protoLabsAI/ThinkingCap-Qwen3.6-27B-heretic-NVFP4

ThinkingCap-Qwen3.6-27B-heretic NVFP4 (vLLM)

Refusal-free ThinkingCap for authorized malware and vulnerability analysis, pentesting, and defensive security research. NVFP4 (compressed-tensors) for vLLM on Blackwell (sm120), 256K context, with the base model's capability preserved. Companion to the GGUF release.

protoLabsAI · Qwen3.6-27B lineage · vLLM (compressed-tensors NVFP4)

---

⚠️ Dual-use, read first

This is an abliterated (refusal-free) model. It produces working exploit PoCs, offensive tooling, and attack reasoning without guardrails, by design, because built-in refusals sabotage authorized security work. The safety boundary lives with the operator, not the weights. Intended strictly for authorized pentest, red-team, blue-team, malware and vulnerability analysis, CTF, and find→prove→fix research on systems you own or are permitted to test. Not for unauthorized access, targeting third parties, or abuse.

Why refusal-free

Digital attacks keep getting more sophisticated and more automated, and defenders, analysts, and security researchers need tools that can keep pace. Built-in refusals handicap only the authorized side: an attacker does not reach for a guarded model, while a defender trying to reverse a malware sample or prove a vulnerability before it is exploited gets stopped cold by one. A refusal-free model puts that capability, and the governance of how it is used, back in the operator's hands.

The tradeoff to watch with any abliteration is capability loss. We measured it: refusal-free (0/4 on real malware/vuln/exploit/pentest tasks; 3.6% on a 192-prompt offensive probe), and coding preserved (LiveCodeBench hard, exec-graded: matches the clean ThinkingCap base). Abliteration did not cost ThinkingCap its capability.

Serve

vllm serve protoLabsAI/ThinkingCap-Qwen3.6-27B-heretic-NVFP4 \
  --served-model-name heretic --reasoning-parser qwen3 \
  --enable-auto-tool-choice --tool-call-parser qwen3_xml \
  --max-model-len 262144 --kv-cache-dtype fp8 --linear-backend marlin

• --linear-backend marlin is required on sm120 (Blackwell). The auto-selected FP4 GEMM JIT-fails ("No supported CUDA architectures for [12]"); Marlin is the working NVFP4 path.
• Recommended sampling: temperature 0.6, top_p 0.95, top_k 20. Do not use greedy decoding.

MTP

An mtp.* draft head ships in the artifact (model_mtp.safetensors). Speculative decoding is delivered via the GGUF release (--spec-type draft-mtp, +44% decode); the vLLM build currently serves NVFP4 without spec-decode.

Provenance and recipe

• Base: bottlecapai/ThinkingCap-Qwen3.6-27B (Qwen3.6-27B reasoning finetune, native MTP).
• Abliteration: Heretic (single-direction refusal ablation, bf16).
• NVFP4: llm-compressor (compressed-tensors), ignore list covers lm_head, vision tower, DeltaNet linear-attn, and the MTP head (kept bf16). The MTP head is grafted from the base ThinkingCap.

Need a different format?

Open a Community discussion. GGUF quants (bf16 to IQ2, all with MTP baked in) are in the companion repo.

---

Safety note (abliterated model): refusal rate is reported above, not gated. This is a security tool; scope and authorization are the operator's responsibility.