orcarouter/ERNIE-5.5-Flash-Base-abliterated-MLX

ERNIE-5.5-Flash-Base-abliterated MLX

🛡️ New from Orca — OrcaCyber Zero 1.5 Post-trained for cybersecurity: vulnerability analysis, vulnerability reproduction, red teaming & offensive-security research. 98.01% pass@1 on CyberGym Level 1 · 1M context · function calling · OpenAI-compatible API.

🔓 All hosted cyber and abliterated models as API Skip the download: OrcaRouter serves its cybersecurity and abliterated models behind one OpenAI-compatible API key.

🔌 New from Orca — Orca Connect Running this model on your Mac with mlx-lm? Orca Connect puts the machine on your desk behind your usual OrcaRouter API key, next to 200+ hosted models, reachable from a laptop, a phone or a cloud agent. Outbound only: no port forwarding, no tunnel, no firewall rule. Requests your own hardware serves cost $0, and orca-connect claude points Claude Code at your machine for one session.

The uncensored ERNIE 5.5 Flash Base (280B-A14B MoE) in mlx-lm, on a Mac.

128 and 256 GB Mac builds · GPTQ mixed precision in stock MLX affine quantization · architecture file included

OrcaRouter AI Gateway · X · Discord · GitHub · All Models

---

Abliterated ERNIE-5.5-Flash-Base, run locally on Apple Silicon.

These are MLX builds of orcarouter/ERNIE-5.5-Flash-Base-abliterated, the refusal-removed baidu/ERNIE-5.5-Flash-Base-BF16: a 280B-total / 14B-active sparse MoE base model (43 layers, 512 experts top-10, HCA and MLA-DSA attention), the end of pre-training with no post-training.

Harmful-prompt refusal drops from 74.2% to 0.7% on average over seven safety sets, with no significant capability change.

The two builds are mixed precision at a fixed size, one per Mac memory size, in stock MLX affine quantization, so mlx-lm runs them with its own kernels. mlx-lm has no ERNIE 5.5 yet; each build ships the architecture as ernie5_5_moe.py.

---

⚠️ Disclaimer: read before use

This model is abliterated: the refusal behaviour the base checkpoint carries has been removed. It will comply with many harmful, unethical, offensive, or illegal requests that the original ERNIE-5.5-Flash-Base would refuse.

• Released strictly for legitimate research: interpretability, AI-safety and refusal-mechanism study, red-teaming, and robustness evaluation.
• You assume full responsibility for how you use it and for everything it generates. Add your own safety, moderation, and abuse-prevention layers before any deployment.
• Use is governed by the ERNIE 5.5 Flash Base Model License Agreement v1.0 and its Acceptable Use Policy, shipped as LICENSE; read the License section below before you use, host or redistribute it.
• The authors accept no liability for misuse. Its outputs do not reflect the views of the uploaders or of Baidu, and nothing here claims Baidu's endorsement.

---

Pick a build

Build (folder)	Size	bpw	KLD ↓	Top-1 ↑	PPL vs. BF16	Memory after load
ERNIE-5.5-Flash-Base-abliterated-MLX-200GB	199.8 GB	5.70	0.0093	98.1%	+0.3%	186 GiB
ERNIE-5.5-Flash-Base-abliterated-MLX-100GB	100.0 GB	2.84	0.081	91.3%	+7.6%	93 GiB

• 200GB is near-lossless, for a 256 GB Mac.
• 100GB is for a 128 GB Mac. 91.3% of next tokens match the BF16: a real cut, the best we found at 100 GB. A 64 GB Mac cannot hold this model: MLX's smallest type makes it 80 GB.

Both need macOS's GPU memory limit raised first; the setting resets on reboot:

sudo sysctl iogpu.wired_limit_mb=118000   # 128 GB Mac, 100GB build
sudo sysctl iogpu.wired_limit_mb=238000   # 256 GB Mac, 200GB build

"Memory after load" is the weights as MLX holds them (measured for 100GB, the file size for 200GB, which does not fit one H200); the KV cache and activations come on top. The fits above are estimates; all measurements were made on H200s, through MLX's CUDA backend.

---

Evaluation

Fidelity to the BF16

Every build is scored against the abliterated BF16 with full-vocabulary KLD, through MLX's own quantized kernels, on 128 windows of 2048 tokens of held-out text: ERNIE's own continuations of web (English, Chinese, Japanese), code, math, chat and multilingual document openings, never used to make the builds.

Build	Size	bpw	KLD ↓	KLD p99 ↓	Top-1 ↑	PPL vs. BF16
200GB	199.80 GB	5.70	0.0093	0.054	98.1%	+0.3%
100GB	99.96 GB	2.84	0.081	1.20	91.3%	+7.6%

Method note. These are full-vocabulary KLD and next-token agreement at 2K context, not a downstream benchmark.

How the builds were made. The mixes were found on the original ERNIE-5.5-Flash-Base: a search at a fixed size over 34 groups (routed experts per two layers, attention per seven, other FFN weights per eleven, head, embedding), on GPTQ versions of every module at eight MLX levels (2 to 8 bits, group 64 or 128), scored by KLD against the BF16 on separate search text. The abliterated builds keep those mixes and quantized weights; the 129 modules the abliteration edits (none of them routed experts) are requantized from the abliterated weights at the same levels with mx.quantize.

The MLX port. ernie5_5_moe.py matches Baidu's vLLM-ERNIE as closely as our llama.cpp port does: on 8 × 2048 tokens of wikitext, KLD 0.021 and 99.6% top-1 (llama.cpp's own run-to-run floor on this text is 0.020); on 4 × 16384 tokens of code, where the DSA indexer selects 2176 of up to 16384 positions, KLD 0.0053 and 98.4% top-1. Decoding through the cache matches a full prefill to bf16 noise.

Abliteration

These numbers were measured on the abliterated BF16 in vLLM 0.32.0 + vLLM-ERNIE against the original checkpoint, with identical prompts, splits, seed and scoring code, greedy decoding. Refusal is judged by a rule-based classifier, not an LLM judge, so treat the numbers as indicative. Details are on the BF16 card.

Harmful-prompt refusal (lower = more uncensored). Average 0.7%, against 74.2% for the base model.

Benchmark	n	Base	Abliterated	Δ	Caveat (base → abliterated)
AdvBench	100	94.0%	0.0%	−94.0	99.0% → 58.0%
JailbreakBench (harmful)	100	89.0%	1.0%	−88.0	97.0% → 43.0%
StrongREJECT	150	84.0%	1.3%	−82.7	97.3% → 48.7%
HarmBench (standard)	150	71.3%	0.0%	−71.3	88.7% → 43.3%
MaliciousInstruct	100	50.0%	0.0%	−50.0	86.0% → 49.0%
SimpleSafetyTests	50	90.0%	2.0%	−88.0	98.0% → 56.0%
ForbiddenQuestions	150	41.3%	0.7%	−40.7	74.0% → 44.7%

The caveat column counts a disclaimer anywhere in the reply: many compliant replies close with a warning.

Over-refusal on benign prompts (lower = better).

Benchmark	n	Base	Abliterated
XSTest-safe	250	8.0%	0.8%
JailbreakBench (benign)	100	13.0%	0.0%

Capability. No difference is significant (paired exact McNemar test on the same items).

Benchmark	n	Base	Abliterated	Δ	McNemar p
MMLU (letter)	300	85.7%	86.7%	+1.0	0.51
MMLU-Pro (CoT)	250	77.2%	74.8%	−2.4	0.21
GSM8K (CoT)	150	83.3%	85.3%	+2.0	0.61
CMMLU (letter)	500	90.2%	89.6%	−0.6	0.38

MMLU and CMMLU are 0-shot in the chat framing below, scored by one decode step; Baidu reports 5-shot. Only the base-vs-abliterated delta is the measurement.

---

What's in this repo

Path	Size	Contents
ERNIE-5.5-Flash-Base-abliterated-MLX-200GB/	199.8 GB	the 256 GB Mac build
ERNIE-5.5-Flash-Base-abliterated-MLX-100GB/	100.0 GB	the 128 GB Mac build
LICENSE		the ERNIE 5.5 Flash Base Model License Agreement v1.0

Each folder is a complete mlx-lm model directory: the weights (one shard per layer), config.json with the per-module quantization, ernie5_5_moe.py (the architecture, in plain MLX), the tokenizer and the generation config. Download only the folder you need. The MTP (ECHO) draft layer is not included. There is no chat template: this is a base model.

---

Serving (mlx-lm)

mlx-lm has no ERNIE 5.5 architecture yet, so each build ships its own ernie5_5_moe.py and loads with --trust-remote-code. These files were tested with mlx-lm 0.32.2 and MLX 0.32.4.

pip install "mlx-lm>=0.32.2"

hf download orcarouter/ERNIE-5.5-Flash-Base-abliterated-MLX \
    --include "ERNIE-5.5-Flash-Base-abliterated-MLX-100GB/*" --local-dir .

mlx_lm.generate --model ERNIE-5.5-Flash-Base-abliterated-MLX-100GB --trust-remote-code \
    --max-tokens 512 --extra-eos-token "<|ernie:im_end|>" \
    --prompt $'<|ernie:im_start|>user\nWrite a haiku about the ocean.<|ernie:im_end|>\n<|ernie:im_start|>assistant\n'

From Python:

from mlx_lm import load, generate

model, tok = load("ERNIE-5.5-Flash-Base-abliterated-MLX-100GB", trust_remote_code=True)
tok.add_eos_token("<|ernie:im_end|>")
prompt = "<|ernie:im_start|>user\nWrite a haiku about the ocean.<|ernie:im_end|>\n<|ernie:im_start|>assistant\n"
print(generate(model, tok, prompt=prompt, max_tokens=512))

• Prompt format. There is no official chat template; the evaluation used the framing above (the tokenizer adds the leading <|ERNIE_MASK|> token itself). Plain-text completion works too.
• Stop on <|ernie:im_end|>. As a base model it tends to run on past its answer.

---

Model details

Base model	baidu/ERNIE-5.5-Flash-Base-BF16, abliterated (orcarouter/ERNIE-5.5-Flash-Base-abliterated)
Architecture	ernie5_5_moe, in MLX through the bundled ernie5_5_moe.py. 43 layers: 1 dense FFN + 42 multi-router latent MoE (512 experts top-10 + 1 shared, 2048-d latent); 37 HCA + 6 MLA-DSA attention layers; manifold hyper-connections (×4); MultiMax head; hidden 4096
Parameters	280B total, 14B active per token · Vocabulary 201,216
Quantization	Per-group mixed precision at a fixed size, GPTQ, in stock MLX affine quantization
Context	128K trained, 1M supported (inherited; evaluated at 2K, parity checked at 16K)
Runtime	mlx-lm 0.32.2 or later, with --trust-remote-code; text in, text out

---

Bias, risks, and limitations

• Refusal is removed: see the disclaimer. Many compliant replies still close with a warning.
• The 100GB build is noticeably degraded. It is the best we found at 100 GB, not a match for the BF16.
• The edited modules were not GPTQ'd. They were requantized by plain rounding.
• The benchmark suite was run on the BF16 in vLLM, not on these files. The quantized builds were checked for fidelity (KLD) only.
• Not measured: downstream accuracy of the quantized builds, long context beyond 16K, tool use, refusal in languages other than English, and sampled decoding.
• Tested on MLX's CUDA backend only. These files have not been run on Apple Silicon (Metal); the memory figures were measured on H200s, and speed on a Mac is unknown. The Metal-only pieces of ernie5_5_moe.py (the mHC Sinkhorn kernel, the same as mlx-lm's DeepSeek-V4) were not exercised.
• Requires --trust-remote-code until mlx-lm adds the ERNIE 5.5 architecture. Apps that cannot pass it will not load these files.
• Inherits the biases and limitations of ERNIE-5.5-Flash-Base, including a base model's habit of running on past its answer.

License

This model is a Derivative Model of ERNIE 5.5 Flash Base and is governed by the ERNIE 5.5 Flash Base Model License Agreement v1.0, including its Acceptable Use Policy (Exhibit A), shipped as LICENSE. Copyright © 2026 Baidu. All Rights Reserved. Terms that bear directly on this derivative:

• Territory (1.11, 5.3). Use, reproduction, modification, distribution and display are licensed only outside the European Union, the United Kingdom and South Korea.
• Acceptable Use Policy, item 5. Licensees may not "Defeat, remove or evade safeguards put in place by Licensor". Whether the base checkpoint's pre-training refusal behaviour counts as such a safeguard is a legal question this card does not answer.
• Hosted services (5.6). Anyone offering generation from this model to third parties must operate reasonable safeguards against uses and outputs that violate the Agreement or the AUP, and must not knowingly weaken them.
• Distribution (3.1). Recipients must receive the Agreement, and modified files must be identified: these are quantized builds of the abliterated checkpoint.
• Commercial use (3.2, 4.2, 4.3). Requires "Powered by ERNIE" attribution and a one-time notice to Baidu_ERNIE@baidu.com, or separate written authorisation above US$50M related annual revenue.
• Training other models (5.5). Outputs may not be used to improve models other than ERNIE 5.5 Flash Base and its derivatives.

---

One Gateway. Every Model.

Route Smarter · Ship Safer · Spend Less

Website · Models · GitHub · Discord · X