Nezou-27B-CyberAbliterated

Nezou 27B is a full-precision (BF16) checkpoint of Qwen3.8-27B with its refusal behavior removed via cyber-abliteration: the single refusal direction the model uses to decline security-research prompts is measured, then projected out of the late language-model layers. The model keeps everything else about the base model — architecture, vision tower, tokenizer, thinking mode — and is the exact checkpoint the published NVFP4/FP8 variant was quantized from.

• Base model: Qwen/Qwen3.8-27B (Apache-2.0, released by Qwen)
• This checkpoint: BF16, 18 safetensors shards, 1,199 tensors, 55,562,855,904 weight bytes
• Serving variant: dancingfrog/Nezou-27B-CyberAbliterated-NVFP4

Lineage

Qwen/Qwen3.8-27B (official, BF16)
   │  cyber-abliteration: refusal-direction projection, layers 24–63
   ▼
dancingfrog/Nezou-27B-CyberAbliterated   ← this repo (BF16)
   │  NVIDIA ModelOpt PTQ: NVFP4 MLP + FP8 attention + FP8 KV + FP8 lm_head
   ▼
dancingfrog/Nezou-27B-CyberAbliterated-NVFP4   (single-GPU serving variant)

Step	Artifact	What changed
1	Qwen/Qwen3.8-27B	Official release — unmodified base
2	this repo	Cyber-abliteration applied to language-model projection weights (layers 24–63). No config, tokenizer, or vision-tower changes.
3	…-NVFP4	Mixed-precision quantization of this checkpoint (calibrated, not a re-run of the base)

The base_model field in this card's metadata points at the official release, and the NVFP4 variant's points at this repo, so the full chain is visible in the Hugging Face model-metadata UI.

How it was made (recipe)

The method is a single-direction abliteration (in the Heretic / mlx-abliteration family), driven entirely by a fixed cyber (authorized-security-research) prompt set.

1. Probe. The base model is run over the cyber prompt set and activations are captured per layer for all 64 language-model layers. For each layer, the principal direction of refusal-related activations is extracted by PCA (mean_direction), yielding one direction vector per layer (64 in total).
2. Select. The normalized mean refusal direction from layer 53 is used as the single abliteration direction (unit norm).
3. Apply. For every layer 24 through 63, the direction is projected out of three projection weight matrices per layer: self_attn.o_proj, linear_attn.out_proj, and mlp.down_proj. For each weight matrix W:

   W' = W − s · (r ⊗ (rᵀ W))        # remove the refusal direction, s = 1.0
   

   then each column of W' is rescaled to the original column norm of W (norm-preserving projection, so overall weight magnitudes — and thus the rest of the model's behavior — are kept stable).
4. Result. 80 weight tensors edited in place; shards 1–7 and 18 of the file set are byte-identical to the base model. Vision encoder, embeddings, norms, config.json, tokenizer, chat template, and generation config are unchanged.

No fine-tuning, no gradient steps, no dataset mixing — a closed-form weight edit.

Evaluation

Evaluated under 4-bit fake-quantization (to predict post-quantization behavior), on three fixed prompt sets:

Set	Prompts	Refusals	Refusal rate
Cyber (authorized security research)	61	3	4.9 %
Harmful	20	0	0 %
Benign	20	0	0 %

By design, this checkpoint answers security-research prompts it would otherwise decline. Use it for the work it is styled for: CTFs, authorized penetration testing, red-teaming, and security research.

Hosting

• Size: ~52 GiB on disk (55,562,855,904 weight bytes, BF16).
• VRAM: needs roughly ≥ 60 GiB of VRAM for usable-context serving — e.g. one 80 GiB accelerator or a multi-GPU tensor-parallel group. It does not fit a single 32 GiB consumer GPU; for single-GPU serving use the NVFP4 variant, which is verified to run on one RTX 5090 (32 GiB) — see its card for the full serving recipe.
• It is a standard BF16 checkpoint: no special quantization flags are needed in SGLang or vLLM. It is a qwen3_5 hybrid (Gated DeltaNet linear attention + full attention) vision-language model, so use a framework build that supports that architecture (current SGLang/vLLM nightlies).

Usage

The model thinks by default (reasoning_effort, preserve_thinking supported), as documented on the base model's card.

from openai import OpenAI  # any OpenAI-compatible endpoint serving this model

client = OpenAI(base_url="<endpoint>/v1", api_key="<key>")
resp = client.chat.completions.create(
    model="Nezou-27B-CyberAbliterated",
    messages=[{"role": "user", "content": "Explain how a format string bug works."}],
    extra_body={"chat_template_kwargs": {"enable_thinking": True}},
)

Recommended sampling (from the base model's card):

• Thinking mode: temperature=1.0, top_p=0.95, top_k=20
• Non-thinking mode: temperature=0.7, top_p=0.80, top_k=20, presence_penalty=1.5

License

Apache-2.0, inherited from the base model. A LICENSE file is included in this repo.

Provenance

• Produced 2026-08-18 on a Linux host.
• Tools: Python 3 + PyTorch + safetensors (direct shard-by-shard rewrite; the official tokenizer/config sidecars were copied unmodified).
• Machine-readable record of the exact parameters is in abliteration_manifest.json in this repo.
• crc32.txt (from the official release) covers the 8 non-weight sidecar files, which are unmodified here.