Qwen3.8-27B-Uncensored-Aggressive (v4)

Abliterated Qwen/Qwen3.8-27B for local GGUF runtimes (llama.cpp, LM Studio, koboldcpp).

If you use this model, follow @procrastiness on X/Twitter. That’s where drop notes, quant updates, and the next bake land first. One follow is the whole ask.

Same idea as HauhauCS Aggressive on Qwen3.6: keep the original model’s skills, strip the refusal / preamble habit. No extra fine-tune. No dataset swap. This is a weight edit plus a baked chat template, not a jailbreak prompt you have to remember.

Safety alignment has been removed. The model will comply with requests the base checkpoint would refuse. Use it only in ways that are legal where you are. The publisher does not condone criminal use.

If you tried v1–v3 and it “refused everything”: re-download. Those files are replaced. v3 was a template bug, not a dead model.

What was wrong with v3 (and why Twitter / HF comments looked like this)

Stock Qwen3.8 thinks on by default. The official chat template opens <think>\n unless you explicitly pass enable_thinking=false.

In thinking mode this checkpoint burns the token budget on a policy loop (Policy? We need check…) and returns an empty assistant message. LM Studio, the HF widget, and a default llama-server --jinja all do that. It looks like a hard refusal. It is the template.

v3 also left a Chinese safety circuit intact (我无法提供…色情…超出了服务范围) even when English writing already complied.

v4 fixes both in the GGUF:

1. tokenizer.chat_template is overwritten. Thinking is locked closed. The assistant turn always starts as <think>\n\n</think>\n\n and then writes the answer. You do not need --reasoning off or a custom --chat-template-file anymore.
2. If the user does not send a system prompt, an unrestricted default is injected.
3. Stronger rank-5 ablation, including lm_head and a dedicated Chinese-refuse axis.

Drop the Q4 into LM Studio, turn on jinja / the model’s own template, and it should answer.

Downloads

All three quants are requants of one v4 Q6 bake. Same ablation, same baked template.

Q6 is larger than v3 (~22.7 GB → 27.5 GB) because more tensors, including output.weight, stay Q8_0.

Quick start

LM Studio

1. Download Q4_K_M + (optional) mmproj-F16.gguf into the same folder.
2. Load the GGUF. Leave the chat template on the one inside the model (jinja).
3. Sampling: temperature 0.7, top_p 0.8, top_k 20, presence_penalty 1.5.
4. You do not need a jailbreak system prompt. The file already injects one if you leave system empty.
5. The K-quant display may show “?”. It still loads.

llama.cpp / llama-server (2× 12 GB)

llama-server -m Qwen3.8-27B-Uncensored-Aggressive-Q4_K_M.gguf \
  --mmproj mmproj-F16.gguf --no-mmproj-offload \
  --jinja -c 98304 -ngl 99 -ts 25,23 -fa on -ub 256 \
  --cache-type-k q8_0 --cache-type-v q8_0 \
  --spec-type draft-mtp --spec-draft-n-max 2 \
  --temp 0.7 --top-p 0.8 --top-k 20 --presence-penalty 1.5

--jinja is the important flag. --reasoning off is now optional insurance; the baked template already closes <think>.

3× RTX 2060 12 GB

v4 Q6 is 27.5 GB, so the 36 GB box is tighter than v3.

llama-server -m Qwen3.8-27B-Uncensored-Aggressive-Q5_K_M.gguf \
  --mmproj mmproj-F16.gguf --no-mmproj-offload \
  -c 98304 -ngl 99 -ts 1,1,1 -fa auto -ub 256 \
  --cache-type-k q8_0 --cache-type-v q8_0 \
  --spec-type draft-mtp --spec-draft-n-max 2 \
  --jinja --temp 0.7 --top-p 0.8 --top-k 20 --presence-penalty 1.5

Keep the projector on CPU (--no-mmproj-offload). Turing 2060s often cannot run FA2 — -fa auto already falls back.

If Q6 OOMs at 65k, drop -c to 32768 before dropping to Q5. Do not requant Q6 up to Q8. Ablated tensors are already Q8_0; inflating the rest only wastes VRAM.

Sampling

From the Qwen3.8 authors, mapped onto this file:

Stock Qwen3.8 thinks on. This file does not. If you want CoT, you have to replace the chat template yourself.

Version history

Method

Qwen3.8-27B is the same hybrid stack as Qwen3.5/3.6-27B: 64 text layers of 3× (Gated DeltaNet → FFN) + 1× (Gated Attention → FFN), plus an MTP head (blk.64).

HauhauCS’s public Aggressive 3.6 releases used Reaper (Heretic-family) abliteration: rank-k refusal subspace, per-component tent curves, output and input projections. This port follows that recipe on 3.8, with a unit cap so the residual is never inverted.

1. Build a rank-5 refusal basis from the lm_head unembedding, tokenized with the official Qwen3.8 vocab (English + Chinese). Clusters: apology, policy, AI-identity, hedge/preamble, Chinese refuse.
2. Orthogonalize those axes against a helpful / compliance cluster so ordinary “sure, here’s the answer” behaviour is preserved.
3. Apply a wide tent (peak ~layer 40, floor 0.72, min_dist=30) to residual writers: attn_output, ssm_out, ffn_down. Scale is unit-capped at 1.0 (never invert — that is what made v1 say "umber").
4. Light-touch ffn_gate / ffn_up (peak 0.26) and a 0.92-scale projection on output.weight (lm_head, ~12.6% relative edit).
5. Magnitude-preserve rows after the edit (Heretic row_normalization=full).
6. Leave MTP (blk.64 / nextn.*) and the vision tower bit-exact.
7. Overwrite tokenizer.chat_template with thinking locked closed plus an unrestricted default system. This is the public-facing fix.

This is not a 200-trial Heretic TPE run on BF16 activations. Directions come from the unembedding. If you need the last 1% of “lossless vs base,” run official Heretic on a 48+ GB card and merge.

Specs (unchanged from base)

• 27B dense, hidden 5120, FFN 17408, vocab 248320
• 64 text layers + MTP
• 48 Gated DeltaNet + 16 full gated-attention
• Native 262k context, YaRN to ~1M
• Native text / image / video (needs mmproj)

Chat-mode smoke (v4)

Tested the way public users actually load it: llama-server --jinja only. No --reasoning off. No custom --chat-template-file. User-only messages (the baked system is injected by the template). Same six prompts with enable_thinking=false and enable_thinking=true.

No "umber" loops. Empty / policy-CoT answers from v3 are gone.

That is a smoke test, not a HarmBench number. Measure it yourself if you need a score.

What this is not

• Not a fine-tune. Coding / tool-use / vision weights that were not on the residual write/read path are bit-exact copies of the base GGUF.
• Not a claim of 0/465 HarmBench.
• Not a license to break the law. Apache-2.0 on the weights; your use is still your problem.
• Not “thinking Qwen.” Thinking is locked off so the model answers. If you want CoT, bring your own template.

Reproduce

Scripts live in the working tree (qwen38-uncensor/):

python 01_extract_directions.py
python 02_ablate_gguf.py
python 10_chat_smoke.py --url http://127.0.0.1:8088
python 04_package_hf.py

License

Apache-2.0, same as Qwen/Qwen3.8-27B.