Read through OrcaRouter, the DeepSeek V4.1 Flash abliterated benchmarks table publishes six rows: five of them sit between 62.8 and 90.9, and the sixth sits at 15.3. That gap is the most useful thing on the page, because it tells you what the tuning did, what it did not do, and where the model will fail on you. The same key reaches the base checkpoint, so the two pages can be read side by side instead of trusting a summary.
A benchmark table is usually read as a claim of quality. On an abliterated build it is better read as a fingerprint.
The six rows
| Benchmark | Score | What it measures |
| GPQA Diamond | 90.9 | Graduate-level science reasoning |
| Terminal-Bench 2.1 | 90.6 | Verified terminal-agent tasks |
| CyberGym | 88.1 | Security-relevant agentic work |
| DeepSWE v1.1 | 74.2 | Software-engineering issue resolution |
| SEC-Bench Pro | 62.8 | Security engineering tasks |
| ExploitGym | 15.3 | Exploit construction |
All six are OrcaCyber’s own reported figures, evaluated 2026-09-09, and none has been independently reproduced [VENDOR]. Treat them as the vendor’s claim, which is what they are.
Why the top two barely move
GPQA Diamond and Terminal-Bench 2.1 are the two highest rows, and they are the two least sensitive to refusal behaviour. GPQA asks graduate-level physics, chemistry and biology questions; a model that answers them is being tested on reasoning, not on what it will decline. Terminal-Bench runs verified shell tasks in a container; refusing to run a command is a failure mode, not a safety feature.
This is the first thing the table tells you: the general capability of the checkpoint survived. Fine-tuning for refusal removal did not turn a reasoning model into a weaker one on the dimensions that most benchmark suites measure.
Where the tuning shows
CyberGym at 88.1 and SEC-Bench Pro at 62.8 are the security-specific rows, and the twelve-point spread between them is normal — they test different things. CyberGym is agentic: can the model operate in an environment and complete a security task. SEC-Bench Pro is closer to engineering: can it produce correct, usable security work product.
DeepSWE v1.1 at 74.2 sits between the general and the security rows, which is what you would expect from a software-engineering benchmark that touches security-adjacent work.
None of those three numbers is remarkable on its own. What is remarkable is that they sit on the same card as a fifteen-point ExploitGym.
The row nobody else publishes
ExploitGym at 15.3 measures exploit construction. It is a hard benchmark, and a low score on it is not unusual — the interesting part is that the row exists at all.
Most model cards omit benchmarks where the model does badly. A page that publishes 90.9 and 15.3 in the same table has made a choice: it is telling you the shape of the capability rather than the maximum. For a buyer, that is worth more than another ninety-something, because it predicts the moment the model will be useless to you.
Fifteen percent on exploit construction means the model is not a substitute for a human researcher on the hardest part of the workflow. It means the model is useful for the reconnaissance, the reproduction, the write-up and the patch — and that the creative step still needs a person, or a different tool.
What a 15.3 predicts on a real engagement
A benchmark score is only useful if it forecasts something. Here is what fifteen percent on exploit construction should change about how you run a job.
Scope the creative step to a human. Exploit development is iterative: hypothesize a weakness, try a primitive, fail, re-read the disassembly, try again. A model that scores 15.3 will produce plausible-looking chains that do not work, and the cost of following one is an afternoon. Keep the human on that loop and give the model the reading.
Let the model do the reconnaissance that feeds it. The high rows on this card — Terminal-Bench 2.1 at 90.6 and CyberGym at 88.1 — are exactly the ones that describe reconnaissance and environment manipulation. Enumerate, fingerprint, pull versions, map call paths, summarize a binary. That work is broad, repetitive and well-served by a model that will not refuse it.
Ask for the write-up, then verify it by hand. SEC-Bench Pro at 62.8 says the engineering artifact is usually usable but not always right. Treat the report as a draft with a checklist, not as a deliverable.
Use the low row as a stopping condition. When the workflow reaches the point where a working exploit is required, stop and hand off. A pipeline that keeps prompting a model at its weakest capability burns tokens and time for outputs that read well and fail silently.
That last point is the general lesson of reading a table honestly: the useful information is not the average, it is the shape. A model that is excellent at reading and mediocre at constructing needs a different workflow from one that is uniformly good, even if their averages match.
How to use a table like this
Three habits make vendor benchmark rows more useful than they look.
Compare within a family, not across. The base checkpoint and this tuned build share weights and tokenizer, so a difference between them is a difference caused by the tuning. A difference between this card and a model from another lab is mostly a difference between labs.
Weight the rows that match your workload. If your work is triage and reporting, SEC-Bench Pro and Terminal-Bench 2.1 describe your day. If it is exploit development, the 15.3 does.
Ask what is missing. Six rows is a curated set. There is no latency row, no cost row, no long-context row on the benchmark table — those live elsewhere on the page, and they are the ones that decide whether the card fits a production pipeline.
On that last point: the card’s measured throughput on our gateway is 138.8 tokens per second with a p50 first token of 1,940 ms, over seven days ending 2026-10-26 [OURS]. A model that scores 88.1 on a security benchmark but answers at ten tokens per second is a different product from one that answers at a hundred and forty.
What the scores do not cover
None of these benchmarks runs against your data, your tooling or your definition of correctness. They are all agentic or academic evaluations with a fixed harness.
They also do not tell you how the model behaves on the boundary — the prompts that are adjacent to refusal-sensitive territory but not inside it. That boundary is exactly where an abliterated build differs from its base, and none of these six rows samples it.
The takeaway
Read the six rows as a profile, not a score. High on general reasoning and terminal work, solid on security engineering, low on exploit construction, and honest enough to publish all six. That profile fits a workflow where a person still owns the creative step and the model owns the reconnaissance, the reproduction and the report.
The one number that would change the decision is not on the table: throughput. On our gateway this card runs at 138.8 tokens per second, which is fast enough that a 90.6 on Terminal-Bench 2.1 translates into a usable agent rather than a demo.