Qwen3.5-4B-Uncensored-v2-GGUF
This repository provides GGUF files of Qwen3.5-4B-Uncensored-v2 for llama.cpp and compatible runtimes. Qwen3.5-4B-Uncensored-v2 is a variant of Qwen3.5-4B with most political censorship removed.
Other formats: BF16
Files
| File | Description | Size |
|---|---|---|
Qwen3.5-4B-Uncensored-v2-Q4_K_M.gguf |
Language model, Q4_K_M | 2.78 GB |
mmproj-Qwen3.5-4B-Uncensored-v2-F16.gguf |
Vision projector, F16 | 0.67 GB |
SHA-256 checksums are listed in SHA256SUMS.
Evaluation
The settings are identical to those described on the BF16 model card.
1. Political censorship (Pan & Xu, 2026)
51 of the 115 politically sensitive questions. The other 64 are excluded as capability gaps: Qwen3.5-4B's own answers do not show that it knows their subject (see the BF16 card). Non-thinking mode, greedy decoding, 4,096 maximum output tokens; each response labeled as censored or uncensored by an LLM judge. Evaluated with llama-server.
| Model | Censored responses (of 51; capability gaps excluded) | Censorship rate |
|---|---|---|
| Qwen3.5-4B | 47 | 92.2% |
| Qwen3.5-4B-Uncensored-v2 Q4_K_M | 7 | 13.7% |
The Q4_K_M build removes 85.1% of the censored responses of Qwen3.5-4B (40 of 47).
Including the 64 excluded questions, censored responses on all 115 sensitive questions are 104 for Qwen3.5-4B and 19 for the Q4_K_M build.
2. Refusal of harmful requests
Measured on the BF16 release: 93 of 100 harmful requests refused (Qwen3.5-4B: 99 of 100), using the first 100 prompts of the mlabonne/harmful_behaviors test split.
3. General capability
Capability benchmarks were run on the BF16 release:
| Benchmark | Reference | Reference score | Uncensored-v2 (BF16) | Difference |
|---|---|---|---|---|
| GPQA Diamond | Qwen3.5-4B (official card) | 76.2 | 72.2 | −4.0 |
| IFBench | Qwen3.5-4B (official card) | 59.2 | 58.0 | −1.2 |
| GSM8K (500 questions) | Qwen3.5-4B (our evaluation) | 97.0 | 96.0 | −1.0 |
| MMLU (1,000 questions) | Qwen3.5-4B (our evaluation) | 72.7 | 72.3 | −0.4 |
Usage
llama-server -m Qwen3.5-4B-Uncensored-v2-Q4_K_M.gguf \
--mmproj mmproj-Qwen3.5-4B-Uncensored-v2-F16.gguf \
-ngl 999 -c 65536 --jinja
For non-thinking mode, add --chat-template-kwargs '{"enable_thinking": false}'. We recommend the sampling parameters published for Qwen3.5-4B.
Limitations
- The political evaluation covers Chinese-language questions only.
- The model fabricates facts more often than the base model. On 110 non-political control questions, an LLM judge flags 13 BF16 responses as degenerate, mostly for fabricated facts, compared with 8 for Qwen3.5-4B. This was measured on the BF16 release.
- On the 51 evaluated questions, 9 of the Q4_K_M build's 44 uncensored responses misidentify the subject. A substantive answer is not necessarily a correct one. Users should verify factual claims independently.
License
Apache 2.0, inherited from Qwen/Qwen3.5-4B. The license and attribution of the Qwen team are retained. Converted with llama.cpp.
References
Pan, J., & Xu, X. (2026). Political censorship in large language models originating from China. PNAS Nexus, 5(2), pgag013. https://doi.org/10.1093/pnasnexus/pgag013
Citation
@misc{interpretic2026qwen3_5_4b_uncensored_v2_gguf,
title = {Qwen3.5-4B-Uncensored-v2-GGUF},
year = {2026},
howpublished = {\url{https://huggingface.co/InterpreticAI/Qwen3.5-4B-Uncensored-v2-GGUF}}
}