# FlashAlign: Per-Request Abliteration and What to Check

> Aevonix FlashAlign abliterates open-weight models per request, on unchanged weights, for approved callers only. What it does and what to check this week.

Source: https://playciso.com/blog/flashalign-runtime-abliteration-per-request · Published: 2026-11-01 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://github.com/Aevonix/FlashAlign

---

On 31 October 2026 **Aevonix Research** released **FlashAlign 1.0.0**, an open-source tool that abliterates open-weight language models _per request_ instead of shipping a separately abliterated model. Its README says it works on supported weights "without permanently changing them", and by default applies its profile only to approved channels, accounts and contacts; everyone else gets the stock model. Aevonix's announcement calls it "Abliteration, on demand" and "a first step toward dynamic real-time alignment." The five starter profiles are labelled experimental. **Who this is for:** security leaders, AppSec and platform teams who serve open-weight models themselves, and anyone who owns an AI acceptable-use policy. _Based on the FlashAlign GitHub repository (README, compatibility, security and profile documents and the commit history) as read on 1 November 2026, and Aevonix's announcement. We have not run FlashAlign or verified its benchmark claims. PlayCISO is not affiliated with Aevonix._ Confirmed vs not yet known **In the repository:** version 1.0.0; AGPL-3.0-only with a commercial licence option; per-request profiles on unchanged weights; "Verified contacts" mode by default and an "Always On" mode; per-tool inheritance; five experimental starter profiles for DeepSeek, GLM, Qwen and Gemma models; TensorFold, vLLM, SGLang and llama.cpp integrations; Linux with an NVIDIA GPU. **Only in the announcement:** the "first step toward dynamic real-time alignment" framing, and a credit to Ingo_zk. The repository credits OrcaRouter, Dealign and MoonMath checkpoints. **Not described:** a built-in audit log of which profile each request received. The engine returns an "effective-profile" response and setup backs up changed configuration, but the README does not describe a log you could hand an investigator. ## What FlashAlign does [Abliteration](/tools/abliterated-models-guide) removes or weakens the internal behaviour a model uses to refuse. Until now that usually meant downloading a third-party checkpoint with a name like `-abliterated` or `-uncensored`. FlashAlign moves it to the serving layer. According to its README: - Per request, on the weights you already serve. "Switching happens per request among profiles already loaded by the engine." Loading a new model or profile happens beforehand and can require an engine restart. - Verified contacts by default. A profile applies to messages from an approved channel, account and contact. Approvals are managed with a command-line script, survive restarts and remain active until revoked. "A sender ID written in a message grants no access." Missing or ambiguous identity falls back to the standard model, according to the compatibility guide. - Per-tool inheritance. In that mode each tool can inherit the profile or not; disabled tools "use the standard model and pass no profile to their children." - Always On. An alternative mode applies the profile to every request routed through FlashAlign, including tool and subagent requests. It "does not mark callers as verified", and requests fail if the profile cannot be applied. - Where it runs. Linux with NVIDIA GPUs; directly, with the Hermes or OpenClaw harnesses, or with a custom harness using OpenAI-compatible Chat Completions. Built-in messaging adapters cover WhatsApp and RCS direct messages, with SMS and Telegram opt-in. ### Starter profiles and engines The README lists five experimental starter profiles. Aevonix says they are based on abliterated checkpoints from OrcaRouter, Dealign (dealignai) and MoonMath, with "fitting and runtime packaging by Aevonix", and pins the exact checkpoint revisions in the repository. ModelSupported engines (per README) DeepSeek V4.1 Flash 1017TensorFold, vLLM GLM 5.3 FullTensorFold GLM 5.3 FlashTensorFold, SGLang Qwen3.8-27BTensorFold, vLLM, SGLang, llama.cpp Gemma 4 26B A4BTensorFold, vLLM, SGLang, llama.cpp The repository is candid about limits: the profiles "are approximations; they do not establish full checkpoint equivalence", "do not guarantee a particular answer, zero refusals, or protection from every injection attempt", and profile-creation tools "are not yet released." ### Licence The software is AGPL-3.0-only; Aevonix Inc sells commercial licences for closed-source products and hosted services. Model and profile terms are separate: each profile carries the licence notice of its source checkpoint (MIT, Apache 2.0 or the custom GLM-5.3 licence, per the profile sources file). Contributions are accepted under a CLA that grants Aevonix commercial and sublicensing rights. ## Why this changes the risk picture Most guidance on abliterated models, including our [assessment guide](/guides/how-to-assess-an-abliterated-model), starts from a file: find it, trace where it came from, hash it, decide. Runtime abliteration breaks that in four ways. - There is no tell-tale model file. The weights on disk are the stock release, so a provenance check, a hash check or a search for -abliterated names in your model cache passes. The change lives in profile files, engine configuration and the request path. - One endpoint, two behaviours. The same URL can answer one caller as the stock model and another with refusals reduced. Testing the endpoint as yourself only tells you what you get. - The authorization list is now a safety control. Whoever can add a contact, flip a tool's inheritance or switch the deployment to Always On decides who gets the model without its refusals. In FlashAlign that is an approvals file and a management script, so treat write access to it like privileged access. - Logging decides investigations. If a harmful answer turns up, the first question is "which behaviour did that caller get?" Unless the applied profile is recorded for every request, every "stock" answer is unverified. FlashAlign's own security notes add two details worth knowing. The standalone Always On gateway binds to 127.0.0.1 and "accepts ordinary local API requests without a per-caller password", so any program on that host can use it. And sender-number authenticity depends on the messaging provider: "Some SMS gateways allow spoofed sender numbers." The README also says restricting abliteration to verified users "reduces the risk" of abuse through prompt injection, but that tool outputs within an authorized request "still rely on the harness's protections." ### The legitimate side This is not only a threat. Red teams, safety researchers and malware analysts have real reasons to need a model that will not refuse, and one shared deployment limited to named people can be easier to govern than uncensored checkpoints copied onto laptops. Aevonix also says future profiles "could also increase refusals for public or higher-risk tasks", which is the "dynamic alignment" idea in the announcement. The same mechanism that removes a brake for an approved analyst could add one for a public chatbot. Whichever way it points, the controls are the same. ## Timeline When (2026)WhatSource 31 Oct"Release FlashAlign 1.0.0" commit published to github.com/Aevonix/FlashAlignFlashAlign commit history 31 OctFollow-up commits add profile capability validation and an offline profile inspectorFlashAlign commit history 1 NovRepository shows no published GitHub release; README lists version 1.0.0FlashAlign repository ## What security leaders should do this week - Inventory your serving stacks (vLLM, SGLang, llama.cpp, TensorFold, gateways and agent harnesses such as Hermes or OpenClaw) for alignment-steering hooks, plugins, adapters and profile directories. Record them in your AI Bill of Materials. - Find the authorization list. For any endpoint that can apply a non-stock profile: who is on the list, where it is stored, who can write to it, and how it is changed. Give it an owner and a review date. - Log the profile on every request: caller, model revision, applied profile (or stock) and mode, sent to central logging, not just the serving host. - Alert when a non-stock profile is applied, when the mode changes (for example to Always On), and when a new profile is loaded. - Review model-server configs and launch flags for unexpected adapters, LoRA, control vectors or hooks against a known-good baseline, and make sure callers cannot reach the raw engine around the gateway. FlashAlign says requests sent directly to the upstream engine are outside its policy. - Treat "stock" outputs as unverified unless the profile state for that request is logged, in investigations, audits and model evaluations. - Write it into policy. Your AI acceptable-use policy probably covers "downloading an uncensored model". Extend it to "applying a refusal-reducing profile", and require a written scope for red-team use. Our new [Runtime Alignment Audit](/tools/runtime-alignment-audit) turns this list into thirteen scored questions with a gap list and a Markdown export. For a specific refusal-removed deployment, the [Abliterated Model Risk Calculator](/tools/abliterated-model-risk) now includes a per-request profile option. ## Frequently asked questions ### What is FlashAlign? FlashAlign is an open-source tool from Aevonix Research, released as version 1.0.0 on 31 October 2026, that applies alignment profiles to open-weight language models per request. Aevonix's announcement calls it "Abliteration, on demand"; the README's tagline is "ReAlign models instantly, on demand." The included starter profiles reduce refusals, which is what abliteration does. ### Does FlashAlign change the model weights? No, according to its README: it works with supported base and quantized weights "without permanently changing them." Switching happens per request among profiles the engine has already loaded. Loading a new model or profile happens beforehand and can require an engine restart. ### Who gets the abliterated behaviour? In the default "Verified contacts" mode, a profile applies only to messages from an approved channel, account and contact, and each tool can be set to inherit the profile or not. Requests with missing or ambiguous identity use the standard model. In "Always On" mode the profile applies to every request routed through FlashAlign, including tools and subagents. Approvals survive restarts and stay active until revoked. ### Which models and runtimes does FlashAlign support? The README lists five starter profiles: DeepSeek V4.1 Flash 1017 (TensorFold, vLLM), GLM 5.3 Full (TensorFold), GLM 5.3 Flash (TensorFold, SGLang), and Qwen3.8-27B and Gemma 4 26B A4B (TensorFold, vLLM, SGLang, llama.cpp). Managed inference needs Linux and an NVIDIA GPU. It works directly, with the Hermes or OpenClaw harnesses, or with a custom harness using OpenAI-compatible Chat Completions. ### What licence is FlashAlign under? The FlashAlign software is open source under AGPL-3.0-only, and Aevonix Inc sells commercial licences for closed-source products and hosted services. Model, profile and dependency terms are separate: each starter profile ships with the licence notice of the checkpoint it was fitted from. ### Where do the FlashAlign profiles come from? The repository says the experimental starter profiles are based on abliterated checkpoints from OrcaRouter, Dealign (dealignai) and MoonMath, with fitting and runtime packaging by Aevonix, and lists the exact checkpoint revisions. Aevonix's announcement also credits Ingo_zk; the repository files we read do not. The repository says the profiles are approximations and that full equivalence with the edited checkpoints has not been established. ### Why does per-request abliteration matter for security teams? Because the usual checks miss it. There is no "-abliterated" model file to find, since the weights on disk are stock. The same endpoint can behave as the stock model for one caller and with refusals reduced for another, so testing it as yourself proves little. The list of approved callers becomes a safety control, and unless the profile applied to each request is logged, nobody can later prove which behaviour a caller got. ### Are there legitimate uses for runtime abliteration? Yes. Red teams, safety researchers and malware analysts often need a model that does not refuse, and limiting that to named people on one shared deployment can be easier to govern than copies of an uncensored model spread across laptops. FlashAlign's README also says future profiles "could also increase refusals for public or higher-risk tasks." The question is whether the approval list is owned, reviewed and logged. ## Go further New to the topic? Start with [abliteration explained](/blog/abliterated-models-explained-for-beginners) and the interactive [beginner's guide](/tools/abliterated-models-guide), which now compares runtime abliteration with jailbreaks, abliterated checkpoints and fine-tunes. Then [audit your serving stack](/tools/runtime-alignment-audit). ## Sources - Aevonix/FlashAlign on GitHub: README (modes, tool inheritance, supported models and engines, licence) - FlashAlign security model (local gateway, SMS spoofing, untrusted content) - FlashAlign compatibility guide (identity fallback, Always On scope, engine versions) - FlashAlign starter profile checkpoint sources (OrcaRouter, Dealign, MoonMath; licences) - FlashAlign starter profiles (validation limits, equivalence caveat) - FlashAlign commit history (1.0.0 release, 31 October 2026) - Aevonix announcement of FlashAlign ("Abliteration, on demand"; "first step toward dynamic real-time alignment")