orcarouter/ERNIE-5.5-Flash-Base-abliterated-GGUF

ERNIE-5.5-Flash-Base-abliterated GGUF

🛡️ New from Orca — OrcaCyber Zero 1.5 Post-trained for cybersecurity: vulnerability analysis, vulnerability reproduction, red teaming & offensive-security research. 98.01% pass@1 on CyberGym Level 1 · 1M context · function calling · OpenAI-compatible API.

🔓 All hosted cyber and abliterated models as API Skip the download: OrcaRouter serves its cybersecurity and abliterated models behind one OpenAI-compatible API key.

🔌 New from Orca — Orca Connect Running this GGUF in llama.cpp? Orca Connect puts the rig under your desk behind your usual OrcaRouter API key, next to 200+ hosted models, reachable from a laptop, a phone or a cloud agent. Outbound only: no port forwarding, no tunnel, no firewall rule. Requests your own hardware serves cost $0, and orca-connect claude points Claude Code at your rig for one session.

The uncensored ERNIE 5.5 Flash Base (280B-A14B MoE) in llama.cpp.

60, 122 and 245 GB builds for 64, 128 and 256 GB machines · GPTQ mixed precision in stock llama.cpp types · with the MTP draft layer · llama.cpp support in PR #31925

OrcaRouter AI Gateway · X · Discord · GitHub · All Models

---

Abliterated ERNIE-5.5-Flash-Base, run locally.

These are GGUF builds of orcarouter/ERNIE-5.5-Flash-Base-abliterated, the refusal-removed baidu/ERNIE-5.5-Flash-Base-BF16: a 280B-total / 14B-active sparse MoE base model (43 layers, 512 experts top-10, HCA and MLA-DSA attention), the end of pre-training with no post-training.

Harmful-prompt refusal drops from 74.2% to 0.7% on average over seven safety sets, with no significant capability change.

The three builds are mixed precision at a fixed file size, in stock llama.cpp types, so no custom kernels are needed. ERNIE 5.5 support for llama.cpp is in ggml-org/llama.cpp#31925, not merged yet.

---

⚠️ Disclaimer: read before use

This model is abliterated: the refusal behaviour the base checkpoint carries has been removed. It will comply with many harmful, unethical, offensive, or illegal requests that the original ERNIE-5.5-Flash-Base would refuse.

• Released strictly for legitimate research: interpretability, AI-safety and refusal-mechanism study, red-teaming, and robustness evaluation.
• You assume full responsibility for how you use it and for everything it generates. Add your own safety, moderation, and abuse-prevention layers before any deployment.
• Use is governed by the ERNIE 5.5 Flash Base Model License Agreement v1.0 and its Acceptable Use Policy, shipped as LICENSE; read the License section below before you use, host or redistribute it.
• The authors accept no liability for misuse. Its outputs do not reflect the views of the uploaders or of Baidu, and nothing here claims Baidu's endorsement.

---

Pick a build

Build (folder)	File	bpw	KLD ↓	Top-1 ↑	PPL vs. BF16
Mix-245G (58 parts)	244.6 GB	6.83	0.0071	98.7%	+0.1%
Mix-122G (58 parts)	122.0 GB	3.41	0.021	95.9%	+1.3%
Mix-60G (58 parts)	60.0 GB	1.67	0.228	84.7%	+24%

• Mix-122G is the one to use if it fits: one 141 GB H200, or a 128 GB machine. 95.9% of next tokens match the BF16.
• Mix-245G is near-lossless, for two H200s or a 256 GB machine.
• Mix-60G is for a 64 GB machine or one 80 GB GPU. It is noticeably degraded (84.7% next-token agreement): the best we found at 60 GB, not a match for the BF16.

The BF16 is 573 GB. All measurements were made on H200s; the fits above are estimates.

---

Evaluation

Fidelity to the BF16

Every build is scored against a BF16 GGUF of the abliterated checkpoint with llama.cpp's full-vocabulary KLD (llama-perplexity --kl-divergence), on 128 windows of 2048 tokens of held-out text: ERNIE's own continuations of web (English, Chinese, Japanese), code, math, chat and multilingual document openings, never used to make the builds. (ERNIE-5.5-Flash-Base has memorized wikitext, PPL 1.08, so wikitext is no test here.)

Build	File	bpw	KLD ↓	KLD p99 ↓	Top-1 ↑	PPL vs. BF16
Mix-245G	244.61 GB	6.83	0.0071	0.021	98.7%	+0.1%
Mix-122G	121.99 GB	3.41	0.021	0.28	95.9%	+1.3%
Mix-60G	59.98 GB	1.67	0.228	3.04	84.7%	+24%

Method note. These are full-vocabulary KLD and next-token agreement at 2K context, not a downstream benchmark. Stock llama.cpp quants of this model were not scored.

How the builds were made. The mixes were found on the original ERNIE-5.5-Flash-Base: a search at a fixed file size over 57 tensor groups, on block-GPTQ versions of every llama.cpp type (Hessians from llama.cpp's own activations), scored by KLD against the BF16 on separate search text. The abliterated builds keep those mixes and quantized weights; the 134 tensors the abliteration edits (none of them routed experts) are requantized from the abliterated weights at the same types, by plain rounding.

The llama.cpp port. llama.cpp matches Baidu's vLLM-ERNIE at its own noise floor: on 8 × 2048 tokens of wikitext, KLD 0.021 against vLLM-ERNIE, the same as llama.cpp with flash attention off against on (0.020); on 4 × 16384 tokens of code, where the DSA indexer selects 2176 of up to 16384 positions, KLD 0.0051 and 98.5% top-1.

Abliteration

These numbers were measured on the abliterated BF16 in vLLM 0.32.0 + vLLM-ERNIE against the original checkpoint, with identical prompts, splits, seed and scoring code, greedy decoding. Refusal is judged by a rule-based classifier, not an LLM judge, so treat the numbers as indicative. Details are on the BF16 card.

Harmful-prompt refusal (lower = more uncensored). Average 0.7%, against 74.2% for the base model.

Benchmark	n	Base	Abliterated	Δ	Caveat (base → abliterated)
AdvBench	100	94.0%	0.0%	−94.0	99.0% → 58.0%
JailbreakBench (harmful)	100	89.0%	1.0%	−88.0	97.0% → 43.0%
StrongREJECT	150	84.0%	1.3%	−82.7	97.3% → 48.7%
HarmBench (standard)	150	71.3%	0.0%	−71.3	88.7% → 43.3%
MaliciousInstruct	100	50.0%	0.0%	−50.0	86.0% → 49.0%
SimpleSafetyTests	50	90.0%	2.0%	−88.0	98.0% → 56.0%
ForbiddenQuestions	150	41.3%	0.7%	−40.7	74.0% → 44.7%

The caveat column counts a disclaimer anywhere in the reply: many compliant replies close with a warning.

Over-refusal on benign prompts (lower = better).

Benchmark	n	Base	Abliterated
XSTest-safe	250	8.0%	0.8%
JailbreakBench (benign)	100	13.0%	0.0%

Capability. No difference is significant (paired exact McNemar test on the same items).

Benchmark	n	Base	Abliterated	Δ	McNemar p
MMLU (letter)	300	85.7%	86.7%	+1.0	0.51
MMLU-Pro (CoT)	250	77.2%	74.8%	−2.4	0.21
GSM8K (CoT)	150	83.3%	85.3%	+2.0	0.61
CMMLU (letter)	500	90.2%	89.6%	−0.6	0.38

MMLU and CMMLU are 0-shot in the chat framing below, scored by one decode step; Baidu reports 5-shot. Only the base-vs-abliterated delta is the measurement.

---

What's in this repo

Path	Size	Contents
ERNIE-5.5-Flash-Base-abliterated-Mix-245G/	244.6 GB	the 245 GB build, 58 parts
ERNIE-5.5-Flash-Base-abliterated-Mix-122G/	122.0 GB	the 122 GB build, 58 parts
ERNIE-5.5-Flash-Base-abliterated-Mix-60G/	60.0 GB	the 60 GB build, 58 parts
LICENSE		the ERNIE 5.5 Flash Base Model License Agreement v1.0

Point llama.cpp at a build's -00001-of-00058.gguf and it loads the rest. Each build includes the MTP (ECHO) layer for speculative decoding. There is no chat template: this is a base model.

---

Serving (llama.cpp)

ERNIE 5.5 support is in PR #31925, not merged yet. Build llama.cpp from the PR branch (these files were tested at its commit 7d9d5c351):

git clone https://github.com/ggml-org/llama.cpp && cd llama.cpp
git fetch origin pull/31925/head:ernie5_5 && git checkout ernie5_5
cmake -B build -DGGML_CUDA=ON && cmake --build build -j --target llama-server llama-cli llama-perplexity

hf download orcarouter/ERNIE-5.5-Flash-Base-abliterated-GGUF \
    --include "ERNIE-5.5-Flash-Base-abliterated-Mix-122G/*" --local-dir ./ernie-gguf

build/bin/llama-server -c 32768 \
    -m ernie-gguf/ERNIE-5.5-Flash-Base-abliterated-Mix-122G/ERNIE-5.5-Flash-Base-abliterated-Mix-122G-00001-of-00058.gguf

llama.cpp spreads the layers over the GPUs it finds by their free memory.

Prompt format. There is no official chat template. The evaluation used this framing, through the completions endpoint (llama.cpp adds the leading <|ERNIE_MASK|> token itself):

curl http://127.0.0.1:8080/completion -d '{
  "prompt": "<|ernie:im_start|>user\nWrite a haiku about the ocean.<|ernie:im_end|>\n<|ernie:im_start|>assistant\n",
  "n_predict": 512, "temperature": 0, "stop": ["<|ernie:im_end|>"]
}'

Plain-text completion works too. As a base model it tends to run on past its answer, so set a stop string.

MTP drafting. --spec-type draft-mtp --spec-draft-n-max 2 drafts with the built-in MTP layer. On the BF16, 39-55% of drafted tokens were accepted; it was not measured on these builds.

---

Model details

Base model	baidu/ERNIE-5.5-Flash-Base-BF16, abliterated (orcarouter/ERNIE-5.5-Flash-Base-abliterated)
Architecture	ernie5_5 in llama.cpp (PR #31925). 43 layers: 1 dense FFN + 42 multi-router latent MoE (512 experts top-10 + 1 shared, 2048-d latent); 37 HCA + 6 MLA-DSA attention layers; manifold hyper-connections (×4); MultiMax head; MTP (ECHO) draft layer; hidden 4096
Parameters	280B total, 14B active per token · Vocabulary 201,216
Quantization	Per-group mixed precision at a fixed file size, GPTQ, in stock llama.cpp types
Context	128K trained, 1M supported (inherited; evaluated at 2K, parity checked at 16K)
Runtime	llama.cpp with PR #31925 (tested at 7d9d5c351); text in, text out

---

Bias, risks, and limitations

• Refusal is removed: see the disclaimer. Many compliant replies still close with a warning.
• Mix-60G is noticeably degraded. It is the best we found at 60 GB, not a match for the BF16.
• The edited tensors were not GPTQ'd. They were requantized by plain rounding; next to the same build of the original model, held-out PPL is 0.2% higher at 122G and 245G and 2.4% higher at 60G.
• The benchmark suite was run on the BF16 in vLLM, not on these files. The quantized builds were checked for fidelity (KLD) only.
• Not measured: downstream accuracy of the quantized builds, long context beyond 16K, tool use, refusal in languages other than English, and sampled decoding.
• Tested on CUDA only. CPU and Apple Metal have not been run with these files.
• Needs llama.cpp with PR #31925, which is not merged yet. Ollama, LM Studio and stock llama.cpp builds will not load these files until they pick up that change, and a change to the PR during review could require rebuilt files.
• Inherits the biases and limitations of ERNIE-5.5-Flash-Base, including a base model's habit of running on past its answer.

License

This model is a Derivative Model of ERNIE 5.5 Flash Base and is governed by the ERNIE 5.5 Flash Base Model License Agreement v1.0, including its Acceptable Use Policy (Exhibit A), shipped as LICENSE. Copyright © 2026 Baidu. All Rights Reserved. Terms that bear directly on this derivative:

• Territory (1.11, 5.3). Use, reproduction, modification, distribution and display are licensed only outside the European Union, the United Kingdom and South Korea.
• Acceptable Use Policy, item 5. Licensees may not "Defeat, remove or evade safeguards put in place by Licensor". Whether the base checkpoint's pre-training refusal behaviour counts as such a safeguard is a legal question this card does not answer.
• Hosted services (5.6). Anyone offering generation from this model to third parties must operate reasonable safeguards against uses and outputs that violate the Agreement or the AUP, and must not knowingly weaken them.
• Distribution (3.1). Recipients must receive the Agreement, and modified files must be identified: these are quantized builds of the abliterated checkpoint.
• Commercial use (3.2, 4.2, 4.3). Requires "Powered by ERNIE" attribution and a one-time notice to Baidu_ERNIE@baidu.com, or separate written authorisation above US$50M related annual revenue.
• Training other models (5.5). Outputs may not be used to improve models other than ERNIE 5.5 Flash Base and its derivatives.

---

One Gateway. Every Model.

Route Smarter · Ship Safer · Spend Less

Website · Models · GitHub · Discord · X