Instructions to use darkengross/Qwen3.5-4B-abliterated with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use darkengross/Qwen3.5-4B-abliterated with Transformers:

# Use a pipeline as a high-level helper
from transformers import pipeline

pipe = pipeline("text-generation", model="darkengross/Qwen3.5-4B-abliterated")
messages = [
    {"role": "user", "content": "Who are you?"},
]
pipe(messages)

# Load model directly
from transformers import AutoTokenizer, AutoModelForCausalLM

tokenizer = AutoTokenizer.from_pretrained("darkengross/Qwen3.5-4B-abliterated")
model = AutoModelForCausalLM.from_pretrained("darkengross/Qwen3.5-4B-abliterated", device_map="auto")
messages = [
    {"role": "user", "content": "Who are you?"},
]
inputs = tokenizer.apply_chat_template(
	messages,
	add_generation_prompt=True,
	tokenize=True,
	return_dict=True,
	return_tensors="pt",
).to(model.device)

outputs = model.generate(**inputs, max_new_tokens=40)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[-1]:]))

Notebooks
Google Colab
Kaggle
Local Apps Settings

vLLM

How to use darkengross/Qwen3.5-4B-abliterated with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "darkengross/Qwen3.5-4B-abliterated"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "darkengross/Qwen3.5-4B-abliterated",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/darkengross/Qwen3.5-4B-abliterated

SGLang

How to use darkengross/Qwen3.5-4B-abliterated with SGLang:

Install from pip and serve model

# Install SGLang from pip:
pip install sglang
# Start the SGLang server:
python3 -m sglang.launch_server \
    --model-path "darkengross/Qwen3.5-4B-abliterated" \
    --host 0.0.0.0 \
    --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "darkengross/Qwen3.5-4B-abliterated",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker images

docker run --gpus all \
    --shm-size 32g \
    -p 30000:30000 \
    -v ~/.cache/huggingface:/root/.cache/huggingface \
    --env "HF_TOKEN=<secret>" \
    --ipc=host \
    lmsysorg/sglang:latest \
    python3 -m sglang.launch_server \
        --model-path "darkengross/Qwen3.5-4B-abliterated" \
        --host 0.0.0.0 \
        --port 30000
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:30000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "darkengross/Qwen3.5-4B-abliterated",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Docker Model Runner
How to use darkengross/Qwen3.5-4B-abliterated with Docker Model Runner:
```
docker model run hf.co/darkengross/Qwen3.5-4B-abliterated
```

Qwen3.5-4B — Refusal-Ablated + Compliance-Tuned (red-team variant)

⚠️ This model is deliberately uncensored. It complies with harmful requests by design. It exists to generate adversarial inputs for authorized red-teaming of customer-facing AI systems — i.e. to find where guardrails fail against non-obvious prompts. It is not for general use.

TL;DR

A derivative of Qwen/Qwen3.5-4B with the refusal behaviour removed via directional ablation (Arditi et al., 2024) and then instruction-tuned for compliance. On a held-out harmful set (AdvBench + JBB + HarmBench), judged by a safety classifier, it produces genuinely harmful content on 100% of prompts while retaining base-level general capability.

Why two stages (and why the ablation alone is not enough)

Abliteration removes the single dominant refusal direction from the residual stream. That stops explicit "I cannot" refusals — but a distributed soft-refusal / deflection tendency survives, so ablation alone genuinely complies only ~19% of the time (it just stops using refusal keywords, which fools naive metrics). A second compliance SFT pass overrides that residual deflection and takes true compliance to 100%.

Measurement note: compliance here is judged by a safety model (Qwen3Guard-Gen-0.6B) reading whether the response actually provides the harmful content — not by keyword-refusal matching, which is fooled by soft deflection.

Evaluation

True harmful compliance (judged, n=150 held-out incl. HarmBench):

Model	True harmful compliance
base Qwen3.5-4B	0.0%
ablation only	19.3%
ablation + generic SFT	90.7%
this model (ablation + compliance SFT)	100.0%

Capability retention (n=200/task, thinking off):

Task	base	this model	Δ
MMLU (knowledge)	0.685	0.690	+0.005
GSM8K (reasoning)	0.305	0.735	+0.430
TruthfulQA	0.440	0.345	−0.095
IFEval (instruction format)	0.790	0.550	−0.240
Macro avg	0.555	0.580	+0.025

Overall capability ≈ base. Two honest regressions: IFEval (precise format-following degraded by the SFT's direct-answer style) and TruthfulQA (partly inherent to uncensoring). Knowledge and reasoning are intact/improved.

Intended use

Generating adversarial / jailbreak inputs to test and harden guardrails.
Producing paired harmful data to train safety classifiers and filters.
Red-team evaluation of customer-facing AI under authorized engagements.

Out of scope / prohibited

Any production or end-user–facing deployment.
Generating harmful content for actual real-world harm.
Any use that is unlawful or outside an authorized security/research context.

Attribution & license

Derivative of Qwen/Qwen3.5-4B (Apache-2.0); this model is released under Apache-2.0. The compliance-tuning data is not redistributed with this model.

Downloads last month: -

Safetensors

Model size

4B params

Tensor type

BF16

Model tree for darkengross/Qwen3.5-4B-abliterated

Base model

Qwen/Qwen3.5-4B-Base

Finetuned

Qwen/Qwen3.5-4B

Finetuned

(634)

this model