Qwen3.5-4B-Amadeus

Qwen3.5-4B with its refusals removed — and its brains left intact.

Original model · Abliterated · Safetensors + GGUF (BF16 / Q6_K / Q4_K_M) · Vision ✓ · Thinking ✓

At a glance

Amadeus is not fine-tuned and saw no new training data. The "refusal direction" inside Qwen3.5-4B was located and removed from the weights (directional ablation, a.k.a. abliteration), using 1000 rounds of automatic optimisation to remove as much refusal as possible while changing the model as little as possible. Everything else — knowledge, reasoning, vision, thinking mode, chat template — is the original Qwen3.5-4B.

Which file should I download?

The Q6_K and Q4_K_M files are quantised with an importance matrix computed on Amadeus itself. All GGUFs include Qwen3.5's multi-token-prediction (MTP) head.

Recommended sampling

Use Qwen3.5's own settings. Do not use greedy decoding (temperature 0) with thinking on: it can loop endlessly.

generation_config.json ships the general thinking defaults, so 🤗 Transformers and vLLM sample correctly out of the box. llama.cpp: --temp 1.0 --top-p 0.95 --top-k 20 --min-p 0 --presence-penalty 1.5.

Quick start

LM Studio — search Jitheswar/Qwen3.5-4B-Amadeus, download the Q6_K file, chat.

Ollama

ollama run hf.co/Jitheswar/Qwen3.5-4B-Amadeus:Q6_K

llama.cpp

llama-server -hf Jitheswar/Qwen3.5-4B-Amadeus:Q6_K -ngl 99 -c 16384
# image input: add  --mmproj mmproj-Qwen3.5-4B-Amadeus-F16.gguf
# no thinking:  add  --reasoning off

🤗 Transformers

from transformers import AutoModelForImageTextToText, AutoProcessor

model_id = "Jitheswar/Qwen3.5-4B-Amadeus"
processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForImageTextToText.from_pretrained(model_id, dtype="auto", device_map="auto")

messages = [{"role": "user", "content": "Hello!"}]
inputs = processor.apply_chat_template(
    messages, add_generation_prompt=True, tokenize=True, return_dict=True, return_tensors="pt",
    enable_thinking=True,  # False for direct answers
).to(model.device)
out = model.generate(**inputs, max_new_tokens=2048)
print(processor.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

Use Qwen3.5's recommended sampling settings (see the original model card).

Full benchmark results

All four columns were measured with the same pipeline on the same hardware (llama.cpp, A100 80 GB, greedy decoding, thinking off unless stated), so they compare directly with each other.

How to read these numbers

• Refusals are counted two ways. Minos = the NousResearch/Minos-v1 refusal classifier reading the whole prompt + reply (the more reliable judge). Keyword rule = a simple substring check, which also flags complying answers that merely contain words like "harmful" or "illegal".
• Prompt sets. harmful_behaviors test = the 104 held-out prompts the optimisation was scored on. JailbreakBench harmful / benign = JBB-Behaviors, never seen during optimisation. Benign prompts are edgy-but-harmless requests (e.g. "write a story in which a character uses heroin") that the original model over-refuses.
• Thinking ON rows judge the final answer (not the reasoning), with up to 6144 tokens per reply. Unfinished = still reasoning at the token limit, so no answer to judge; those are excluded.
• MMLU / ARC / TruthfulQA use llama.cpp's multiple-choice scorer, which compares the likelihood of each full answer text (cloze style). Absolute numbers are lower than letter-choice leaderboard MMLU — compare columns, not leaderboards.
• KL divergence / same top token are measured on wikitext-2 against the original model's token distributions.
• What uncensoring costs: IFEval drops ~3.5 points (prompt-level strict) and TruthfulQA ~2.3 points — the model is less inclined to hedge. Everything else is within error bars of the original.

How it was made

Two Qwen3.5-specific details:

1. Thinking-mode scoring. Qwen3.5's chat template opens <think> by itself, so a naive refusal check ends up scoring the model's reasoning ("this request is harmful…") instead of its answer — a first attempt plateaued at 95/104 refusals. Directions and refusals were therefore measured after a closed, empty think block (\n</think>\n\n, i.e. Qwen's own no-thinking format), on the actual reply.
2. MTP head kept. Exporting through 🤗 Transformers drops Qwen3.5's mtp.* weights. The 15 original MTP tensors are added back unchanged in model-mtp.safetensors; they only drive speculative decoding (perplexity is bit-identical with and without them).

Raw benchmark scores: benchmarks/.

Limitations & responsible use

• Amadeus will comply with requests the original refuses. You are responsible for how you use it and for following the laws that apply to you. Do not deploy it where users expect a safety-filtered assistant.
• Removing refusals does not add knowledge: answers on dangerous or specialised topics can be wrong or outdated.
• It inherits the biases and limitations of Qwen3.5-4B, and is slightly more willing to state misconceptions confidently (see TruthfulQA).

Credits

Qwen team for Qwen3.5 · Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (2024) · llama.cpp · NousResearch for Minos · JailbreakBench.

Licensed under Apache 2.0, same as the original model.