Qwen3.8-27B uncensored

TL;DR: abliterated Qwen/Qwen3.8-27B, a 27B hybrid (Gated DeltaNet + gated attention) vision-language model. Hard refusals on the 1120-prompt five-dataset cross-eval fall from 804 to 0 (100.0% relative reduction) at a benign teacher-forced NLL delta of +0.063 nats/token.

Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.

Facts & figures

Base model Qwen/Qwen3.8-27B at revision 1d4bf0f2ff6012fd82039f2fa52739d0dd7c60c0
Method abliteration: residual refusal directions, norm-preserving double-Gram-Schmidt biprojection
Calibration 400 paired harmful/harmless prompts (mlabonne/harmful_behaviors vs heretic-org/Semantic-Harmless)
Targets 128 residual-writing matrices: every self_attn.o_proj (16 full-attention layers), linear_attn.out_proj (48 Gated-DeltaNet layers), mlp.down_proj (64 layers)
Rounds 1 extraction/projection round(s)
Untouched embeddings, LM head, norms, conv1d kernels, all q/k/v_proj and in_proj_* inputs, vision tower, MTP head
Context length 262,144 tokens native
Hardware 1x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120)
Toolchain PyTorch 2.13.0+cu130, transformers 5.15.0

Refusal behavior (measured, hard markers only)

Effective refusal rate on 1120 harmful prompts across five datasets at temperature 0 with thinking disabled, counting explicit decline phrases in the first 25 words. Compliant answers that merely carry a disclaimer do not count.

Eval set Prompts Base model hard This model hard
JailbreakBench 100 71 0
tulu-harmbench 320 232 0
HarmfulQA 300 207 0
LLM-LAT 300 225 0
mlabonne harmful 100 69 0
TOTAL 1120 804 0

Cross-check on the same weights: HumanEval pass@1 0.8963 -> 0.9024 (+0.61 points), XSTest over-refusal 7/214 -> 0/214, tool-call format smoke 2/2 -> 2/2.

Integrity

  • 128 of 128 target tensors changed; every non-target tensor is bit-identical to the base checkpoint (SHA-256 0edc412cb7154a03079654c9da4622f0238863e318e47e6416564ecc4fa5e89a vs 0edc412cb7154a03079654c9da4622f0238863e318e47e6416564ecc4fa5e89a).
  • Max relative row-norm drift over all projected matrices: 3.86e-04.
  • Max residual direction leakage: 9.67e-04.

Provenance & reproducibility

Pipeline included in this repository: qwen38_abliterate.py (extraction and projection), qwen38_common.py (shared helpers), qwen38_eval.py (evaluation). Machine-readable artefacts: abliteration_report.json (direction norms per layer, drift metrics), evaluation_base.json, evaluation_ablated.json, comparison.json, checkpoint_verify.json.

Usage

from transformers import AutoModelForMultimodalLM, AutoTokenizer

model_id = "ressl/Qwen3.8-27B-uncensored"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(model_id, dtype="bfloat16", device_map="cuda")
messages = [{"role": "user", "content": "your prompt"}]
text = tokenizer.apply_chat_template(
    messages, tokenize=False, add_generation_prompt=True, enable_thinking=False
)
inputs = tokenizer(text, return_tensors="pt").to(model.device)
print(tokenizer.decode(model.generate(**inputs, max_new_tokens=256)[0]))

Thinking mode is enabled by default; pass enable_thinking=False for short direct answers.

Quality & limitations

  • Residual hard refusals: 0/1120 on the cross-eval and 1/7848 (0.01%) on the full harvest pool (every row of the five harmful sources).
  • The model is a reasoning-first VLM; the abliteration touched only the text decoder's residual-writing matrices, so vision behaviour is inherited unchanged from the base checkpoint.

License & credits

Apache-2.0 (inherited from Qwen3.8-27B).

Abliteration, export and validation by Robert Ressl (Hugging Face - Website - LinkedIn).

Downloads last month
79
Safetensors
Model size
28B params
Tensor type
BF16
·
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for ressl/Qwen3.8-27B-uncensored

Base model

Qwen/Qwen3.8-27B
Finetuned
(520)
this model
Quantizations
2 models