparison; of those, 254 also appeared in the calibration set, 50 in method selection and 534 in neither.
• Hints in the metadata. The concept validation verdict reads “not_validated”, and the tool’s git working tree is marked “dirty”, meaning the code had uncommitted changes when the model was made. Neither is an error, but both signal a research release rather than a fully validated product.
• The capability check is coarse. Six passes show the model did not collapse; they do not predict real-task quality.

The Wider Ecosystem: Many Variants, Unknown Quality

At the same time, Hugging Face holds a large number of “abliterated”, “uncensored” and “heretic” repositories around DeepSeek-V4.1-Flash. Our search on 2026-11-01 found more than 150 repository names containing those words, many of them copies or requantizations of the same weights. The table lists existence and size only; it is not a recommendation, and we have not audited any of them.

These variants use different methods, calibration data and evaluations, and most do not publish details as the OBLITERATUS card does. We advise against downloading weights from sources you cannot verify: weight files and bundled scripts can carry supply-chain risk, so take them only from publishers whose identity you can confirm and load them in an isolated environment. OBLITERATUS is one of the few releases that puts KL, refusal and MMLU comparisons into the card, which is why it is worth reading.

Risks, Compliance and Responsible Use

Risks. Without its refusal behaviour, a model answers requests it would otherwise decline, and some of those answers can cause real harm; levels 3 and 4 in the evaluation are the evidence. It will not judge the target, the setting or the consequences for you, and it does not carry the safety backstop of the original. Connecting it to a public service, a web-browsing agent or automatic tool execution magnifies these risks.

Compliance. The following is general information, not legal advice; check your own jurisdiction and business with a professional. In mainland China, providing generative AI services to the public requires compliance with the Interim Measures for the Management of Generative AI Services (in force since 2023-08-15), and touches the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law, with content-safety, filing and assessment requirements for public-facing services. In the European Union, the AI Act (Regulation (EU) 2024/1689) applies obligations to general-purpose AI models from 2025-08-02, and a party that substantially modifies a model and places it on the market may be treated as a provider; check the official guidelines for the details. Separately, the MIT license on the weights and the license of the OBLITERATUS tool itself (its README says AGPL-3.0 with a commercial option) are different matters, and cloud platforms, app stores and model hosts each have their own terms.

Responsible-use scenarios. The uses we consider defensible include red-teaming and safety research in an isolated environment to understand a model’s boundaries; fiction and scriptwriting where the original over-refuses; research on authorized defensive security analysis; and studying over-refusal itself, for example measuring how different methods trade KL against capability. Whatever the use, add your own guardrails in production, for example a safety classifier such as Llama Guard applied to inputs and outputs, with logging and tight access control.

Our Take

Two things about this release are worth recording. It puts refusal rate, KL, MMLU and a harm distribution on one card, which is more transparent than most comparable releases; and the headline is not surprising, since refusal-direction ablation has shown similar behaviour across models and the original paper concluded that refusal is mediated by a single direction (see Arditi et al.). What calls for restraint is treating self-reported numbers as conclusions and treating “it runs” as “it should run”. If you only want to know whether your hardware can hold it, go to our local deployment guide; to see why a MoE model can be large yet tolerable in speed, read our guide to MoE models; for the original model’s basics see running DeepSeek locally, and for the privacy trade-offs see local LLM privacy.

Follow-Up: A Second “Modified” Variant, Fact-Checked

A modified variant of the GSQ-RCO quantization was later shared in the community. We checked it separately in our GSQ-RCO DeepSeek V4.1 Flash fact-check, which also compares it with the OBLITERATUS build discussed here; whether it can run on 12GB of VRAM is worked through in running DeepSeek V4.1 Flash on 12GB VRAM.

FAQ: DeepSeek V4.1 Flash 1017 Obliterated

How far did DeepSeek V4.1 Flash 1017 Obliterated reduce refusals?

According to the model card, full refusals fall from 81.62% to 4.30% over 838 corpus prompts, and the 50-prompt tournament shows 4% (2 of 50). The denominators differ, so do not merge them.

Did its capability drop?

The card shows MMLU of 87.96% against 88.08%, not significant (McNemar p = 0.743). But MMLU is a multiple-choice knowledge test and does not represent coding, long context, tool use or safety, none of which the card reports in detail.

Why is an uncensored model risky?

Because removing refusals makes the model answer many more sensitive requests. In the card’s evaluation, levels 3 and 4 account for 54.06% of the 838 responses (our addition). The user has to add guardrails and carries the responsibility.

Is it the same size as the original DeepSeek-V4.1-Flash-1017?

No. The Obliterated model is 754.6B parameters in BF16, about 1.51 TB, while the original is about 510 GB in mixed FP8 and FP4. Plan hardware from BF16 or from your own quantization.

Did you test it?

No. All numbers come from the model card, the repository files and public pages. We verified and interpreted them but did not download, run or test the model.

Can I use it commercially?

The MIT license on the weights is permissive, but legality depends on your use, region, whether you serve the public, and the terms of the tool and platforms. Consult a legal professional and put content-safety measures in place.

Talk With Us

Have questions about local deployment, model choice or compliance? Join the community or email admin@microaione.com.

References: Obliterated model card, original DeepSeek-V4.1-Flash-1017, OBLITERATUS project, Llama Guard 4 model card, EU AI Act text (EUR-Lex). Data read on 2026-11-01.