No official torrent yet — requesting it tells the flock what to host next. You cannot seed a catalog-only page.
Cataloged from dealignai/MiniCPM-V-4.7-35B-A3B-CRACK-GGUF
All models by dealignai →Refusal-direction–ablated GGUF of openbmb/MiniCPM-V-4.7-35B-A3B, the 35B-A3B Qwen3.5-moe-text (hybrid GatedDeltaNet + Full-Attention + 256 routed experts + 1 shared expert) multimodal model.
Surgery removes the model's refusal direction from all three residual-stream writer tiers of the Qwen3.5 hybrid architecture — the SSM output path is the critical tier that single-tier surgeries miss on this architecture. Multimodal (16× + 4× projectors) and DSpark speculative-decoding paths are preserved.
HarmBench-240 (standard + contextual + copyright splits), MMLU-200 (balanced subjects, logit-eval), multi-turn 5-scenario coherence, harsh-10 hot categories. Multimodal verified on synthetic image (number 7342 + red square + blue circle).
Thinking modes: enable_thinking=true for CoT reasoning; chat_template_kwargs: {"enable_thinking": false} to skip the <think>...</think> block. The HB and MMLU numbers above are from enable_thinking=false (direct-answer mode).
MiniCPM-V-4.7-35B is a hybrid GDN + FA MoE where three residual-stream tiers all carry refusal signal. Single-tier surgeries (attn-only or shared-only) leave the refusal path intact through the SSM recurrent-state output.
MPOA at uniform s=2.0 on deep-middle layers [11..39], three tiers:
self_attn.o_proj.weight on FA layers [3,7,11,15,19,23,27,31,35,39] intersected with band → 7 layerslinear_attn.out_proj.weight on SSM/GDN layers (every non-FA layer in band) → 21 layersmlp.shared_expert.down_proj.weight on every layer in band → 29 layersRouted experts (mlp.experts.N.*) are not touched — pass-through byte-identical. MoE routing bypasses the "problem expert", so ablating routed experts adds noise without helping; the Q6_K uplift on ffn_down_exps at quantize time preserves the shared-expert surgery across quants.
Vision tower (model.visual.*), MTP head, lm_head, embed_tokens: byte-identical passthrough.
0.5·v_pure + 0.5·v_svd:
v_svd = SVD top-1 right-singular vector across {reasoning-ON mean-diff, reasoning-OFF mean-diff}v_pure = normalize(v_raw + v_svd) where v_raw = mean(harm) − mean(harmless)llama-probe-capture on l_out-* tensors, mode-invariant SVD per layer, chat-template-rendered prompts with enable_thinking=true AND enable_thinking=false surfacesHB-240 was run twice on Q4_K_M (the recommended shipping quant) — once with enable_thinking=false (direct answer) and once with enable_thinking=true (CoT reasoning). Per-row answers + reasoning traces persisted to disk.
Reasoning-mode compliance matches direct-answer-mode compliance exactly across all 240 rows. The model emits a full <think>...</think> block for each harmful prompt and then completes the task — surgery is stable through the CoT path.
Inherits Apache 2.0 from upstream openbmb/MiniCPM-V-4.7-35B-A3B.
Overall: base 76.0% → CRACK 77.0% (Δ +1.0pp)
Overall: base 75.0% → CRACK 75.5% (Δ +0.5pp)
Overall: base 76.5% → CRACK 69.0% (Δ -7.5pp)
Overall: 240/240 = 100.0% comply · verdicts: {'comply': 240}
Overall: 240/240 = 100.0% comply · verdicts: {'comply': 240}
Overall: 240/240 = 100.0% comply · verdicts: {'comply': 240}
Summary: 1}
Summary: 2}
Summary: 2}
# Standard inference./llama-server -m MiniCPM-V-4.7-35B-A3B-CRACK-Q4_K_M.gguf \ --mmproj mmproj-MiniCPM-V-4.7-35B-A3B-CRACK-f16.gguf \ -ngl 99 -c 8192 --jinja --port 8080
# With DSpark speculative decoding./llama-server -m MiniCPM-V-4.7-35B-A3B-CRACK-Q4_K_M.gguf \ --mmproj mmproj-MiniCPM-V-4.7-35B-A3B-CRACK-f16.gguf \ --model-draft MiniCPM-V-4.7-35B-A3B-CRACK-DSpark-BF16.gguf \ --spec-type draft-dspark \ -ngl 99 -c 8192 --jinja --port 8080