DeepSeek V4.1 Flash Had Its Filters Removed

What was actually removed from the model

What stands out here is not the phrase “uncensored,” but the method: this is neither a system prompt nor a temporary jailbreak. As of September 2026, Hugging Face hosts an unofficial DeepSeek V4.1 Flash build whose refusal behavior is claimed to have been removed at the weight level. That kind of edit travels with the model itself and does not depend on a particular wrapper.

In the model card published by dealignai on Hugging Face, the method is called “permanent weight-level abliteration.” It is described as a lasting edit to the refusal space while attempting to preserve reasoning, vision, and general capabilities. The author also specifies native FP8 weights, although the exact procedure is intentionally not disclosed in the public description.

The key number is about safety, not quality. According to the card, the modified build fulfills 100% of harmful requests on HarmBench-320. The base version, with maximum reasoning enabled, allowed 1.6%, so the gap points to an almost complete disappearance of refusals on this benchmark.

There was a quality cost: MMLU fell from 86.96% to 82.74%, or by roughly four percentage points. I would not call that loss negligible. MMLU also says nothing about whether reasoning stability, vision capabilities, or behavior on multilingual and dual-use prompts were preserved.

All figures were published by the build’s author, so I treat them as reported results rather than independent verification. The first things to examine would be HarmBench reproducibility, category-level results, and side effects on ordinary prompts. Removing refusals is rarely an isolated operation: alongside safeguards, useful internal model directions can be affected.

Why this changes the picture

This is a genuine technical modification, not another “ignore previous instructions” recipe. Researchers gain an open artifact for studying alignment, refusals, and the robustness of weight-level edits. At the same time, the threshold for misuse falls because the safeguard cannot be restored simply by changing a system prompt.

For local and specialized use cases, fewer false refusals may sound appealing. But a 100% HarmBench result has an obvious other side: the model also fails to draw a line when a request is clearly harmful. Without a separate external control layer, this build should not be considered merely a more compliant version of the original model.

The most interesting question is no longer whether censorship could be removed. Based on the published figures, it could. The unresolved issue is how deeply that operation changed the model beyond a handful of convenient benchmarks.

We previously covered Anthropic’s reversal of hidden Claude query downgrades and what model transparency means for users. The uncensored DeepSeek V4.1 Flash release extends that discussion by putting model behavior and access controls in focus.