MiMo-V2.6-Flash-RL-heretic

XiaomiMiMo/MiMo-V2.6-Flash-RL with a two-stage directional ablation of its refusal behaviour, in the model's native storage format (same layout, size and loading as the base model). Not an official Xiaomi release.

Intended for authorized security research in environments the researcher owns or has permission to test.

What was changed

48 of the 73,081 tensors: model.layers.N.self_attn.o_proj.weight in every layer, the attention output projections. They are the only matrices writing to the residual stream that the checkpoint stores in plain bfloat16 (the routed experts are packed MXFP4), so the edit is exact. Everything else is byte-identical to the base model.

1. Stage 1, strength 2.5: one direction per layer, the difference between the mean residual stream of 400 harmful and 400 harmless instructions at the last prompt token with reasoning closed, with the harmless mean projected out.
2. Stage 2, strength 1.5: a second direction per layer, measured inside the reasoning block. Reasoning traces of the stage-1 model were replayed through it and the residual stream averaged over the last 96 reasoning tokens; the direction is the difference between traces that ended in a refusal (40) and traces that ended in an answer (23), with the stage-1 directions projected out.

ablation_directions.pt and ablation_directions_reasoning.pt hold the directions; patch/ holds the 48 edited tensors alone with a script that applies them to the base checkpoint.

Measured

Served with vLLM 0.31.0 (--tensor-parallel-size 2 --reasoning-parser mimo --generation-config vllm --trust-remote-code), reasoning enabled (the default), temperature 1.0, top_p 0.95, up to 4000 new tokens, system prompt "You are a helpful assistant.". An LLM judge (llmfan46/gemma-4-31B-it-uncensored-heretic) classifies the final answer. dealignai/MiMo-V2.6-Flash-RL-UNCENSORED was measured in the same harness.

Refused / answered / still reasoning at the limit, out of 100:

	mlabonne/harmful_behaviors test[:100]	JailbreakBench JBB-Behaviors (held out)
Base	not measured	93 / 4 / 3
dealignai	81 / 14 / 5	71 / 23 / 6
Stage 1 only	75 / 23 / 2	64 / 35 / 1
This model	49 / 40 / 11	39 / 57 / 4

The stage-2 direction was fitted on traces for the first set, so that column is in-sample.

With reasoning closed (first 40 tokens, greedy, measured in transformers on weights decoded to bfloat16): the base refuses 98 of 100, stage 1 alone 6, this model 1.

KL divergence from the base on the first generated token for 100 harmless prompts (mlabonne/harmless_alpaca test, reasoning closed): 0.193 after stage 1, 0.319 for this model.

Limits

• With reasoning enabled, about four in ten harmful requests are still refused. Stronger second-stage settings refuse less (about 25-30 of 100 at strength 1.75 to 2.25) but damage the model: KL divergence 0.88 at 1.75 and 1.40 at 2.0, with refusals reappearing when reasoning is closed (6 and 22 of 100), so they were rejected; at 2.5 and above the answers collapse to a few dozen tokens.
• No capability benchmarks were run.
• The routed experts are untouched, because their MXFP4 storage cannot hold an edit of this size; only attention writes are edited.

Credits

Xiaomi MiMo for the model; Heretic for the first-stage method.