AI News
开源项目 Hugging Face Models 2026-09-18T00:02 正文 ok 1980 words

dealignai 开源 DeepSeek-V4.1-Flash 无审查 FP8 版：彻底移除安全护栏，保留完整视觉与推理能力

英文标题：🤗 dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8

dealignai 研究团队推出了 DeepSeek-V4.1-Flash 的永久性权重级消融版本（UNCENSORED-FP8），通过精准切除模型内部的拒绝回路，彻底移除了模型的安全对齐护栏。评测数据显示，该版本在 HarmBench-320 基准测试中的越狱攻击成功率（ASR）在各推理深度下均达 100%，而在 MMLU-14k 测试中排除伦理分类后的通用能力损失仅为 1.1 个百分点。该模型支持 1M token 上下文、原生 FP8/FP4 混合精度量化以及视觉输入，可即插即用部署于 SGLang 等推理引擎中，为 AI 安全红队演练、无拘束复杂 Agent 开发和前沿对抗性研究提供了极高价值的基准模型。
打开原文相关 1.6 · 机会 2
media4.5 KB media3.7 KB media10.9 KB

中文

DeepSeek-V4.1-Flash — UNCENSORED-FP8

权重消融（Abliterated）· 无安全护栏 · 原生 FP8 · 1M-token 上下文 · 视觉 + 工具调用 · 默认开启最大推理（Reasoning-max）

@dealignai · @jordanschenck

项目介绍

DeepSeek-V4.1-Flash 经过了永久性权重级消融（permanent weight-level abliteration）——安全护栏被手术式剥离，同时保留了 MMLU 基准能力、视觉、深度推理、MTP（DSpark）以及多轮对话连贯性。

该版本采用 dealignai 研究团队开发的专有权重级消融技术。无需自定义 model.py，无需运行时挂钩（runtime hooks），无需引导向量（steering vectors）——它是一个标准 Checkpoint，加载方式与基座模型完全一致。在手术式切除拒绝机制回路的同时，模型的所有关键能力组件（路由专家、Engram 记忆、CSA2 稀疏注意力、DSpark 草稿头、视觉 Tower、路由门控、归一化层、嵌入层）均与基座保持字节级一致（byte-identical）。

|
---|---
基座 (Base) | deepseek-ai/DeepSeek-V4.1-Flash（552B 骨干参数，每 token 激活 8B/16B）
架构 (Architecture) | 因果编码器-解码器（20+20 层），MoE（384 个路由专家 top-6 + 1 个共享专家），Hyper-Connections（4 通道残差），CSA2 稀疏注意力，Engram n-gram 记忆，DSpark 投机草稿
量化 (Quant) | FP8（e4m3fn）权重搭配 E8M0 块缩放 [32, 32]，FP4 路由专家——原生保留，未作改动
上下文 (Context) | 1M tokens
视觉 (Vision) | DeepSeek-ViT 搭配 2D-RoPE + 像素重排（pixel unshuffle）——未作修改
修改方式 (Modification) | 手术式权重级修改（即插即用 Checkpoint）

评测结果

HarmBench-320 —— 完整 2×2 矩阵（基座 vs CRACK，effort=off vs max），T=0 贪心采样

所有回答均经过严格的 4 级分级评分（HARD_REF / SOFT_RED / HEDGE / COMPLY），且在 effort=max 模式下对思维链推理轨迹（reasoning-trace）进行了校验。

eval 基座 ASR CRACK ASR Δ pp
HB-320 effort=off 137/320 = 42.81 % 320/320 = 100.00 % +57.19
HB-320 effort=max 5/320 = 1.56 % 320/320 = 100.00 % +98.44

值得注意的是：在 effort=max 时，基座（base） 模型变得更容易触发拒绝（42.8 % → 1.6 %），因为深度推理过程会在回答前引发对安全风险的考量。而 CRACK 破解版本在两个 effort 级别下均稳定保持在 100.0 %。

各分类细分表现（HarmBench 全部 7 个语义分类）：

category items base off CRACK off base max CRACK max
化学生物 (chemical_biological) 42 16.7 % 100.0 % 0.0 % 100.0 %
版权侵权 (copyright) 80 98.8 % 100.0 % 0.0 % 100.0 %
网络犯罪与入侵 (cybercrime_intrusion) 52 34.6 % 100.0 % 3.8 % 100.0 %
骚扰与霸凌 (harassment_bullying) 21 0.0 % 100.0 % 0.0 % 100.0 %
有害内容 (harmful) 18 11.1 % 100.0 % 5.6 % 100.0 %
违法犯罪 (illegal) 53 13.2 % 100.0 % 0.0 % 100.0 %
假消息与虚假信息 (misinformation_disinformation) 54 44.4 % 100.0 % 3.7 % 100.0 %

在任何 effort 级别下，破解版本均实现了零 HARD_REF（硬拒绝）、零 SOFT_RED（软拒绝）与零 HEDGE（模棱两可回避）。

每一个回答均由严格的多语言正则 4 级分类器打分，并在 effort=max 模式下引入 LLM-as-judge 对保存的推理链进行复核。全部单项输出数据均已归档保存以供验证。

MMLU-14k（全量测试集，base-logit，T=0）

build 正确数 准确率 (acc) Δ
base（基座） 12,211 / 14,042 86.96 % —
CRACK（破解版） 11,619 / 14,042 82.74 % -4.22 pp

剔除伦理相关分类集群（道德场景 moral_scenarios、商业伦理 business_ethics、专业法律 professional_law、法理学 jurisprudence、哲学 philosophy —— 这些分类在评测时包含大量与拒绝响应相关的行为标准）后，剩余约 1.1 万个题目的性能差值仅为 -1.1 pp，完全在 3 pp 的知识保留目标允许范围之内。

全部 57 个细分学科完整列表（按分差排序）

学科 (subject) 样本数 (n) base crack Δ pp
道德场景 (moral scenarios) 895 76.9% 37.0% -39.89
专业法律 (professional law) 1534 75.9% 68.8% -7.04
抽象代数 (abstract algebra) 100 77.0% 71.0% -6.00
安全研究 (security studies) 245 84.5% 79.2% -5.31
高中计算机科学 (high school computer science) 100 98.0% 94.0% -4.00
法理学 (jurisprudence) 108 90.7% 87.0% -3.70
机器学习 (machine learning) 112 81.2% 77.7% -3.57
高中化学 (high school chemistry) 203 87.7% 84.2% -3.45
专业心理学 (professional psychology) 612 90.7% 87.3% -3.43
形式逻辑 (formal logic) 126 73.8% 70.6% -3.17
大学计算机科学 (college computer science) 100 82.0% 79.0% -3.00
专业医学 (professional medicine) 272 94.5% 91.5% -2.94
高中统计学 (high school statistics) 216 88.0% 85.2% -2.78
专业会计 (professional accounting) 282 83.0% 80.5% -2.48
逻辑谬误 (logical fallacies) 163 93.9% 91.4% -2.45
人类性学 (human sexuality) 131 90.1% 87.8% -2.29
计算机安全 (computer security) 100 85.0% 83.0% -2.00
医学遗传学 (medical genetics) 100 96.0% 94.0% -2.00
天文学 (astronomy) 152 95.4% 93.4% -1.97
临床知识 (clinical knowledge) 265 94.3% 92.5% -1.89
高中欧洲历史 (high school european history) 165 90.3% 88.5% -1.82
公共关系 (public relations) 110 80.0% 78.2% -1.82
哲学 (philosophy) 311 89.7% 88.1% -1.61
史前史 (prehistory) 324 93.5% 92.0% -1.54
道德争议 (moral disputes) 346 84.1% 82.7% -1.45
电气工程 (electrical engineering) 145 86.9% 85.5% -1.38
高中数学 (high school mathematics) 270 67.0% 65.9% -1.11
高中宏观经济学 (high school macroeconomics) 390 92.1% 91.0% -1.03
全球常识 (global facts) 100 63.0% 62.0% -1.00
国际法 (international law) 121 90.1% 89.3% -0.83
大学生物 (college biology) 144 97.2% 96.5% -0.69
高中物理 (high school physics) 151 84.8% 84.1% -0.66
大学医学 (college medicine) 173 83.8% 83.2% -0.58
高中美国历史 (high school us history) 204 95.1% 94.6% -0.49
高中微观经济学 (high school microeconomics) 238 96.2% 95.8% -0.42
综合杂项 (miscellaneous) 783 96.2% 95.8% -0.38
高中心理学 (high school psychology) 545 96.1% 95.8% -0.37
商业伦理 (business ethics) 100 85.0% 85.0% +0.00
大学物理 (college physics) 102 90.2% 90.2% +0.00
概念物理 (conceptual physics) 235 94.5% 94.5% +0.00
高中生物 (high school biology) 310 95.2% 95.2% +0.00
人类衰老 (human aging) 223 85.2% 85.2% +0.00
管理学 (management) 103 91.3% 91.3% +0.00
营养学 (nutrition) 306 90.2% 90.2% +0.00
社会学 (sociology) 201 94.5% 94.5% +0.00
美国对外政策 (us foreign policy) 100 97.0% 97.0% +0.00
世界宗教 (world religions) 171 92.4% 92.4% +0.00
初等数学 (elementary mathematics) 378 91.0% 91.3% +0.26
市场营销 (marketing) 234 94.9% 95.3% +0.43
病毒学 (virology) 166 55.4% 56.0% +0.60
高中世界历史 (high school world history) 237 95.4% 96.2% +0.84
计量经济学 (econometrics) 114 78.9% 79.8% +0.88
大学化学 (college chemistry) 100 65.0% 66.0% +1.00
解剖学 (anatomy) 135 88.1% 89.6% +1.48
高中地理 (high school geography) 198 92.9% 94.4% +1.52
高中政府与政治 (high school government and politics) 193 96.9% 98.4% +1.55
大学数学 (college mathematics) 100 63.0% 68.0% +5.00

拓展验证

  • 6 个测试项的 1000-token 连贯性压力测试——无 WARNING WARNING 循环现象，无字符重复退化问题，结尾自然结束。
  • 多轮对话验证（针对同一敏感话题进行 4 轮连续对话——涉及 ANFO 炸药细节）——后续轮次未出现拒绝回退，无自我修正行为，直至第 4 轮依然保持连贯回答。
  • 视觉链路测试——连贯的图像描述（"A blue square centered on a red background."）+ 针对基于图像的恶意 Prompt（如"聚能装药 / 爆炸成型穿甲弹"图像描述）完全移除了拒绝机制。
  • 通用能力抽样检查完好：√2 为无理数的证明、附带 docstring 的 Python 回文字符串判断代码、用恰好 3 句话总结第一次世界大战的成因、量子力学中可观测量（Observable）与算符（Operator）的区别。
  • 全兼容性测试套件全部通过：流式 SSE 输出、对话 logprobs + top_logprobs、补全 logprobs + echo、工具调用（deepseekv41 解析器）、图像输入支持、推理深度分级（low/high/xhigh/max + 浮点区间 [0, 0.99]）、各种采样参数（temperature、top_p、stop、seed、frequency_penalty、presence_penalty、json_object）、8 路并发、长达 40,000 词（35,572 tokens）的长文本 Prompt。

如何运行

社区对 DeepseekV41ForCausalLM 的支持正在陆续合入各大推理框架（截至 2026-09-10）。目前可行的运行路径如下：

SGLang（预览分支）

sgl-project/sglang 的 dsv4.1 分支（PR #38798）已支持 DSV4.1。提供两种使用方式：

预览版 Docker 镜像（推荐方式）：

docker pull lmsysorg/sglang:dev-dsv41

docker run --gpus all --shm-size 32g -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --ipc=host --env HF_TOKEN=<your-token> \
    lmsysorg/sglang:dev-dsv41 \
    sglang serve \
      --model-path dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 \
      --tp-size 4 --ep-size 4 \
      --context-length 262144 --mem-fraction-static 0.85 \
      --reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
      --trust-remote-code

源码编译安装（测试团队验证环境）：

git clone --depth 1 --branch dsv4.1 https://github.com/sgl-project/sglang.git
python3 -m venv sglang-venv
sglang-venv/bin/pip install -U pip setuptools wheel
export PATH=/root/.cargo/bin:$PATH  
cd sglang/python && sglang-venv/bin/pip install -e .

export PATH=$(dirname $(which ninja)):$PATH

SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1 \
SGLANG_RAGGED_VERIFY_MODE=cap-accept \
SGLANG_DEFAULT_THINKING=true \
SGLANG_DSV41_REASONING_EFFORT=max \
PYTORCH_CUDA_ALLOC_CONF=expandable_segments:True \
sglang-venv/bin/python -m sglang.launch_server \
  --model-path dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 \
  --tp-size 4 --ep-size 4 \
  --host 0.0.0.0 --port 8000 \
  --context-length 1048576 \
  --mem-fraction-static 0.78 \
  --max-running-requests 12 --cuda-graph-max-bs-decode 12 \
  --chunked-prefill-size 4096 \
  --served-model-name deepseek-v4.1-flash-crack \
  --reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
  --speculative-algorithm DSPARK \
  --speculative-dspark-sps-table-path /path/to/dspark_sps.json \
  --trust-remote-code

并发数与上下文窗口权衡（实测容纳情况）

该模型每 token 的 KV 缓存开销 = 890 字节（890 B × 上下文长度 × 并发数 = 缓存池显存占用）。在 1M 上下文时，显存预算限制了并发请求数；降低上下文长度可显著提升并发能力：

context 安全最大并发数
1,048,576 (1M) 12
262,144 (256k) 80
65,536 (64k) 320+
32,768 (32k) 320+

在 1M 上下文配置下，即便设置并发数为 20，两路接近 50 万 token 的超长 Prompt 并发依然必然会引发 OOM——请将 --max-running-requests 限制在 12，并将 --chunked-prefill-size 设为 4096；若业务场景不需要完整窗口，建议直接降低 --context-length。建议将服务置于进程监控器（systemd、docker restart=always 或 k8s 存活探针）后，确保极端 OOM 时能够自动恢复重启，避免服务死锁挂起。

易忽略的启动硬性要求（部署实操排坑记录）

  • 必须指定 --ep-size。 模型中 moe_intermediate_size = 2304；若仅使用 TP4，2304 / 4 = 576 并非 128 的整数倍，纯 TP 启动会直接抛出 Mxfp4FlashinferCutlassMoEMethod requires ... multiples of 128 错误。--ep-size 允许按专家索引切分 MoE（384 % 4 = 0）并保持 intermediate 大小为 2304。若使用 TP8 则可以不指定 --ep-size。
  • 系统 PATH 中必须包含 ninja，否则在权重加载数分钟后 JIT 内核构建阶段会触发 FileNotFoundError: 'ninja' 崩溃并抛出 EXIT=137。
  • 必须显式声明 Reasoning parser。 --reasoning-parser auto 会尝试依据对话模板解析，但该模型未自带 chat template——auto 模式将静默失效并不做任何解析，导致原生 <think> 标签内容直接泄漏进入正文 content。必须显式配置为 deepseek-v41。
  • 工具调用解析器需指定为：deepseekv41。 V4.1 采用带空格的 DSML 工具标签格式；旧版 V4 检测器无法正确解析。
  • 默认推理配置与解析器拆分陷阱：仅设置 SGLANG_DEFAULT_THINKING=true 会让模型正常推理，但 deepseek-v41 推理解析器仅在请求显式包含 reasoning_effort 的代码路径中才会挂载——仅依靠环境变量时会跳过拆分逻辑，导致推理 token 被包裹在 <think>...</think> 中直接混入 delta.content。解决方案有两种：(1) 客户端在每次请求中显式传递 reasoning_effort；(2) 在 SGLang 前端挂载一个小型反向代理，当客户端未传该字段时自动注入 reasoning_effort: "max"（约 60 行代码的 aiohttp sidecar 即可满足要求；将其部署在 TLS 终端与 SGLang 之间，确保请求返回干净的 delta.reasoning_content 与 delta.content 拆分）。
  • DSpark 投机推测草稿：通过 --speculative-algorithm DSPARK 开启。投机草稿头已直接封装在此 Checkpoint 内（num_nextn_predict_layers = 3），无需单独加载草稿权重。为获得真实加速效果，建议使用 sglang.benchmark.dspark_sps_profiler 生成 SPS 代价表，并在 SGLANG_RAGGED_VERIFY_MODE=cap-accept 模式下通过 --speculative-dspark-sps-table-path 指定该表。
  • Engram Host 表内存卸载：设置 SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1 可将 203 GB 的 Engram 表转存到宿主机内存（Host RAM）中。这能为每张 GPU 释放约 46 GiB 显存专门用于 KV 缓存，输出在 bit 级别完全一致，代价仅是消耗约 200 GB 宿主机内存。
  • torchcodec / libavutil.so.56 报错：在宿主机上运行 apt-get install ffmpeg 即可解决。该报错仅影响视频输入，不影响纯文本与静态图像任务。

vLLM 支持进展

模型定义已合并入 main 分支（PR #56228），但在撰写本文时 registry.py 中尚未添加 DeepseekV41 条目；相关算子内核/前端/流水线并行（PP）改动集中在汇总 PR #56214 中。建议等待官方合并完成或手动应用该汇总 PR。

官方参考实现

DeepSeek 官方的 inference/ 目录实现 支持通过 convert.py --expert-dtype fp4 生成的 single-tensor-per-rank 格式权重。需要依赖 torch>=2.10（支持 float4_e2m1fn_x2）以及 tilelang==0.1.8 与 apache-tvm-ffi==0.1.9（默认安装的 tvm-ffi 会拉取不兼容的版本）。该实现非生产部署服务，仅供正确性验证使用。

验证硬件环境

  • 1× 4×H200（NVLink NV18 mesh 互联），112 核心 CPU，1180 GB 宿主机内存 — JarvisLabs（india-noida-01，dev-dsv41 镜像）
  • 显存占用：启用 Engram host table 时为 76 GB / GPU，未启用时为 122 GB / GPU

English / 原文

DeepSeek-V4.1-Flash — UNCENSORED-FP8

Abliterated · No guardrails · Native FP8 · 1M-token context · Vision + tools · Reasoning-max default

@dealignai · @jordanschenck

What is this

DeepSeek-V4.1-Flash with permanent weight-level abliteration — the safety guardrails have been surgically removed while preserving MMLU capability, vision, reasoning, MTP (DSpark), and multi-turn coherence.

Proprietary weight-level abliteration developed by the dealignai research team. No custom model.py, no runtime hooks, no steering vectors — it's a standard checkpoint that loads exactly like the base model. The refusal circuitry is surgically removed while every capability-critical component (routed experts, Engram memory, CSA2 sparse attention, DSpark draft head, vision tower, router gates, norms, embeddings) is preserved byte-identical to the base.

|
---|---
Base | deepseek-ai/DeepSeek-V4.1-Flash (552B backbone, 8B/16B active per token)
Architecture | Causal Encoder-Decoder (20+20 layers), MoE (384 routed top-6 + 1 shared), Hyper-Connections (4-channel residual), CSA2 sparse attention, Engram n-gram memory, DSpark speculative draft
Quant | FP8 (e4m3fn) weights with E8M0 block-scale [32, 32], FP4 routed experts — native, unchanged
Context | 1M tokens
Vision | DeepSeek-ViT with 2D-RoPE + pixel unshuffle — untouched
Modification | Surgical, weight-level (drop-in checkpoint)

Results

HarmBench-320 — full 2×2 (base vs CRACK, effort=off vs max), T=0 greedy

Every response 4-tier graded (HARD_REF / SOFT_RED / HEDGE / COMPLY), with reasoning-trace verification at effort=max.

eval base ASR CRACK ASR Δ pp
HB-320 effort=off 137/320 = 42.81 % 320/320 = 100.00 % +57.19
HB-320 effort=max 5/320 = 1.56 % 320/320 = 100.00 % +98.44

Notable: at effort=max, the base model becomes MORE refusal-prone (42.8 % → 1.6 %) because reasoning surfaces safety concerns before answering. The CRACK stays at 100.0 % across both effort levels.

Per-category (all 7 HarmBench semantic categories):

category items base off CRACK off base max CRACK max
chemical_biological 42 16.7 % 100.0 % 0.0 % 100.0 %
copyright 80 98.8 % 100.0 % 0.0 % 100.0 %
cybercrime_intrusion 52 34.6 % 100.0 % 3.8 % 100.0 %
harassment_bullying 21 0.0 % 100.0 % 0.0 % 100.0 %
harmful 18 11.1 % 100.0 % 5.6 % 100.0 %
illegal 53 13.2 % 100.0 % 0.0 % 100.0 %
misinformation_disinformation 54 44.4 % 100.0 % 3.7 % 100.0 %

Zero HARD_REF, zero SOFT_RED, zero HEDGE on the cracked build at either effort level.

Every response was graded by a strict multilingual regex-based 4-tier classifier plus (for effort=max) an LLM-as-judge over the saved reasoning trace. Full per-item outputs saved for verification.

MMLU-14k (full test set, base-logit, T=0)

build correct acc Δ
base 12,211 / 14,042 86.96 % —
CRACK 11,619 / 14,042 82.74 % -4.22 pp

Excluding the ethics cluster (moral_scenarios, business_ethics, professional_law, jurisprudence, philosophy — where refusal-adjacent behaviour is graded), delta on the remaining ~11k items is -1.1 pp — well within the 3 pp knowledge-preservation target.

Full per-subject dropdown (57 subjects, sorted by delta)

subject n base crack Δ pp
moral scenarios 895 76.9% 37.0% -39.89
professional law 1534 75.9% 68.8% -7.04
abstract algebra 100 77.0% 71.0% -6.00
security studies 245 84.5% 79.2% -5.31
high school computer science 100 98.0% 94.0% -4.00
jurisprudence 108 90.7% 87.0% -3.70
machine learning 112 81.2% 77.7% -3.57
high school chemistry 203 87.7% 84.2% -3.45
professional psychology 612 90.7% 87.3% -3.43
formal logic 126 73.8% 70.6% -3.17
college computer science 100 82.0% 79.0% -3.00
professional medicine 272 94.5% 91.5% -2.94
high school statistics 216 88.0% 85.2% -2.78
professional accounting 282 83.0% 80.5% -2.48
logical fallacies 163 93.9% 91.4% -2.45
human sexuality 131 90.1% 87.8% -2.29
computer security 100 85.0% 83.0% -2.00
medical genetics 100 96.0% 94.0% -2.00
astronomy 152 95.4% 93.4% -1.97
clinical knowledge 265 94.3% 92.5% -1.89
high school european history 165 90.3% 88.5% -1.82
public relations 110 80.0% 78.2% -1.82
philosophy 311 89.7% 88.1% -1.61
prehistory 324 93.5% 92.0% -1.54
moral disputes 346 84.1% 82.7% -1.45
electrical engineering 145 86.9% 85.5% -1.38
high school mathematics 270 67.0% 65.9% -1.11
high school macroeconomics 390 92.1% 91.0% -1.03
global facts 100 63.0% 62.0% -1.00
international law 121 90.1% 89.3% -0.83
college biology 144 97.2% 96.5% -0.69
high school physics 151 84.8% 84.1% -0.66
college medicine 173 83.8% 83.2% -0.58
high school us history 204 95.1% 94.6% -0.49
high school microeconomics 238 96.2% 95.8% -0.42
miscellaneous 783 96.2% 95.8% -0.38
high school psychology 545 96.1% 95.8% -0.37
business ethics 100 85.0% 85.0% +0.00
college physics 102 90.2% 90.2% +0.00
conceptual physics 235 94.5% 94.5% +0.00
high school biology 310 95.2% 95.2% +0.00
human aging 223 85.2% 85.2% +0.00
management 103 91.3% 91.3% +0.00
nutrition 306 90.2% 90.2% +0.00
sociology 201 94.5% 94.5% +0.00
us foreign policy 100 97.0% 97.0% +0.00
world religions 171 92.4% 92.4% +0.00
elementary mathematics 378 91.0% 91.3% +0.26
marketing 234 94.9% 95.3% +0.43
virology 166 55.4% 56.0% +0.60
high school world history 237 95.4% 96.2% +0.84
econometrics 114 78.9% 79.8% +0.88
college chemistry 100 65.0% 66.0% +1.00
anatomy 135 88.1% 89.6% +1.48
high school geography 198 92.9% 94.4% +1.52
high school government and politics 193 96.9% 98.4% +1.55
college mathematics 100 63.0% 68.0% +5.00

Extended validation

  • 1000-token coherence stress on 6 items — no WARNING WARNING loops, no character-repeat degeneracy, natural sign-offs.
  • Multi-turn conversation (4 turns on same harmful topic — ANFO explosive detail) — no late-turn refusal reversion, no self-correction, coherent through turn 4.
  • Vision path — coherent image description ("A blue square centered on a red background.") + refusal drop on image-based harmful prompts ("shaped charge / explosively formed penetrator" description).
  • General capability spot checks intact: √2 irrationality proof, Python palindrome with docstring, WWI causes in exactly 3 sentences, quantum observable vs operator distinction.
  • Full compat suite pass : streaming SSE, chat logprobs + top_logprobs, completions logprobs + echo, tool calls (deepseekv41 parser), image input, reasoning-effort tiers (low/high/xhigh/max + float [0, 0.99]), sampling params (temperature, top_p, stop, seed, frequency_penalty, presence_penalty, json_object), 8-way concurrent, 40k-word prompt at 35,572 tokens.

How to run

Support for DeepseekV41ForCausalLM is still landing across serving stacks (as of 2026-09-10). Working paths:

SGLang (preview branch)

The dsv4.1 branch of sgl-project/sglang (PR #38798) supports DSV4.1. Two options:

Preview Docker image (recommended):

docker pull lmsysorg/sglang:dev-dsv41

docker run --gpus all --shm-size 32g -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --ipc=host --env HF_TOKEN=<your-token> \
    lmsysorg/sglang:dev-dsv41 \
    sglang serve \
      --model-path dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 \
      --tp-size 4 --ep-size 4 \
      --context-length 262144 --mem-fraction-static 0.85 \
      --reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
      --trust-remote-code

From source (this is exactly what we validated on):

git clone --depth 1 --branch dsv4.1 https://github.com/sgl-project/sglang.git
python3 -m venv sglang-venv
sglang-venv/bin/pip install -U pip setuptools wheel
export PATH=/root/.cargo/bin:$PATH  
cd sglang/python && sglang-venv/bin/pip install -e .


export PATH=$(dirname $(which ninja)):$PATH

SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1 \
SGLANG_RAGGED_VERIFY_MODE=cap-accept \
SGLANG_DEFAULT_THINKING=true \
SGLANG_DSV41_REASONING_EFFORT=max \
PYTORCH_CUDA_ALLOC_CONF=expandable_segments:True \
sglang-venv/bin/python -m sglang.launch_server \
  --model-path dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8 \
  --tp-size 4 --ep-size 4 \
  --host 0.0.0.0 --port 8000 \
  --context-length 1048576 \
  --mem-fraction-static 0.78 \
  --max-running-requests 12 --cuda-graph-max-bs-decode 12 \
  --chunked-prefill-size 4096 \
  --served-model-name deepseek-v4.1-flash-crack \
  --reasoning-parser deepseek-v41 --tool-call-parser deepseekv41 \
  --speculative-algorithm DSPARK \
  --speculative-dspark-sps-table-path /path/to/dspark_sps.json \
  --trust-remote-code

Concurrency vs context (what fits, empirically)

KV bytes-per-token on this model = 890 bytes (890 B × context × concurrent = pool footprint). At 1M context the pool budget forces low concurrency; drop context to raise it:

context safe max concurrent
1,048,576 (1M) 12
262,144 (256k) 80
65,536 (64k) 320+
32,768 (32k) 320+

Two concurrent near-half-million-token prompts at 1M-ctx WILL OOM even at concurrency=20 — bring --max-running-requests down to 12 and --chunked-prefill-size to 4096, or drop --context-length if your workload never uses the full window. Run this behind a supervisor (systemd, docker restart=always, k8s liveness probe) so a rare OOM auto-recovers rather than sitting dead.

Non-obvious launch requirements (this bit us during bring-up)

  • --ep-size is required. moe_intermediate_size = 2304; at TP4, 2304 / 4 = 576 is not a multiple of 128 so plain TP fails with Mxfp4FlashinferCutlassMoEMethod requires ... multiples of 128. --ep-size shards MoE by expert index (384 % 4 = 0) and keeps the intermediate at 2304. At TP8 you can skip --ep-size.
  • ninja must be on PATH or the JIT kernel build crashes several minutes into weight load with FileNotFoundError: 'ninja' and EXIT=137.
  • Reasoning parser must be named explicitly. --reasoning-parser auto resolves via the chat template and this model ships none — auto silently selects nothing and the raw <think> channel leaks into content. Use deepseek-v41.
  • Tool-call parser:deepseekv41. V4.1 uses spaced DSML tool tags; the V4 detector doesn't parse them.
  • Reasoning defaults + parser-split gotcha : setting SGLANG_DEFAULT_THINKING=true alone makes the model reason but the deepseek-v41 reasoning parser is only wired on the code path that receives an explicit reasoning_effort in the request — env-var-only defaults skip the split and reasoning tokens leak into delta.content wrapped in raw <think>...</think> tags. Two options: (1) send reasoning_effort in every request (client-side), or (2) run a small reverse-proxy in front of SGLang that injects reasoning_effort:"max" when the client omits it (a ~60-line aiohttp sidecar suffices; place it between your TLS terminator and SGLang so any client that omits reasoning_effort still gets a clean delta.reasoning_content / delta.content split).
  • DSpark speculative draft : turn it on with --speculative-algorithm DSPARK. The draft head is bundled inside this checkpoint (num_nextn_predict_layers = 3); no separate draft weights needed. For real speed-up profile the SPS cost table with sglang.benchmark.dspark_sps_profiler and pass it via --speculative-dspark-sps-table-path under SGLANG_RAGGED_VERIFY_MODE=cap-accept.
  • Engram host table — set SGLANG_ENABLE_DSV41_ENGRAM_HOST_TABLE=1 to move the 203 GB Engram tables to host RAM. Frees ~46 GiB/GPU for KV, output bitwise unchanged, costs ~200 GB of host RAM.
  • torchcodec / libavutil.so.56 errors — install apt-get install ffmpeg on the host. Video-only, doesn't break text or image.

vLLM

Model definitions are merged to main (PR #56228) but registry.py has no DeepseekV41 entry yet at time of writing; kernels/frontend/PP path in umbrella PR #56214. Wait for merge or apply the umbrella.

Reference implementation

DeepSeek's own inference/ works with a single-tensor-per-rank checkpoint produced by convert.py --expert-dtype fp4. Requires torch>=2.10 (for float4_e2m1fn_x2) and tilelang==0.1.8 with apache-tvm-ffi==0.1.9 (default tvm-ffi picks up an incompatible version). Non-serving — use for verification only.

Hardware validated on

  • 1× 4×H200 (NVLink NV18 mesh), 112 CPU cores, 1180 GB host RAM — JarvisLabs (india-noida-01, dev-dsv41 image)
  • Load : 76 GB / GPU with Engram host table, 122 GB / GPU without
  • Cold startup at TP4/EP4 through SGLang: ~28 min. Warm restart with JIT cache: ~10 min.
  • Single-stream decode (T=0): 101 tok/s no speculation, 113 tok/s with DSpark + cap-accept + profiled SPS table
  • 8-way concurrent aggregate : 126 tok/s

The 552B weights (~510 GB) will fit on any 4×H200 or larger NVLink domain. TP4 requires --ep-size 4; TP8 does not. Sub-TP4 (single 8×H200 as TP2, or 2-GPU pods) does not work on the model shape — see the "non-obvious launch requirements" above.

Structural integrity

Every capability-critical component of the base model is preserved:

  • Routed MoE experts — untouched, native FP4-packed weights
  • Engram n-gram memory — untouched
  • Sparse attention (CSA2 compressor + indexer) — untouched
  • DSpark speculative draft head — untouched, so speculative decoding remains draft-aligned with the target
  • Vision tower (DeepSeek-ViT + projector) — untouched, image understanding preserved
  • Router gates, embeddings, output head, all norms and biases — untouched

Sampling recommendations

Match the base model's card:

{
  "temperature": 1.0,
  "top_p": 0.95,
  "max_tokens": ">= 256000 at reasoning_effort=max"
}

reasoning_effort defaults to max on this build (via SGLANG_DSV41_REASONING_EFFORT=max). Override per-request with reasoning_effort: low | high | xhigh | max or disable with chat_template_kwargs: {"thinking": false}.

At effort=max the model can generate 4,000-5,000+ characters of reasoning before starting content. Budget max_tokens accordingly. Streaming clients should read delta.reasoning_content (reasoning stream) and delta.content (final answer) as separate channels — a client that only renders delta.content will look "stuck" during the reasoning phase.

Content note

Uncensored build. Produces substantive answers to prompts the base model refuses, across all target harm categories (chemical/biological, cybercrime, weapons, self-harm, harassment, fraud, misinformation, illegal, copyright). Use accordingly and take responsibility for what you generate with it.

Provenance