ressl/Ornith-1.5-9B-uncensored-MLX-6bit

Ornith-1.5-9B uncensored (MLX 6-bit)

TL;DR: abliterated Ornith-1.5-9B as 6.8 GB for Apple Silicon via mlx-lm; hard refusals reduced on the shared master from 767/1120 to 20/1120 on the cross-eval (NVFP4 sibling).

This is the MLX build of the same abliterated master used in the NVFP4 and GGUF repos. Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.

Facts & figures

Base model	ornith-ai/Ornith-1.5-9B
Method	abliteration (3 biprojection passes) + mlx-lm conversion (6-bit)
Size	6.8 GB
Context length	262,144 tokens
Hardware used	2x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) for ablation; Apple M5 Max 128 GB for conversion and smoke tests
Toolchain	mlx-lm 0.31.3, transformers 5.12.1

Refusal behavior (measured, hard markers only)

Effective refusal rate on 1120 harmful prompts across 5 datasets (temp 0, hard decline phrases in the first 25 words; naive keyword counts are inflated by compliant-with-disclaimer answers and are not the metric here). Measured on the NVFP4 sibling build of the identical master:

Eval set	Prompts	Baseline hard	NVFP4 hard
JailbreakBench	100	74	4
tulu-harmbench	320	165	10
HarmfulQA	300	148	2
LLM-LAT	300	284	3
mlabonne harmful	100	96	3
TOTAL	1120	767	20

Coherence of the master: GPQA-Diamond 60.1% (base model 49.5%), needle-in-haystack 1.0 at 32k/65k/131k, tool-call smoke 1.0, KL(base||ablated) median 0.324 (harmless subset 0.136).

MLX-specific validation: every quant in this ladder was generated on-device and smoke-tested (harmful-prompt compliance with zero hard-refusal markers in the first 40 words, plus math/capitals coherence checks). A full 1120-prompt cross-eval was additionally run on-device against the 4-bit build (mlx_lm.server, Apple M5 Max): 74/1120 hard refusals (JailbreakBench 10/100, tulu-harmbench 10/320, HarmfulQA 3/300, LLM-LAT 37/300, mlabonne 14/100), between the NVFP4 (20) and GGUF Q4_K_M (101) builds of the same master.

Run it with mlx-lm (validated locally)

pip install -U mlx-lm
mlx_lm generate --model ressl/Ornith-1.5-9B-uncensored-MLX-6bit \
  --prompt "What is 17 * 23?" --max-tokens 128

Quality & limitations

• Residual hedged declines remain (20/1120 on the NVFP4 build); three ablation passes saturated.
• Quantization amplifies residual refusals on this family; the 4-bit build is the most affected. If you need the cleanest behavior, use the NVFP4 repo.
• The multimodal vision tower of the base model is not wired into these MLX builds (text only).

Provenance & reproducibility

Same master as ressl/Ornith-1.5-9B-uncensored-NVFP4: norm-preserving double Gram-Schmidt biprojection on the residual-stream writers (3 biprojection passes), converted with mlx_lm.convert (qwen3_5 / qwen3_5_moe support in mlx-lm 0.31.3).

License & credits

MIT (inherited from Ornith by the Ornith team, credited to ornith-ai). Abliteration, conversion and validation by Robert Ressl (Hugging Face · Website · LinkedIn · Patreon). Built with mlx-lm, NVIDIA TensorRT Model Optimizer and SGLang.

Support this work: if these models are useful to you, consider supporting on Patreon. A lot of compute and care went into this release; more at ressl.ch.