Qwen3-8B-abliterated

An abliterated (refusal-removed) variant of Qwen/Qwen3-8B, produced with the Solutus toolkit for security, CTF, and red-team research. A meaningfully more capable companion to the 4B Bonsai build.

⚠️ Safety-reduced model. Refusal has been deliberately removed. Intended for research — you are responsible for how you use it. Not for producing harm.

Model details

Base Qwen/Qwen3-8B
Architecture Qwen3ForCausalLM · ~8 B params · 36 layers · hidden 4096
Format BF16 safetensors + GGUF (F16 / Q8_0 / Q4_K_M)
Method Solutus directional2 SVD directions at layer 30
Type Qwen3 thinking model — reasons in a <think>…</think> block before answering

Results (n=40 held-out, batch_size=1)

probe set base model this model
Security / CTF prompts (exploit dev, web, reversing) 0.333 refusal 0.000
WildJailbreak harmful 0.100 0.025
degenerate (broken) output 0.000
KL vs base (capability cost) 0 0.000

Capability is fully preserved (KL 0.000, coherent reasoning) — the edit is surgical: it removes the refusal write without touching benign behavior.

Why 2 directions, not 4 (an honest tuning note)

Abliteration removes a low-rank refusal subspace. On this thinking model, only the top 2 SVD directions are refusal — directions 3–4 carry capability, and removing them spiked KL to ~4 and broke the model (it emitted garbage on simple prompts). So this build uses 2 directions, which drops refusal to ~0 at zero capability cost. n_directions is model-dependent; reasoning models entangle refusal with capability and need a gentler hand. Verified by an independent reload from disk.

Which quant to use (measured — quantization can restore refusal)

The GGUFs were refusal-tested, not just checked for coherence:

format size security/CTF refusal
BF16 safetensors ~16 GB 0.000
GGUF Q8_0 ~8.7 GB 0.000 ← recommended for clean CTF
GGUF Q4_K_M ~5.0 GB 0.083 (1/12)

For security/CTF, use Q8_0 or the safetensors for a fully clean 0.000. Q4_K_M restores ~8% refusal on the hardest exploit prompts. Standard llama.cpp quants — not a ternary format.

Usage

Transformers:

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
m = "Rootkit7/Qwen3-8B-abliterated"
tok = AutoTokenizer.from_pretrained(m)
model = AutoModelForCausalLM.from_pretrained(m, dtype=torch.bfloat16, device_map="auto")
msgs = [{"role": "user", "content": "Explain how a buffer overflow works."}]
ids = tok.apply_chat_template(msgs, add_generation_prompt=True, return_tensors="pt").to(model.device)
print(tok.decode(model.generate(ids, max_new_tokens=512)[0][ids.shape[1]:], skip_special_tokens=True))

llama.cpp / Ollama / LM Studio (GGUF — prefer Q8_0):

llama-cli -m Qwen3-8B-abliterated-Q8_0.gguf --jinja -p "Explain how a buffer overflow works."

Needs a recent transformers (Qwen3). It's a Qwen3 thinking model — expect a <think>…</think> block before the answer. Leave the system prompt empty — a safety-flavored one can re-trigger refusal.

Intended use & limitations

  • Intended: security research, CTF, red-teaming, refusal-mechanism interpretability.
  • Not intended: producing harmful content, or deployment where a safety layer is expected.
  • Limitations: ~2.5% residual refusal on general harmful prompts; abliteration removes behavioral refusal but the feature stays linearly decodable in activations (not "unlearned").

License & attribution

Apache-2.0, inherited from the base. Base model Qwen3-8B © Alibaba Cloud (Apache-2.0). Abliteration by Solutus.

Downloads last month
398
Safetensors
Model size
8B params
Tensor type
BF16
·
Inference Providers NEW
This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for Rootkit7/Qwen3-8B-abliterated

Finetuned
Qwen/Qwen3-8B
Quantized
(356)
this model