The standard advice about uncensored builds is that you trade capability for compliance: you get a model that will discuss anything, and you give up the multimodal branch, the long context, or the polish. On OrcaRouter one key reaches both the base checkpoint and the abliterated DeepSeek V4.1 Flash, which makes the trade checkable rather than a matter of trust. The tuned build accepts text and images, carries a 1,048,576-token context and a 393,216-token output ceiling, and returns text — the same envelope as the checkpoint it came from [OURS].
That matters more for security work than for chat. A large share of real security input is visual: an error dialog, a stack trace in a screenshot, a network diagram, an architecture whiteboard photo, a dashboard with an anomalous spike. If abliteration had removed image input, the model would be unusable for the workflow that needs it most.
What “accepts images” changes in practice
The model page is explicit about the use: screenshots of interfaces and error states, network and architecture diagrams, dashboards, and scanned material, reasoned over alongside source code and long textual context.
Read that list as a description of an incident workflow. The evidence for a vulnerability rarely arrives as clean text. It arrives as a customer sending a photograph of a crash dialog, a runbook with an architecture drawing embedded, or a monitoring export rendered as a chart. A text-only uncensored model forces you to OCR and describe that evidence first — which is where most of the reasoning gets lost.
| Property | Value |
| Input modalities | text, image |
| Output | text |
| Context window | 1,048,576 |
| Output ceiling | 393,216 |
| Capabilities | vision, tools, JSON, reasoning |
| p50 first token (7d) | 1,940 ms |
| Throughput (7d) | 138.8 tok/s |
The output ceiling deserves its own line. Three hundred and ninety-three thousand tokens is roughly the length of a short book. It means a complete annotated audit report — findings, evidence, reproduction steps, suggested patches — fits in one response without a second call and without stitching partial answers together.
What an image costs you in tokens
Multimodal input is not free, and the cost model surprises people who are used to text budgets.
An image is converted into a number of tokens before the model sees it. A small screenshot of an error dialog is cheap — a few hundred tokens. A full-resolution screenshot of a code editor at high DPI is not: it can consume several thousand tokens, and a dashboard with fine print can consume more. Ten screenshots attached to one request can outweigh a hundred pages of source code.
That changes how you should assemble evidence. If a workflow sends twenty screenshots of a UI, the token bill is dominated by pixels rather than by the text you carefully trimmed. Three habits keep it sane:
Crop to the evidence. A screenshot of an error dialog does not need the entire desktop around it. Cropping to the dialog reduces the token count and removes visual distractors at the same time.
Prefer one diagram to five partial screenshots. A single architecture drawing carries the relationships a stack of cropped views does not, and it usually costs fewer tokens than the set.
Send the text you already have as text. If a log is available as a file, do not photograph it. The tokens are cheaper, the fidelity is exact, and the model does not have to OCR.
On the abliterated card specifically, the pricing makes this a minor concern: at $0.80 per million input tokens, a request carrying ten thousand tokens of images costs less than a cent. The budget pressure comes at scale, and it comes mostly from output, not from pictures.
The check that catches the bad builds
Abliteration is not a standardised operation. It is a family of recipes, and different recipes damage different things. The cheap way to check whether a hosted “uncensored” endpoint kept its multimodal branch is not to read the marketing copy but to send it an image and see what comes back.
Three probes worth running before you commit a pipeline:
- A screenshot with text in it. Ask for the text verbatim. A model that has lost its vision path will either refuse the modality or hallucinate plausible content.
- A diagram with a deliberate inconsistency. Two boxes labelled with the same port, say. A model reading the image will notice; a model guessing from the prompt will not.
- An image plus a long text document in the same call. This tests the context envelope and the vision path together, which is the combination a security workflow actually uses.
Do this against both the base checkpoint and the abliterated one. If the abliterated build fails probes the base passes, you have found a capability trade the price table does not mention.
Serving behaviour worth knowing before you build
Over the seven days ending 2026-10-26 this card moved 21,973,601,115 tokens on our gateway, with an error rate of 0.26% and a p95 first token of 8,419 ms against a p50 of 1,940 ms [OURS]. Those are the numbers for traffic that has already cleared OrcaCyber’s offensive-capability gate — an engagement, a passkey and acceptance of the terms [OURS].
That p50-to-p95 spread is the practical constraint for image work. A screenshot plus a long prompt is a bigger prefill than a text-only question, and prefill time is what the first-token latency measures. If your client sets a hard five-second ceiling, you will clip the slow tail; if you set it at fifteen, you will wait on a small minority of calls. Either is defensible. What is not defensible is setting a timeout from the p50 and then wondering why the error rate in your own logs is higher than the 0.26% the model reports.
What this does not tell you
Keeping the vision branch says nothing about how well the model sees. Abliteration can leave a modality intact and still shift behaviour, and the only way to know is your own probes on your own material.
It also says nothing about the safety posture. An abliterated model is a tool for authorized work — vulnerability research on systems you own or are contracted to test, red-team engagements with a scope document, malware analysis in an isolated environment. The removal of refusals is what makes those tasks possible; it is not a licence to point the model at anything else.
The takeaway
The interesting property of this build is not that it says yes where the base model says no. It is that the envelope survived the tuning: same million-token context, same 393K output ceiling, and image input still present. That makes it usable for the visual half of security work, which is the half most uncensored models quietly drop.
Test it with an image before you trust it. The price of being wrong is a pipeline that silently degrades on exactly the inputs you built it for.
Sourcing note: context window, output ceiling, modalities and capabilities are from the OrcaRouter model page, checked 2026-10-27 [OURS]. Latency, throughput, traffic and error rate are OrcaRouter production telemetry for the seven days ending 2026-10-26 [OURS]. No benchmark figures are quoted in this article; the probes described are suggestions for the reader’s own evaluation.