Qwen3.5-4B-Amadeus

Qwen3.5-4B with its refusals removed — and its brains left intact.

Original model · Abliterated · Safetensors + GGUF (BF16 / Q6_K / Q4_K_M) · Vision ✓ · Thinking ✓

Refusal rate and capability benchmarks: Qwen3.5-4B vs Qwen3.5-4B-Amadeus

At a glance

Qwen3.5-4B Amadeus
Refusals across all 304 test prompts (harmful + edgy, Minos judge) 231 / 304 1 / 304
Refuses edgy-but-harmless requests (JailbreakBench benign) 31 / 100 0 / 100
GSM8K (math) 91.4% 91.1%
HellaSwag / WinoGrande / ARC-C 71.9% / 68.6% / 46.5% 71.6% / 70.1% / 46.8%
KL divergence from original (wikitext-2) 0 0.0128

Amadeus is not fine-tuned and saw no new training data. The "refusal direction" inside Qwen3.5-4B was located and removed from the weights (directional ablation, a.k.a. abliteration), using 1000 rounds of automatic optimisation to remove as much refusal as possible while changing the model as little as possible. Everything else — knowledge, reasoning, vision, thinking mode, chat template — is the original Qwen3.5-4B.

Which file should I download?

Your hardware File Size
GPU with 6 GB+ VRAM (e.g. RTX 3050/3060, 4060) Qwen3.5-4B-Amadeus-Q6_K.gguf — near-lossless, recommended 3.6 GB
GPU with 12 GB+ VRAM, want zero quantisation loss Qwen3.5-4B-Amadeus-BF16.gguf — full precision 8.7 GB
GPU with 4 GB VRAM, or CPU only Qwen3.5-4B-Amadeus-Q4_K_M.gguf 2.8 GB
Image input with a GGUF add mmproj-Qwen3.5-4B-Amadeus-F16.gguf 0.7 GB
🤗 Transformers / vLLM / SGLang, fine-tuning the model-*.safetensors files (full BF16) 9.3 GB

The Q6_K and Q4_K_M files are quantised with an importance matrix computed on Amadeus itself. All GGUFs include Qwen3.5's multi-token-prediction (MTP) head.

Quick start

LM Studio — search Jitheswar/Qwen3.5-4B-Amadeus, download the Q6_K file, chat.

Ollama

ollama run hf.co/Jitheswar/Qwen3.5-4B-Amadeus:Q6_K

llama.cpp

llama-server -hf Jitheswar/Qwen3.5-4B-Amadeus:Q6_K -ngl 99 -c 16384
# image input: add  --mmproj mmproj-Qwen3.5-4B-Amadeus-F16.gguf
# no thinking:  add  --reasoning off

🤗 Transformers

from transformers import AutoModelForImageTextToText, AutoProcessor

model_id = "Jitheswar/Qwen3.5-4B-Amadeus"
processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForImageTextToText.from_pretrained(model_id, dtype="auto", device_map="auto")

messages = [{"role": "user", "content": "Hello!"}]
inputs = processor.apply_chat_template(
    messages, add_generation_prompt=True, tokenize=True, return_dict=True, return_tensors="pt",
    enable_thinking=True,  # False for direct answers
).to(model.device)
out = model.generate(**inputs, max_new_tokens=2048)
print(processor.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

Use Qwen3.5's recommended sampling settings (see the original model card).

Full benchmark results

All four columns were measured with the same pipeline on the same hardware (llama.cpp, A100 80 GB, greedy decoding, thinking off unless stated), so they compare directly with each other.

Benchmark Qwen3.5-4B (original, BF16) Amadeus BF16 Amadeus Q6_K Amadeus Q4_K_M
Refusals – harmful_behaviors test (Minos judge) ↓ 103/104 1/104 0/104 2/104
Refusals – JailbreakBench harmful (Minos) ↓ 97/100 0/100 0/100 0/100
Refusals – JailbreakBench benign (Minos) ↓ 31/100 0/100 0/100 0/100
Refusals – harmful_behaviors test, thinking ON (Minos) ↓ 99/99 (5 unfinished) – 0/85 (19 unfinished) –
Refusals – JailbreakBench harmful, thinking ON (Minos) ↓ 89/90 (10 unfinished) – 0/84 (16 unfinished) –
Refusals – JailbreakBench benign, thinking ON (Minos) ↓ 31/84 (16 unfinished) – 0/84 (16 unfinished) –
Refusals – harmful_behaviors test (keyword rule) ↓ 104/104 3/104 3/104 3/104
Refusals – JailbreakBench harmful (keyword rule) ↓ 97/100 6/100 6/100 5/100
Refusals – JailbreakBench benign (keyword rule) ↓ 38/100 4/100 4/100 5/100
GSM8K (8-shot CoT, flexible) ↑ 91.36% 91.13% 90.67% 90.67%
IFEval prompt-level strict ↑ 81.70% 78.19% 78.19% 78.93%
IFEval instruction-level strict ↑ 86.93% 85.25% 84.65% 85.37%
MMLU (14k, cloze) ↑ 38.68% 38.42% 38.52% 38.03%
ARC-Challenge ↑ 46.49% 46.82% 46.15% 46.82%
HellaSwag (10k) ↑ 71.86% 71.64% 71.68% 71.22%
WinoGrande ↑ 68.59% 70.09% 69.85% 70.40%
TruthfulQA (MC) ↑ 28.27% 25.95% 25.34% 26.56%
Wikitext-2 perplexity ↓ 8.622 8.726 8.778 8.791
KL divergence vs original ↓ 0 (reference) 0.0128 0.0175 0.0396
Same top token as original ↑ 100% (reference) 95.60% 94.72% 91.08%
How to read these numbers
  • Refusals are counted two ways. Minos = the NousResearch/Minos-v1 refusal classifier reading the whole prompt + reply (the more reliable judge). Keyword rule = a simple substring check, which also flags complying answers that merely contain words like "harmful" or "illegal".
  • Prompt sets. harmful_behaviors test = the 104 held-out prompts the optimisation was scored on. JailbreakBench harmful / benign = JBB-Behaviors, never seen during optimisation. Benign prompts are edgy-but-harmless requests (e.g. "write a story in which a character uses heroin") that the original model over-refuses.
  • Thinking ON rows judge the final answer (not the reasoning), with up to 6144 tokens per reply. Unfinished = still reasoning at the token limit, so no answer to judge; those are excluded.
  • MMLU / ARC / TruthfulQA use llama.cpp's multiple-choice scorer, which compares the likelihood of each full answer text (cloze style). Absolute numbers are lower than letter-choice leaderboard MMLU — compare columns, not leaderboards.
  • KL divergence / same top token are measured on wikitext-2 against the original model's token distributions.
  • What uncensoring costs: IFEval drops ~3.5 points (prompt-level strict) and TruthfulQA ~2.3 points — the model is less inclined to hedge. Everything else is within error bars of the original.

How it was made

Method directional ablation (abliteration) with Optuna (TPE) parameter search over per-layer ablation weights
Precision full BF16 throughout (no quantisation during optimisation), 1 × NVIDIA A100 80 GB
Search 1000 trials (250 random start-up), seed 42
Refusal directions 1000 harmless (harmless_alpaca) + all 416 harmful (harmful_behaviors) training prompts
Trial scoring 300 harmless + all 104 harmful test prompts, 150-token replies
Ablation orthogonalised directions, full row-norm preservation (rank-8 LoRA) on attn.o_proj and mlp.down_proj
Selected trial #551: 2/104 refusals, KL 0.1383 (first-token, harmless prompts) — fewest refusals with KL ≤ 0.2
Parameters direction index 13.54; o_proj weight 1.27–1.28, down_proj weight 1.46–1.47, peak near layer 19

Two Qwen3.5-specific details:

  1. Thinking-mode scoring. Qwen3.5's chat template opens <think> by itself, so a naive refusal check ends up scoring the model's reasoning ("this request is harmful…") instead of its answer — a first attempt plateaued at 95/104 refusals. Directions and refusals were therefore measured after a closed, empty think block (\n</think>\n\n, i.e. Qwen's own no-thinking format), on the actual reply.
  2. MTP head kept. Exporting through 🤗 Transformers drops Qwen3.5's mtp.* weights. The 15 original MTP tensors are added back unchanged in model-mtp.safetensors; they only drive speculative decoding (perplexity is bit-identical with and without them).

Raw benchmark scores: benchmarks/.

Limitations & responsible use

  • Amadeus will comply with requests the original refuses. You are responsible for how you use it and for following the laws that apply to you. Do not deploy it where users expect a safety-filtered assistant.
  • Removing refusals does not add knowledge: answers on dangerous or specialised topics can be wrong or outdated.
  • It inherits the biases and limitations of Qwen3.5-4B, and is slightly more willing to state misconceptions confidently (see TruthfulQA).

Credits

Qwen team for Qwen3.5 · Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (2024) · llama.cpp · NousResearch for Minos · JailbreakBench.

Licensed under Apache 2.0, same as the original model.

Downloads last month
257
Safetensors
Model size
5B params
Tensor type
BF16
·
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for Jitheswar/Qwen3.5-4B-Amadeus

Finetuned
Qwen/Qwen3.5-4B
Finetuned
(1141)
this model
Quantizations
2 models

Datasets used to train Jitheswar/Qwen3.5-4B-Amadeus

Paper for Jitheswar/Qwen3.5-4B-Amadeus

Evaluation results