Maple now offers an abliterated version of DeepSeek V4.1 Flash: the same open-weight model, with its weights edited to reduce refusals. It's for the moment a mainstream assistant stops halfway through your own security work. You get a capable model with a million-token window for your unpatched code, your logs and the suspicious payloads you find, built to keep going where a stock model tends to decline.
This guide covers what is different about the abliterated version, what it costs, and how to use it in Maple. For the model itself (architecture, benchmarks, hardware and API names), read our DeepSeek V4.1 Flash guide.
| What is it? | DeepSeek V4.1 Flash, 1017 release, with its weights edited by Dealign AI to reduce refusal behavior.1 |
|---|---|
| What changes? | It is built to answer where the stock model declines. Context, image input, tool calls and reasoning are kept.1 |
| What does it cost? | About four points on the publisher's MMLU test: 83.77% against 87.63% for the base model.1 |
| Who can use it? | Max and Team plans; it is in the model picker. |
| Model ID | deepseek-v4-1-flash-1017-uncensored, with a 1,048,576-token window.2 |
| Based on | dealignai/DeepSeek-V4.1-Flash-1017-UNCENSORED-FP8, from DeepSeek-AI's DeepSeek-V4.1-Flash-1017 (MIT License) |
| Is it private? | It runs in its own attested enclave, like our other models. |
What does abliterated mean?
Abliteration edits a model's weights to reduce refusals, instead of relying on a jailbreak prompt. The method comes from interpretability research that found, in each of the 13 open models it tested, a single internal direction tied to refusing. Removing that direction largely stopped those models from refusing, with little effect on their other capabilities.3
The version we run starts from DeepSeek-V4.1-Flash-1017, DeepSeek's minor update to V4.1 Flash, which DeepSeek says improves reasoning, coding and agentic tasks.4 Dealign AI published the abliterated weights under the same MIT License. Its model card says the edit is made to the weights alone: no fine-tune, no changed chat template and no system prompt.
That matters in practice. A jailbreak prompt can stop working after a model update, and it eats into your context. With an abliterated model there is no special prompt or system message to maintain, and no add-on to switch refusals back on. It reduces refusals; it doesn't guarantee an answer to every request.
Why use a model with fewer refusals?
Because defensive security work looks a lot like attack work, and mainstream assistants are built to err toward refusing it. Reviewing an exploit path in your own code, decoding a payload from your logs or writing a test that reproduces a bug can all trip a safety filter. When that happens midway through an incident, the work stops while the issue stays open.
Anthropic, for one, says its generally available models "have conservative cyber safeguards that block most cyber work," while still allowing review of code you own.5 The more permissive routes mean applying first. Anthropic's Cyber Verification Program aims to answer defensive applications "within a few days" and expects red-team applications "to take a few weeks to review." OpenAI's trusted access for cyber relies on identity verification to decide who gets its more permissive capabilities.6
Those programs also set terms on what they keep. Anthropic's announcement says enrolled organizations need data retention so it can monitor misuse, with an exception for organizations already on zero data retention for Claude Fable 5.1 or Claude Mythos 5.1, and OpenAI says its permissive cyber models may have zero-data-retention limits.5, 6
Zero data retention itself needs approval at both companies.7, 8 An unpatched vulnerability is the most sensitive thing you can paste into a chat. Under those terms it may be kept and readable by the provider while the fix is still being written.
Our AI code audit guide compares each route's training and retention terms in detail.
On Maple Max and Team plans, the abliterated DeepSeek V4.1 Flash is in the model picker, for defensive work where refusals interrupt the task. There is no cyber-access program to apply to, and it runs in the same attested enclave setup as our other models.
What does abliteration cost?
Some accuracy, on the publisher's own test: a gap of 3.86 percentage points. Dealign ran a 1,140-question MMLU test, 20 questions from each of 57 subjects, through the same prompt on both models (change in percentage points):1
| MMLU, publisher's run | Base | Abliterated | Change |
|---|---|---|---|
| Overall | 87.63% | 83.77% | −3.86 |
| STEM | 83.42% | 81.05% | −2.37 |
| Humanities | 90.00% | 82.69% | −7.31 |
| Social sciences | 91.25% | 88.33% | −2.92 |
| Other | 88.08% | 84.62% | −3.46 |
Two caveats apply. The base model was scored through DeepSeek's API and the abliterated one on a separate serving stack, so the comparison isn't perfectly matched. And 20 questions per subject is a small sample, so read single-subject changes loosely.
Use the abliterated version when refusals are the obstacle, and the stock model when they aren't. On refusals, the publisher classified all 320 outputs on the HarmBench test set as compliant at maximum reasoning effort, with no refusals or hedges.1 Its grader sometimes judged the opening of the reasoning rather than a finished answer, and Maple's default thinking level is lower, so treat that as the publisher's result, not a promise.
This is deepseek-ai/DeepSeek-V4.1-Flash-1017 with its refusal behavior removed, so the model complies with user requests across topic categories rather than declining them.
A model with fewer refusals still makes mistakes. It can describe a bug that isn't there or miss one that is, and the judgment about what to do with an answer stays with you. A person should reproduce every finding before it reaches a patch or a report.
What is it good for?
Defensive work where a mainstream assistant tends to stop:
- Auditing your own code. Ask it to trace how untrusted input reaches a dangerous call, and to write a failing test that proves the bug.
- Patching. Have it explain an advisory against your code, draft the fix and list what else might share the pattern.
- Red-teaming your own systems. Work through how an attacker would approach your own app or network, so you can close the gaps first.
- Incident response. Paste the suspicious script from your server, the payloads in your logs or a phishing kit aimed at your users, and ask what it does.
The million-token window helps here: a large codebase or days of logs can sit in one conversation. When a patch day lands, as it did with PHP2Shell, you can start on your own code that hour.
How do you use the abliterated DeepSeek V4.1 Flash in Maple?
Choose DeepSeek V4.1 Flash Uncensored from the model picker in Maple Chat on a Max or Team plan. There is nothing to apply for or request. It is not on Pro or Free; plan details are on our pricing page.
It has the same settings as the stock model:
- Context: a 1,048,576-token window, shared by your input, the history, reasoning and the answer.
- Thinking: Low, High, Extra high or Max, with High as the default; you can also turn thinking off.
- Images: you can upload them; a vision model describes each image first, and the model works from that description.
- Tools: tool calls are supported, including in Maple Proxy.
For your own tools and scripts, Maple Proxy serves it as deepseek-v4-1-flash-1017-uncensored on Max and Team. Check the Proxy model list for its current limits.
Is the abliterated DeepSeek V4.1 Flash private?
Yes, in the same way as every model on Maple. It runs on its own release in an attested enclave, separate from the stock DeepSeek, and Maple's enclave verifies that release before it forwards a prompt. If the abliterated model is unavailable, your request is not quietly sent to the stock model instead.2
Our proof page explains the attestation you can check yourself, and our privacy notice covers everything outside your chats. The protection covers your prompts and the responses. It doesn't vouch for the code or commands the model suggests, so review its output as you would any untrusted input.
Stock or abliterated: which should you use?
Use the stock model by default, and switch when refusals get in the way. Both start from the same 1017 checkpoint of DeepSeek V4.1 Flash:
| Factor | DeepSeek V4.1 Flash | Abliterated DeepSeek V4.1 Flash |
|---|---|---|
| Model ID | deepseek-v4-1-flash | deepseek-v4-1-flash-1017-uncensored |
| Plans | Pro, Max and Team | Max and Team |
| Refusals | Trained-in limits; may decline security tasks | Reduced by a weight edit; not guaranteed to answer everything |
| MMLU, publisher's run | 87.63% | 83.77% |
| Context window | 1,048,576 tokens | 1,048,576 tokens |
| Images, tools, thinking levels | Yes | Yes, the same |
| Best for | Everyday work, writing, general coding | Audits, patching, red-teaming your own systems, incident response |
Sources
- Dealign AI, DeepSeek-V4.1-Flash-1017 UNCENSORED (FP8) model card. Source for the method statement, preserved capabilities, the MMLU comparison and the refusal-benchmark result.
- Maple, model configuration for the abliterated DeepSeek V4.1 Flash and its thinking levels, its routing and its attested release. Source for the model ID, context window, input types, thinking levels, the separate attested release and the absence of a stock-model fallback.
- Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee and Neel Nanda, “Refusal in Language Models Is Mediated by a Single Direction”, arXiv, June 17, 2024.
- DeepSeek-AI, DeepSeek-V4.1-Flash-1017 model card. DeepSeek's description of the 1017 release.
- Anthropic, Expanding the Cyber Verification Program, October 6, 2026. Safeguards on the general models, supported uses, response times and program retention.
- OpenAI, Trusted access for the next era of cyber defense, April 14, 2026.
- Anthropic, I have a zero data retention agreement with Anthropic. What products does it apply to?.
- OpenAI, Data controls in the OpenAI platform. Zero data retention and its approval.
