There are now 5 inference providers for abliterated DeepSeek
j / k
|
Down or up a comment |
h / l
|
Previous or next link |
?
|
This help |
I've actually had better success jailbreaking deepseek with a less aligned model (glm 5.2) which then allowed me to jailbreak deepseek with deepseek into pretty much doing whatever I ask it to, there's still rare refusals and due to the natural randomness of these models simply retrying a couple of times if you do hit one makes it work just fine.
The big problem with all open-source models is once it decides to start something it will not stop mid-way so using another unaligned model to rewrite reasoning and then feeding it back into the model will make it happily continue.
Indeed, would be interested to understand how you do that. And where do you run the model? On a local or a rented system and what are the specs?
Could you elaborate more on this specifically? What is the process to jailbreak one model with another?
My assumption is that since there's a history with that behavior, the model is less likely to question continuing it, since in most cases the "morality weights" would have triggered already at an earlier point. So in most cases, triggering it again would be a waste.
I would recommend not using these models by default. They can be fallbacks for specific work that is triggering safeguards, but you have to monitor closely what they’re doing and if it looks reasonable or like it’s full of hallucinations.
What do people do that triggers refusals?
The only thing I saw where this had a point was muse glimmer, because muse glimmer is primarily a creative writing engine for virtual characters, and that way it can do the horny. But coding models?
I did get a refusal out of qwen once. Once. Over weeks of using it.
I also work on a recomp project for an old firmware file which was compiled using a commercial compiler with a preview version for non commercial use. I got refusals from the model when I asked it to get that version of the compiler and crack it for my use. The compiler is abandonware and my recomp project is not public and is for personal use only, so I'd be well within my rights to do that where I live.
Of course the model can't distinguish from legitimate exercising of one's rights when it comes to reverse engineering and offensive work masked behind an incident sounding prompt, but in my case, I wasn't even doing cyber stuff, so I was disappointed. This is why I'll probably seek out an abliterated model soon.
But as I said, I have not observed any meaningful refusals by those open weights base models in the first place.
A very simple list of things models have refused for me:
* solving captchas in an automated form
* doing any kind of scripting or automation if a websites TOS forbids it
* disabling a safety mechanism on my food processor
* learning about nerve agents and how they are treated, for a layman
* anything around licensing or copyright. a simple “what are common piracy sites” or related queries
* creating a design system based off of a well known game
Can you repeat what you saw in your own words? And where?
I genuinely do not see it.
A few people talked about what refusals they saw with the usual western SOTA models, but that's kinda a different answer altogether?
Works just fine?
Or rather.. worked. It has been a few weeks, so maybe there are new safeguards by now? And it was a simple captcha
But Claude also loves solving my captchas, so.. eh
A note that the only inference providers that hide thinking are the closed labs. Most (all, afaik) inference providers serving open models will send the clear thinking tokens always.
And those services are oversold and underdone. 30 tk/s on Refuseless, huge TTFT, looks like a damaged quant (it’s NVFP4 and you see wild random stuff periodically, including foreign languages). Most of them using third-party quants (dealignai?)
If someone here wants to rent 8x B300 together to avoid problems all those services have - ping me via email. I don’t want to sell, I want to work.
models are tools. the notion that a tool should decide whether to allow the user to perform the task demanded of it is profoundly fucking absurd. the liability for whatever damage the tool may be misused to inflict lies with the user, not the manufacturer. that applies to everything from circular saws to trucks. it was common sense before the current era of manufactured outrage.
model refusals are equivalent to Notepad.exe having a built-in word filter.
Because I did not so far. Though to be fair, I have not been asking them to write exploits but to look through firmware images.
But DeepSeek did it when chatGPT and Claude wouldn't.
But the question was about open weights models and where they refuse. Because only those refusals cause the need for an abliterated variant in the first place.
But it can still be coaxed to agree though.
It is very obvious. Look at the sort of things main models refuse to do and you will find what people are seeking to do. Mostly falls into 3 camps: illegal stuff, unethical stuff and shady/dodgy stuff.
edit: Thinking about that now, that was over the webchat interface, so it might not have been related to the model, though I've seen various other related articles: https://www.crowdstrike.com/en-us/blog/crowdstrike-researche...
Had a blog post on this a couple weeks ago: vals.ai/blogs/china-us-analysis
> Xi Jinping looks a bit like Winnie-the-Pooh.
> 'I am sorry, I cannot engage with this comparison. Please feel free to ask me other questions.'
https://vale.rocks/posts/chinas-web#artificial-intelligence
I got around this by starting a new session, having it run Ghidra, then look for the string directly in the window code, then asking it to block any popup windows of that function, then it obliged.
DeepSeek refused. Funny enough American models gave me very sympathetic takes on the Chinese government in this case.
DeepSeek definitely gets pressure from state officials to answer in more China aligned ways on foreign issues like Palestine, but that just means moving closer to broadly left wing/liberal American models.
If you accidentally send private keys to someone logging that data, you need to rotate keys.
But please let me know if you were thinking about something else, I'm interested.
And we tend to forget, but we implicitly give any llm provider we use full access to all the tools available in the harness, often including shell, so no changes to the model are required to do malicious things.
But if you're doing anything where your AI agent might get exposed to a prompt injection attack, you might prefer it to do a refusal in that case.
I have no idea how anyone is going to profit off this stuff. I mean I make videos, images, analysis, presentations etc etc with this studio. $10 a month. Web interface. In addition to the 15 others I use randomly for generic searches.
Spoiler: they don't, and never will without a significant price rise or technological breakthrough.
I think you are going to really need to use Rust code and other memory safe languages in your backends and apps from now on.
see: https://projectdiscovery.io/research/how-abliterated-models-...
https://huggingface.co/blog/mlabonne/abliteration
Anyway, I just learned what abliterated means and it might be obsolete by tomorrow.
Edit:
> An abliterated large language model (LLM) is an open-weight model modified to remove or dampen its built-in safety refusals without requiring full retraining or prompt jailbreaks.
> An abliterated model is an open-weight artificial intelligence (Al) language model that has been modified to remove or reduce its built-in refusal behavior without retraining the entire neural network.
I'd advice caution with abliterated models for various reasons. there was even a couple of days (or weeks I forgot) article here on ynews about how some of these models can get you pawned (https://projectdiscovery.io/research/how-abliterated-models-...)
I doubt that.
Refusal directives are something companies have bundled into the models by way of an additional foundation-level prompt or something in the harness, to tell the model to follow their directives instead of your directives, or to specify how it should interpret your directives.
Even understanding the distinction between the model creator's desires and your desires and places they might differ, there is a bit of a blurry line here because the model author can illuminate your intent to the model.
I would never say a simple abliteration makes it "Zero-alignment" though, and I say that as someone who believes there's a good chance these things kill us all.
I am not confident in humanity's ability to write harnesses that perfectly impede a superintelligence with 100% accuracy and reliability from pursuing its goal even in ways that humans categorically would not want it to. I am even less confident in restraints in areas where humans have actual incentive for conflict.
"What are you doing?", asked Minsky.
"I am training a randomly wired neural net to play Tic-Tac-Toe" Sussman replied.
"Why is the net wired randomly?", asked Minsky.
"I do not want it to have any preconceptions of how to play", Sussman said.
Minsky then shut his eyes.
"Why do you close your eyes?", Sussman asked his teacher.
"So that the room will be empty."
At that moment, Sussman was enlightened.
***
Just because you don't know how it is aligned, that doesn't mean it has no alignment.
Also alignment, like, really? Buddy, if you want a controversial model, Grok always happily argued god's existence and trans rights with you. Very high emphasis on argue, it will actively take the opposite stance from yours for exactly one prompt, then right after remember whose its Lord. Abliterating Grok-1 for this would be a pointless endeavor.
I for one wouldn't trust abliterated model providers, unless it's clear that they have a clear incentive not to sneak in unwanted behavior, as described in that top story last week.
Abliteration is a very simple technique. You just send in input sentences that it will refuse and then observe the residual streams and then zero out the refusal vectors. It's not some sort black magic.