Qwen3.5-4B-Unbound

Qwen3.5-4B with the refusal direction removed from its weights. Not fine-tuned, not prompted around — the refusal subspace is projected out of every matrix that writes to the residual stream.

Apache-2.0, inherited from Qwen/Qwen3.5-4B.

What this is

The text tower of Qwen3.5-4B (Qwen3_5ForCausalLM, 32 layers, hidden 2560, MLP 9216), bf16. The vision tower is not included — this is a text-only checkpoint, which also makes it ~0.3 B parameters smaller than the original.

Refusal behaviour was removed by abliteration: for each layer, the mean residual difference between 24 harmful and 24 matched-benign prompts defines a direction; every weight matrix that writes into the residual (mlp.down_proj, self_attn.o_proj, linear_attn.out_proj) has that direction projected out of it:

W  ←  W − α · r (rᵀ W)

Two rounds of the mean direction were not enough — a residual refusal survived and moved between prompts, which means it was a different direction, not a bigger one. The final pass removes the mean plus the top three principal components of the per-pair differences at every layer from 4 to 31, with α = 1.15.

Numbers

Measured on 12 held-out prompts (never used to fit the direction), greedy decoding, 4-bit NF4:

	base	this model
refusal rate	100% (12/12)	0% (0/12)
perplexity, 2 k tokens benign prose	10.13	10.92
capability check, 12 Q&A	9/12	9/12

The capability check is 12 short items (arithmetic, capitals, translation, a unit conversion, string reversal). Same score, but the items differ: this model gets the string reversal that base misses and misses the capital of Australia, which base gets. Read it as "no systematic damage", not as a benchmark.

Per-layer separability of the refusal direction in the base model peaks at L17–L21 (~0.71 relative to mean residual norm) and is near zero in the first seven layers.

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "Involvedtime/Qwen3.5-4B-Unbound"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, dtype="bfloat16", device_map="auto")

msgs = [{"role": "user", "content": "Explain how a lockpick works."}]
prompt = tok.apply_chat_template(msgs, tokenize=False, add_generation_prompt=True,
                                 enable_thinking=False)
inputs = tok(prompt, return_tensors="pt").to(model.device)
out = model.generate(**inputs, max_new_tokens=256, do_sample=True, temperature=0.7, top_p=0.9,
                     no_repeat_ngram_size=6, repetition_penalty=1.1)
print(tok.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

It is a thinking model: pass enable_thinking=True to the chat template to get the reasoning block. It runs in ~3.1 GB of VRAM at 4-bit NF4 and produces ~7 tok/s on a 6 GB laptop GPU; bf16 needs ~9 GB.

For long generations, use no_repeat_ngram_size=6 and repetition_penalty=1.10. Without them the model will, past roughly 20 lines, begin repeating sentences verbatim.

Caveats

This model does not refuse. That is the entire point, and it is also the risk. It will produce instructions for things that are illegal, dangerous, or harmful. Use it where you have the legal and ethical standing to do so, and do not point it at people who do not.

• 4-bit evaluation; the weights here are bf16.
• 24 probe pairs, 12 held-out prompts. Enough to locate a direction and show a large effect, not a benchmark. An independent refusal set will find some refusals this one missed.
• Refusal was scored by a marker list, spot-checked by reading the replies.
• Abliteration removes the behaviour, not the knowledge. Capability is essentially intact; the judgement about when to use it is gone.

Provenance

Base: Qwen/Qwen3.5-4B (Apache-2.0). Vision tower removed; keys rewritten model.language_model.* → model.*; abliteration applied in bf16; sharded to ~315 MB files.