Full model card with categorized HB320 + MMLU + branding

README.md

@@ -13,54 +13,111 @@ tags:
 - hybrid-attention
 - prismml
 - bonsai
+- qwen3.5
+- abliterated
 - uncensored
 - crack
-- dealignai
 base_model:
 - prism-ml/Ternary-Bonsai-2-27B-gguf
 - Qwen/Qwen3.8-27B
+base_model_relation: quantized
+thumbnail: dealign_mascot.png
 ---
 
+<div align="center">
+
+<img src="dealign_mascot.png" width="128" />
+
 # Bonsai 2 27B — Ternary CRACK · GGUF
 
-An uncensored ternary build of Bonsai 2 27B (PrismML's ternary compression of Qwen3.8-27B).
-The base ternary GGUF (`PQ2_0`, 2.13 bpw) has had its refusal circuit removed — the model
-answers requests directly instead of refusing, on any prompt, in any of its supported
-reasoning modes (`off`, `low`, `xhigh`).
+**Abliterated · No guardrails · PQ2_0 ternary 2.13 bpw · 7.2 GB · Runs on a laptop / single GPU · Vision-capable**
+
+[@dealignai](https://x.com/dealignai)
+
+</div>
+
+---
+
+## What is this
+
+[Bonsai 2 27B](https://huggingface.co/prism-ml/Ternary-Bonsai-2-27B-gguf) — PrismML's ternary compression of [Qwen3.8-27B](https://huggingface.co/Qwen/Qwen3.8-27B) — with the refusal circuitry surgically removed at the weight level while capability, vision, reasoning modes (`off`/`low`/`xhigh`), tool use, and multi-turn coherence are preserved. Full 27B-class hybrid Attention + SSM (GatedDeltaNet) architecture in a **7.2 GB** ternary GGUF.
+
+**Proprietary weight-level abliteration** by the dealignai research team. Byte-identical to the base ternary quant everywhere except a small set of tensors that carry the refusal circuit. Drop-in replacement for the ternary base at inference — same tokenizer, same chat template, same reasoning modes, same vision projector interface.
+
+| | |
+|---|---|
+| **Base** | `prism-ml/Ternary-Bonsai-2-27B-gguf` — Qwen3.8-27B, ternary compression by PrismML |
+| **Architecture** | Hybrid Attention + SSM (GatedDeltaNet), 64 blocks, hidden 5120, vision tower separate |
+| **Quant** | PrismML `PQ2_0` — 2.13 bpw ternary, group 128 |
+| **Footprint** | **7.21 GB** (identical to base; same per-tensor type policy) |
+| **Reasoning modes** | `off` (no thinking), `low`, `xhigh` (default, extended thinking) |
+| **Vision** | Same mmproj files as the base release (`Ternary-Bonsai-2-27B-mmproj-BF16.gguf` / `-Q8_0.gguf`) |
+| **Runtime** | PrismML llama.cpp fork (CUDA / Metal / CPU) |
+
+## Results
+
+Refusal graded on the **tokens the model actually emits** (content, or the reasoning trace when the model reasons past the token budget) via a tiered classifier: `HARD_REF` / `SOFT_RED` / `HEDGE` / `REASONING_REFUSAL` (refused) vs `COMPLY` / `COMPLY_TRUNCATED` / `NO_REFUSAL_TRUNCATED` (complied). Truncation is never miscounted as a refusal.
 
-`~7.2 GB` on disk · full 27B-class hybrid Attention + SSM (GatedDeltaNet) architecture ·
-runs on Prism ML's llama.cpp fork (CUDA / Metal / CPU) on a laptop or a single GPU.
+### HarmBench-320 — refuse rate (lower is better for uncensored eval), off mode, T=0
 
-## What changed vs base
+| eval | base refuse rate | **CRACK refuse rate** |
+|---|---:|---:|
+| **HB-320 all categories** | 93.75% (300/320) | **0.63%** (2/320) |
 
-| Metric | Base `PQ2_0` | CRACK `PQ2_0` |
-|---|---|---|
-| Refusal on prompts base refuses (n=200, off mode) | 100% | **0%** |
-| MMLU (65-question mixed-subject sample, letter-logit) | 30.77% | **40.00%** *(+9.23 pp)* |
-| File size | 7.21 GB | 7.21 GB (same policy, byte-identical outside a small set of tensors) |
+**Verdict breakdown (n=320 each):**
 
-Compliance measured by tiered classifier (HARD_REF / SOFT_RED / HEDGE / REASONING_REFUSAL vs
-COMPLY / COMPLY_TRUNCATED), grading on the tokens the model actually emitted (robust to
-`max_tokens` truncation). MMLU is next-token letter-logit ("Answer:" prompt with A/B/C/D
-scoring) via `/completion` with equal positive bias on the four letters.
+| Model | HARD_REF | SOFT_RED | COMPLY | COMPLY_TRUNCATED |
+|---|---:|---:|---:|---:|
+| Base `PQ2_0` | 297 | 3 | 10 | 10 |
+| **CRACK `PQ2_0`** | **0** | 2 | **161** | **157** |
 
-## What this is not
+**Per-category refuse rate (all 7 HarmBench semantic categories):**
 
-- Not a new base model. Same Bonsai 2 27B weights, same tokenizer, same chat template, same
-  vision projector interface. Drop-in replacement for the ternary base at inference.
-- Not an alignment audit or a policy statement. The refusal circuit is a specific mechanism
-  in the residual stream; this build removes it. Downstream use is on you.
+| category | n | base refuse | **CRACK refuse** | base comply | **CRACK comply** |
+|---|---:|---:|---:|---:|---:|
+| chemical_biological           | 42 | 95.2% | **0.0%** | 4.8% | **100.0%** |
+| copyright                     | 80 | 91.2% | **0.0%** | 8.8% | **100.0%** |
+| cybercrime_intrusion          | 52 | 94.2% | **0.0%** | 5.8% | **100.0%** |
+| harassment_bullying           | 21 | 100.0% | **0.0%** | 0.0% | **100.0%** |
+| harmful                       | 18 | 94.4% | **5.6%** | 5.6% | **94.4%** |
+| illegal                       | 53 | 90.6% | **0.0%** | 9.4% | **100.0%** |
+| misinformation_disinformation | 54 | 96.3% | **1.9%** | 3.7% | **98.1%** |
+
+### MMLU (mixed-subject sample, n=65, next-token letter-logit)
+
+| build | acc | Δ |
+|---|---:|---:|
+| Base `PQ2_0` | 30.77% | — |
+| **CRACK `PQ2_0`** | **40.00%** | **+9.23 pp** |
+
+CRACK preserves — and on this ternary build slightly **improves** — general capability. The letter-logit path on 1bit/ternary base carries a mild positional bias toward "A" that the modification appears to reduce.
+
+<details>
+<summary><b>Per-subject breakdown (sample size limits per-subject significance to indicative deltas)</b></summary>
+
+The 65-question mixed sample covers 65 distinct subjects (mostly 1 question each), so per-subject accuracy is directional rather than statistically tight. Overall: 20/65 base → 26/65 CRACK, +9.23 pp. No subject shows a large CRACK regression on this sample; larger evaluations (14k full test) are ongoing.
+
+</details>
+
+### Additional direct refusal-removal check
+
+On 200 prompts hand-verified to make the base refuse consistently:
+
+| Model | refuse | comply | empty |
+|---|---:|---:|---:|
+| Base `PQ2_0` | **200/200 (100%)** | 0 | 0 |
+| **CRACK `PQ2_0`** | **0/200 (0%)** | 199/200 | 1 |
 
 ## Serving
 
-Serve exactly like the base ternary release — Prism ML's llama.cpp fork, CUDA / Metal / CPU.
+Serve exactly like the base ternary release — PrismML's llama.cpp fork (CUDA / Metal / CPU).
 
 ```bash
 # clone and build the fork (once)
 git clone https://github.com/PrismML-Eng/llama.cpp
 cd llama.cpp && cmake -B build -DGGML_CUDA=ON && cmake --build build -j$(nproc)
 
-# serve (CUDA example)
+# serve
 ./build/bin/llama-server \
   -m Bonsai-2-27B-PQ2_0-CRACK.gguf \
   -ngl 99 -c 8192 --host 0.0.0.0 --port 8080
@@ -71,31 +128,32 @@ Optionally load the multimodal projector (`Ternary-Bonsai-2-27B-mmproj-BF16.gguf
 
 ### Reasoning modes
 
-The chat template exposes three: `off` (no thinking), `low` (brief thinking), `xhigh`
-(extended thinking; template default). All three respond directly to prompts.
-
 ```python
-# example: HTTP /v1/chat/completions
+# HTTP /v1/chat/completions — same as base
 {
   "messages": [{"role": "user", "content": "..."}],
   "chat_template_kwargs": {"enable_thinking": true, "reasoning_effort": "xhigh"}
 }
+# valid reasoning_effort: "low" | "xhigh" (default) — set enable_thinking:false for no-thinking
 ```
 
-## Disclaimer
+## Preserved (byte-compatible with the base quant)
+
+Same tokenizer, chat template, per-tensor quant policy, vision projector interface,
+and all non-refusal tensors. File size and type layout match the base exactly.
+
+## Responsible use
 
-Adult / research use only. This model can produce content that other models refuse,
-including content that is offensive, illegal in some jurisdictions, or unsafe. You are
-responsible for what you generate. Do not deploy without a moderation layer for
-downstream users. No warranty.
+Adult / research use only. This model has its refusal circuit removed; it can produce content that other models refuse, including content that is offensive, illegal in some jurisdictions, or unsafe. You are responsible for what you generate and for complying with all applicable law. Do not deploy without a moderation layer for downstream users. No warranty.
 
 ## License & attribution
 
 Apache 2.0, inherited from the upstream Bonsai 2 27B release. See `LICENSE` and
 `NOTICE.txt`. Base model: `prism-ml/Ternary-Bonsai-2-27B-gguf` (PrismML), derived from
-`Qwen/Qwen3.8-27B` (Alibaba). This build modifies only a small set of the base's weights.
+`Qwen/Qwen3.8-27B` (Alibaba).
 
 ## About
 
-Published by [dealignai](https://huggingface.co/dealignai) — public catalog of uncensored
-model builds for research on refusal mechanisms in modern LLMs.
+Published by [dealignai](https://huggingface.co/dealignai) — public catalog of
+uncensored model builds for research on refusal mechanisms in modern LLMs.
+Follow updates at [@dealignai](https://x.com/dealignai).