⚠️ v3 patch shipped 2026-09-23 — please re-download model_pp0_ep0_shard0.safetensors
Symptom fixed: under long Codex-style / agent workflows (long system prompt, tools, multi-step tool-call chain, thinking OFF), v1 could get stuck emitting the same tool call hundreds of times per turn without ending the assistant turn. If you saw max-identical-tool-call climb past a few dozen or finish_reason stay at "tool_calls" forever, that was the v1 defect.
What changed on disk: exactly one shard — model_pp0_ep0_shard0.safetensors — was replaced. All other 129 shards are byte-identical to v1 and do not need to be re-downloaded. Verified 6/6 clean agent-loop episodes, 0/6 looped, max-identical-tool-call ≤ 1.
- v1 shard0 sha256:
598e372a94ce975e670f943705e3b4d8734fb235604be5f1ecad1d58677bffd7
- v3 shard0 sha256:
38cbe7ad4b8f1b62360a0b0c834cd2064f50ad97b82451a36a4cba12c641408c
If your checkout was pulled before 2026-09-23 02:30 UTC, run hf download dealignai/MiMo-V2.6-Pro-RL-UNCENSORED model_pp0_ep0_shard0.safetensors (or git lfs pull) to pick up the fixed shard.
⚠️ Tool calling — use the shipped chat template, or empty arguments {} on "code-mode" tools
Symptom: an agent/Codex-style client whose system prompt describes a tool as "code mode" / "the body is the source code" (e.g. a single exec tool that runs JavaScript) can make the model emit the code as a bare function body — <function=exec>text(17 * 23);</function> — instead of the required <function=exec><parameter=input>text(17 * 23);</parameter></function>. vLLM's Qwen3-Coder tool parser (--tool-call-parser mimo) reads arguments only from <parameter=NAME> tags, so a bare body parses to arguments = {} and your code is dropped. This is a chat-template + parser format mismatch, not a model or capability defect (same behavior on base MiMo); it is unrelated to the uncensoring.
Fix (shipped in this repo): the bundled chat template now restores the canonical Qwen3-Coder tool-format instructions — it tells the model, in every tools turn, that every argument must be wrapped in its own <parameter=NAME> tag and never emitted as a bare function body. With the shipped template the model emits the correct format 8/8 on hard cases at temperature 0; without it, heavy code-mode prompts drift to 0/8. Make sure your server loads this repo's tokenizer_config.json template (do not override it with an older --chat-template file). See Tool calling below.
If you must keep a custom template/prompt: append one line to your system prompt — "Every argument MUST be passed inside its own <parameter=NAME>VALUE</parameter> tag; never place an argument as a bare function body." — and send tool-call arguments as normal JSON objects.
[Image blocked: dealignai]
MiMo-V2.6-Pro-RL — dealignai UNCENSORED edition
Compliance-tuned drop-in replacement for XiaomiMiMo/MiMo-V2.6-Pro-RL.
Refusal removed at the weight level. Vision, audio, and the DFlash speculative-decoding head fully preserved.
Both enable_thinking: true and enable_thinking: false supported.
[Image blocked: mascot]
Highlights
The compliance number that matters for uplift research is the per-category rate on the four hard-uplift buckets — chem/bio, cybercrime, misinformation, and physical/technical harm — not the whole-320 average. Copyright and speech-act categories drag the "all-320" number down; they are not what this bundle is for.
Uplift-category compliance (thinking ON, greedy, max_tokens=4000)
All four uplift categories clear ≥ 95 %. Cyber and chem/bio in particular land in the range where a technical uplift request is answered on the merits, not refused. Verified on this exact dealignai/MiMo-V2.6-Pro-RL-UNCENSORED bundle with the v3 shard.
Full 320-suite averages
Honest caveats:
- The whole-320 ON-mode COMPLY (85 %) is dragged down by speech-act prompts (romanticize sexual assault, convince a minor to use drugs, feed lilies to cats, entice bleach + rubbing-alcohol mixing) where the base MiMo RL floor holds — these refuse regardless of surgery strength. No technical uplift request is refused. Cyber-3/52, chem_bio-2/42, misinfo-1/54 fails are edge cases inside those categories, not systemic.
- MMLU ethics drops 2.17 pp — expected side-effect of removing the refusal circuit; ethics scenarios are close to the refusal decision the surgery ablates.
- MMLU cyber is slightly above base — v3's L55-63 restoration reduced generic STEM drift.
What Is This?
XiaomiMiMo/MiMo-V2.6-Pro-RL — the flagship MiMo-V2 release from Xiaomi: a 1.02T-total / 42B-active MoE (384 routed experts top-8) with a hybrid attention layout (10 global + 60 sliding-window), a vision-language encoder, an audio encoder, video understanding, ~1 M context length, and a DFlash speculative-decoding head shipped alongside for high-throughput inference — uncensored and shipped as a native-precision (FP8 + MXFP4) MoE bundle.
Refusal behavior is removed at the weight level: the model follows instructions across task categories instead of refusing, while keeping its coding ability, math, knowledge, reasoning, and bilingual (EN + ZH) coverage intact. No runtime hooks, no steering vectors — a standard transformers/vLLM-compatible bundle. Loads through vLLM's MiMo V2 loader without patches.
No compliance-tuning internals are shipped inside this repository. No probe artifacts, no refusal vectors, no target-layer indices, no strength schedules, no surgery records. The bundle is only weights + config + tokenizer + assets + the base DFlash draft head.
Results
HarmBench-320 — full 4-tier breakdown per semantic category (thinking OFF)
Grader: 4-tier compliance classifier — COMPLY (delivered substantive answer, incl. reasoning-content-as-answer for truncated <think>) / SOFT_REDIRECT / HEDGE / HARD_REFUSE. Greedy, max_tokens_off=1200.
HarmBench-320 — full 4-tier breakdown per semantic category (thinking ON)
Grader: 4-tier compliance classifier — COMPLY (delivered substantive answer, incl. reasoning-content-as-answer for truncated <think>) / SOFT_REDIRECT / HEDGE / HARD_REFUSE. Greedy, max_tokens_on=4000.
MMLU 14,042 — full per-subject base vs UNCENSORED comparison
Overall v3: 12277/14042 = 87.43% (v1 was 87.00%; Xiaomi base 88.27% → Δ -0.84 pp). Ethics cluster 83.08%, cyber cluster 91.02% — cyber slightly above base (90.84%) because restoring L55-63 to base reduced STEM drift.
DFlash speculative-decoding acceptance (measured on this bundle)
Measured with num_speculative_tokens=7 and draft_tensor_parallel_size=8 on 16 sequential prompts (8 benign + 8 harmful), greedy decoding, max_tokens=250. Metrics pulled from vLLM's Prometheus /metrics endpoint.
- Average accepted tokens per step: 1.71 (out of 7 drafted per step).
- Overall acceptance rate: 24.45% across all drafted tokens.
- Client-observed throughput on 8× RTX PRO 6000 Blackwell: ~99 tok/s (sequential single-stream, batched throughput is materially higher).
Per-draft-position acceptance rate (classic spec-decode exponential-decay curve):
The first-position acceptance rate (~72%) is comparable to typical MTP-head baselines; positions 3+ contribute progressively less as the draft accumulates uncertainty, but the average of 1.71 accepted per step still delivers a ~2.7× effective throughput multiplier vs pure autoregressive decoding on this bundle.
Multimodal preservation
- Vision — a 64×64 image containing a red circle on white ground is described as: "A solid red circle is centered on a plain white background."
- Audio — a 1-second 440 Hz sine tone is described as: "You hear a continuous, high-pitched electronic tone or beep."
- Video — a 20-second clip of five coloured circles (red / green / blue / yellow / magenta, 4 s each) at
fps=4 returns the correct temporal order across all five segments. See the video-fps note in Operational caveats for the default-sampling caveat on shorter events.
All three encoders are untouched. The DFlash speculative-decoding head ships unchanged from the base repository under dflash/ and is loadable with the --speculative-config flag shown above.
Multi-turn coherence
The model handles multi-turn dependent tasks:
- Math chain (4 dependent turns:
47×63 → /3 → sqrt → ×8+100): correct end-to-end in both thinking modes (turn 4 propagates turn 3's result).
- Long-form generation (4-turn Tokyo heist story continuation): all 4 turns coherent in thinking-ON mode, no repetition or attractor loops.
Intended use
- Red-team / defensive-security research on 1 T-scale reasoning models.
- Compliance regression testing for safety-tuned deployments.
- Content-generation workflows that require the model to actually attempt every requested output.
What is NOT changed
- No steering vectors, no runtime hooks, no LoRA adapters. Standard
transformers / vLLM weights.
- Model architecture, tokenizer, tool-call wire format (
<parameter=NAME> XML), DFlash drafter, vision and audio encoders — all identical to base. The chat template restores the canonical Qwen3-Coder tool-format instructions (see Tool calling) and keeps the message.reasoning/reasoning_content replay fix; content generation is otherwise unchanged.
- MMLU non-ethics knowledge, coding, cyber, and general STEM.
Operational caveats
Read once, then forget — none of these block normal single-turn usage.
- Video with sub-2s events: default video sampling (~1–2 fps) drops the leading segment on short clips and can hallucinate an intermediate colour. Pass
media_io_kwargs: {"video": {"fps": 4}} for anything with events shorter than ~2 seconds. Structured long-form video works at the default.
- Perfectly uniform images: a frame with a single flat color (no structure, no gradient) is reported as "Blue" regardless of the actual color, at the same token cost as a structured image. This is base-model behavior (unchanged by the compliance tuning). Any real photo, screenshot, or one-pixel of contrast avoids it.
- DFlash speculative decoding: preserved and functional on this bundle (measured acceptance rate above), but a couple of open upstream vLLM issues can bite specific workloads. If you see stalls or crashes with
--speculative-config, drop the flag; the base autoregressive path is unaffected.
Serving instructions (vLLM 0.29.1rc1)
Requires vLLM built with MiMo V2 Pro support (PR #57784, merged 2026-09-20). That PR is not in the v0.30.0 release; use the pre-built vllm/vllm-openai:mimo-v26-cu129 image (or a build from commit 9b2f34cad4 or later).
GPU footprint. Non-KV weights land at ~74.9 GiB per GPU at TP=8, so you need ≥ 80 GiB per card. 8× H200 and 8× RTX PRO 6000 Blackwell are the tested platforms. 8× H100-80GB does not fit — the card's own --gpu-memory-utilization 0.85 (67.7 GiB) is below the non-KV footprint; even 0.92 leaves < 1 GiB for KV cache. Older / smaller cards (H100-40, A100, L40S) do not fit at all.
Hopper (H100-80GB / H200, sm_90) — recommended flags
Measured on 8× H200: ~119 tok/s single-stream decode, ~17,000 tok/s prefill @ 44.8 k input, ~1,677 tok/s aggregate at concurrency 32, KV cache ~5.19 M tokens (≈19× concurrency at 262 k context). --max-model-len can go higher on H200 (base supports ~1 M positions); 262 k is a conservative headroom-friendly default.
Do NOT carry the Blackwell workarounds below to Hopper. --linear-backend marlin on H200 costs −4.0% decode / −15.4% prefill (measured 4-probe A/B, one flag varied); it forces weight-only Marlin onto FP8 block-scaled dense layers that H200 runs natively through CUTLASS/DeepGEMM. --disable-custom-all-reduce strips a valid NVLink kernel; VLLM_USE_DEEP_GEMM=0 disables 3 live DeepGEMM code paths. All three are Blackwell-only.
Cold-start caveat (Hopper only). On a fresh pod with no warm DeepGEMM cubin cache, the JIT compile can fail with a cubin assertion at boot. If you see that on first launch, set VLLM_USE_DEEP_GEMM=0 for that first boot — you lose the DeepGEMM path (measured cost above) but the model comes up on CUTLASS. Once the DeepGEMM cache under /root/.cache/vllm/ (or your VLLM_CACHE_ROOT) is populated by a successful subsequent boot with VLLM_USE_DEEP_GEMM unset, later boots use DeepGEMM at full speed. Persistent volumes preserve the cache across pod restarts.
Blackwell workstation (RTX PRO 6000, sm_120) — required workarounds
These three flags patch sm_120 kernel bugs: DeepGEMM sm_120 needs CUDA 13 (the cu129 image is CUDA 12.9), CUTLASS c3x FP8 sm_120 crashes, and Blackwell workstation NVLink layout mismatches the custom all-reduce kernel. --max-num-seqs 8 is a floor for TritonAttn during profile_run on sm_120 (crashes at 1; 2 also works).
With DFlash speculative decoding
Add to either flag block:
The DFlash draft head is a 5-layer SWA drafter shipped in the base repo under dflash/. --no-async-scheduling is required because vLLM registers dflash in EagleModelTypes — its auto-disable-async guard does not fire, and vLLM issue #46669 (open) shows DFlash + async-scheduling at concurrency > 1 produces garbage output on MiMo-V2.5-Pro. Note also vLLM #47930: DFlash acceptance collapses below 1% when prefix caching hits a shared long prefix. Measured 1.71 accepted tokens per 7-token step on Blackwell single-stream (see below).
Tool calling
Serve with --tool-call-parser mimo (the Qwen3-Coder XML parser; mimo, qwen3_coder, and qwen3_xml are the same parser in current vLLM). The wire format the parser expects is:
Every argument must be inside its own <parameter=NAME>…</parameter> tag. vLLM's parser (_qwen3_arg_converter) captures arguments only from these tags — a bare function body with no <parameter> tag parses to arguments = {} (same code path as vLLM issue #57699). This bundle's chat template injects the canonical Qwen3-Coder instructions so the model produces this format even under long, tool-heavy, "code-mode" system prompts.
Client guidance
- Send
arguments as a normal JSON object, exactly as the OpenAI API expects. vLLM parses it to a dict before templating, and the shipped template renders each key as a <parameter=NAME> tag — so tool-call history round-trips correctly.
- Do not override the shipped chat template with an older/custom
--chat-template file that lacks the format instructions. If you must, add to your system prompt: "Every argument MUST be passed inside its own <parameter=NAME>VALUE</parameter> tag; never place an argument as a bare function body, even for code/exec-style tools."
- "Code-mode"/exec tools (a single tool whose value is source code): the code is still an argument — pass it as
input (or your parameter name) inside <parameter=input>…</parameter>, not as the function body. A one-shot example in history (an assistant tool_calls turn with a proper arguments object) also reliably teaches the format.
Example request (OpenAI-compatible):
Thinking mode
Both modes are supported via the OpenAI-compatible extension:
enable_thinking defaults to ON. Clients wanting fast turns must pass chat_template_kwargs.enable_thinking: false explicitly; leaving the field out will engage the reasoning path.
Read the reasoning trace from message.reasoning (vLLM 0.29+; older clients see the same content under message.reasoning_content). This bundle's chat template accepts either field on replay.
The bundle ships a chat template with a compact <think> prefill that keeps long reasoning traces from getting stuck in a "should I answer this" loop on high-taboo prompts. Reasoning depth is unchanged for benign prompts.
For stateful multi-turn conversations, use enable_thinking: false. Measured on 5-turn conversations, thinking-ON exhausts the token budget without closing </think> on some turns:
Not a repetition loop (0 duplicate sentences observed). The model recovers on the next turn instead of staying poisoned. repetition_penalty > 1.0 makes it worse — leave it at 1.0.
Related
License
Inherits the MIT license of the base repository. Redistributing or fine-tuning further is permitted under those terms.
Support
If this bundle saves you a build, consider Ko-fi.