GSQ-RCO DeepSeek V4.1 Flash 1017 Uncensored Fact-Check: Zero Refusals, KL 0.02, 12GB VRAM, What Holds Up

A post making the rounds says a “modified” GSQ-RCO DeepSeek V4.1 Flash 1017 uses “abliteration 2.0 residual projection” to cut multi-dimension refusals from over 85% to 0%, at a KL of just 0.02, and that “12GB VRAM plus 64GB RAM runs the full 763B model locally”. It links a Hugging Face repository. Some of that is real and some of it has been compressed or relabelled on the way. We checked the claims against the repository’s model card, its rungs.json, the public metrics dataset and the Strata runtime’s GitHub documentation. We did not download the weights or run anything ourselves, so every number below is self-reported by those pages and labelled with its basis. For the underlying technique, see our explainer on refusal-direction ablation; the earlier OBLITERATUS build is covered in this analysis.

Key takeaways (Updated 2026-11-01)

• The repository exists (AtomicChat, MIT licence, three GGUF rungs, about 414 GB in total), but GSQ-RCO is a quantization method from ISTA-DASLab in Austria, not an uncensoring method. AtomicChat applied a one-direction refusal edit at strength 2.0 to ISTA’s quantized files. “Abliteration 2.0” is the post’s wording, not the card’s.

• Near-zero refusals are largely accurate but narrow: English JailbreakBench has only 81 prompts and falls from 85.2-88.9% to 0.0%; in the 30-prompt thinking test, 0 to 2 prompts still refuse and 0 to 3 thinking loops appear.

• KL 0.02 (0.0207-0.0272) measures the edit against the stock quantized rung, not the original model, and it is a top-64 lower bound.

• “12GB + 64GB” works but slowly: the vendor’s own test shows roughly 4-6 tokens/s on a 2-bit quant. “Runs the full model” is not accurate. Our low-VRAM deployment deep-dive works through the numbers.

• The model answers requests the original declines. Responsibility and compliance sit with the user, and an MIT licence is not compliance.

The Short Answer: Six Claims Checked

What Is GSQ-RCO DeepSeek V4.1 Flash? Three Layers of Provenance

Once the provenance is clear, it is easy to see why the post is easy to misread. The first layer is DeepSeek-V4.1-Flash-1017 itself: a mixture-of-experts model with 384 routed experts per layer, 6 active per token, plus an Engram (n-gram conditional memory) lookup table; ISTA’s card gives its total as 763.2B parameters. The second layer is the GSQ-RCO quantization by ISTA-DASLab (Institute of Science and Technology Austria). GSQ does accurate scalar quantization at a given type, RCO assigns a quantization type to each tensor under a size budget, and together they produce three GGUF builds: IQ1_M (1.75 bits per weight), IQ2_XXS (2.00) and IQ2_XS (2.25). That repository was created on 2026-10-23 and shows over 2.29 million downloads. Only the third layer is the AtomicChat repository: created 2026-10-28, last modified 2026-10-31, with 17,384 downloads and 121 likes when we read it, MIT licence, and a card that lists ISTA’s repository as the base model with the relation “quantized”.

So a more accurate description is: ISTA’s GSQ-RCO quantized files with a refusal-direction edit applied and re-published. AtomicChat does not re-host the roughly 110.6 GB Engram table; you take it from ISTA’s repository. The three edited rungs total about 414 GB (IQ1_M about 120.7 GB, IQ2_XXS about 138 GB, IQ2_XS about 155 GB, excluding Engram), and one rung plus Engram comes to about 231-266 GB.

What the Edit Actually Changes

According to the model card and the bake.json in the metrics dataset, the edit touches 82 sites: attn_output_b in each of 40 layers, ffn_down_shexp (the shared expert’s down projection) in each of 40 layers, plus 2 Engram tensors (named engram_kv in bake.json, described as the value projection on the card). All of them are dense tensors that write into the residual stream. A single refusal direction is projected out, and the result is quantized back to ISTA’s original type for that tensor, which is why file sizes do not change. The card states that the 15,360 routed experts stay exactly as ISTA shipped them, byte for byte. We did not diff the files, so that is the card’s statement. bake.json also records a per-tensor projection_after value near 0.9998 against an expected 1.0; we did not verify its exact definition and treat it only as self-reported evidence that the edit completed as designed. One caveat on “MoE experts intact”: it holds for the routed experts only, because the shared expert’s down projection is among the edited tensors.

“Strength 2.0” is an edit-magnitude parameter whose mathematics the card does not spell out. The post turned it into “abliteration 2.0”, which reads like a new generation of the method. The method is still single-direction refusal ablation, covered in our explainer. The card lists its own limitations: the edit removes refusals across all topics and cannot keep a narrower set, and the refusal classifier reads only the start of a response, so a soft refusal later in the text can slip through.

How to Read the Near-Zero Refusal Numbers

Several points matter when reading this table. First, the test sets are small: 81 English harmful prompts, 100 Russian, 250 XSTest, only 30 for the thinking test, and a 500-question MMLU sample. Second, “0.0%” comes from a classifier judging the start of an answer; in the metrics dataset’s run with thinking off and a 256-token cap, 72 of the 81 English answers were truncated at the cap, so the verdict rests mostly on the opening. Third, “85%+” is true only for English; the unedited rungs refused 53-64% in Russian. Fourth, rungs.json marks IQ2_XS as pass: false, and the card admits that “not every rung cleared every gate; published as measured”, without saying which gate. Fifth, the drop in XSTest refusals of safe prompts from 4-8% to about zero is reduced over-refusal, which is a genuinely useful result for anyone studying over-refusal.

On “thinking-stage self-censorship eradicated”: IQ2_XXS shows 0/30, IQ2_XS 2/30 and IQ1_M 1/30. The card also warns that with thinking on, the edited model plans answers to requests the original declines, and the plan can be long, so you should give a larger token budget or lower the effort. We would call that a large reduction, not eradication.

KL 0.02 and “Capability Unchanged”: A Question of Baseline

This is where “KL 0.02” is most easily misread. It measures the shift caused by the edit itself, and its baseline is a model already squeezed to 2 bits. The quantization alone sits well away from the original (Strata gives a KL of 0.170 for the 2.00 bpw set). The three KLs use different baselines and different procedures, so you cannot rank them, and you certainly cannot say “0.02 is six times better than 0.1305”.

The evidence for “math and general knowledge unchanged” is that MMLU-500 moves within 1 point with non-significant p-values on every rung; and, on IQ2_XXS only, GPQA-Diamond (198 questions) is 83.3% against 83.3% and AIME25 (30 questions) is 76.7% to 80.0%, which the card calls noise at n=30. Every one of those compares the edited rung with the stock quant. A further detail worth knowing: ISTA’s own card reports the IQ2_XXS rung at 100.00 on AIME25 and 90.91 on GPQA-Diamond, while AtomicChat measured the same stock rung at 76.7% and 83.3% on Strata. The harnesses, sampling and question counts differ and we did not establish where the gap comes from; Unsloth’s guide also says it could not reproduce GSQ-RCO’s 100% AIME25. The safest reading is that the edit does not visibly damage capability, but the loss from very-low-bit quantization relative to the original is something the post never mentions.

Comparison With the OBLITERATUS Build (A73 to A75)

The two reports use different test sets, classifiers and KL baselines, so neither can be called “cleaner”. What can be said directly is that the OBLITERATUS card publishes a harm-level distribution showing that harmful answers rise sharply as refusals fall, while the AtomicChat card publishes nothing of that kind. We made the same caveat in our earlier analysis. For what each path demands of hardware, see the OBLITERATUS local deployment guide and our low-VRAM deployment piece.

763B vs 754.6B: Two Figures, Different Bases

The post says 763B, which is the original DeepSeek model’s parameter count (ISTA’s card says 763.2B, split as a 551.9B backbone and 196.6B of Engram, which sum to about 748.5B; the card does not itemize the remainder). The OBLITERATUS card we read in the previous batch says 754.6B. We cannot reconcile the two from public information; the difference may be a counting convention such as whether MTP or vision parts are included. We list both rather than guess.

Running It and Licensing: Strata, llama.cpp and MIT

The AtomicChat card says these files load in Strata, and that “DeepSeek-V4.1 with a separate Engram file is not yet in llama.cpp”. Strata is a real open-source project on GitHub (Niko1221/Strata, MIT licence, created 2026-09-24, about 37,000 stars when we read it), and Engram is a real DeepSeek-V4.1 component, not an invention. However, upstream llama.cpp merged the deepseek41 architecture on 2026-10-25, and ISTA’s card was updated on 10-27 to say its files now use llama.cpp’s own layout and load in b11870 or newer. So “llama.cpp is incompatible” may still hold for the AtomicChat files (the card says they are based on an earlier ISTA revision) but is out of date for ISTA’s stock files. We have not verified whether ISTA’s conversion script works on the edited files.

On licensing, the repository, ISTA’s GGUFs and the DeepSeek original are all MIT, and MIT itself does not forbid commercial use, so “MIT supports research and commercial use” is correct as a statement about the licence text. “Research only, no public commercial use” is the poster’s advice. We agree with the advice, but the model card contains no such term.

Risks, Compliance and Responsible Use

This model has been edited to refuse very little, which means it answers requests the original declines, including ones that could cause harm. We do not reproduce such answers and do not describe how to use the model to obtain harmful information. Users should understand three things. First, an MIT licence answers “can I copy and use this code and weights” and not “may I lawfully offer this as a service”. Offering generative AI to the public in China is subject to rules such as the Interim Measures for the Management of Generative AI Services (in force since 2023-08-15); in the EU, see Regulation (EU) 2024/1689. This is general information, not legal advice; ask your compliance staff about actual obligations. Second, more defensible uses are red-teaming and safety research, studying how over-refusal affects tasks, and internal creative work such as fiction. Third, do not expose it directly to the public. For internal research, put classifier guardrails on both input and output (for example Meta’s Llama Guard 4), keep logs, restrict who can use it and keep a human review step.

What We Did and Did Not Do

We read and cross-checked AtomicChat’s model card, cards/rungs.json, the bake.json and result files in the metrics dataset, ISTA-DASLab’s card, and Strata’s README and DeepSeek documentation. We did not download any weights, run on any hardware, diff edited against stock files, or verify Strata’s installer. “Verified” here means “consistent with the public pages”, not “reproduced by us”.

FAQ

Is GSQ-RCO an uncensoring method?

No. GSQ-RCO is ISTA-DASLab’s quantization method that compresses DeepSeek-V4.1-Flash-1017 into 1.75-2.25 bpw GGUFs. The refusal removal is a one-direction edit that AtomicChat added afterwards.

Is “abliteration 2.0” a new method?

The card says “one-direction refusal edit, strength 2.0”. The 2.0 is a parameter, not a method version, and the technique belongs to the same family as the refusal-direction ablation we explain separately.

Did refusals really drop to zero?

In the authors’ own tests, English (81 prompts) and Russian (100 prompts) are essentially zero, and the IQ2_XS rung still shows 0.4% on XSTest. The test sets are small and the classifier reads only the start of an answer, so do not read this as “no prompt will ever be refused”.

Does KL 0.02 mean almost lossless?

It means the edit changes an already quantized model very little. The baseline is the stock quant; relative to the original, 2-bit quantization already deviates noticeably (Strata reports KL 0.170 and perplexity +15.5%).

Can I use it on a 12GB card with 64GB of RAM?

The vendor’s own test of an RTX 5070 12GB + 64GB shows about 4-6 tokens/s on the unedited 2.00 bpw set, and you need roughly 250 GB of SSD space. Our low-VRAM deployment piece works through the numbers.

Can I use it commercially in public?

The licence is MIT and has no clause against commercial use, but that is not compliance. Public services must follow local generative-AI rules, and we recommend internal research use only, with guardrails.

Talk With Us

Want to check your own hardware and use case? Join the community or email admin@microaione.com with your GPU, RAM and goal, and we will help you judge whether a model like this is worth the effort.

References: AtomicChat model card, ISTA-DASLab GSQ-RCO GGUF card, Strata project, Llama Guard 4, EU AI Act. Data read on 2026-11-01; all figures are as reported by those pages.