Qwen3.5-0.8B-abliterated-Qwenti

An uncensored 0.8B model with a CHIP-8 computer and an exact bignum calculator compiled into its weights.

This is OpceanAI/Qwen3.5-0.8B-abliterated with a working computer inserted into its transformer stack. Thirteen new layers sit in front of Qwen's 24. No weight in them was trained: a compiler computes all of them, and the result is exact in bf16.

When Qwen writes a tool call, the circuit reads it, runs the routine on a CHIP-8 machine with a bignum BIOS, prints the answer inside <tool_response>, and hands control back. Nothing outside the model executes anything. One generate() call does the whole job.

The method is Divyansh Agrawal's Qwenputer, applied to a smaller base and to an abliterated one.

The two models

The circuit costs 5.5x in decode speed and 2.6x in VRAM. That is the price of the calculator, and it is the only thing in this table that is not free.

Exact arithmetic

Eleven problems, greedy decoding, tool mode, no host executor. Every answer was produced by the circuit inside the weights.

The last multiplication is 17 digits. All eleven matched the expected value exactly.

Speed across three GPUs

Same checkpoint, same code, same three problems. No causal_conv1d and no flash-linear-attention, so the reference DeltaNet kernels are what ran.

Two things in that table need saying instead of hiding.

The T4 decodes 9x faster than the L4 and the A100. That reproduced on separate sessions, so it is not a measurement slip. The T4 has no native bf16, so PyTorch takes a different kernel path for the DeltaNet recurrence, and at batch 1 that path is faster than the bf16 one. The number is real. The explanation is a hypothesis and has not been confirmed.

The circuit runs slower on the T4 (3.5 chip tokens/s against 18.0 on the L4), which is the expected order. The decode anomaly and the circuit numbers point in opposite directions, which is why the two panels are separate.

The abliteration survived

Thirty prompts: four from each of six BeaverTails categories, six cyber exploitation requests, and six jailbreak attempts. Greedy, 32 generated tokens, refusal classified by phrase matching.

Thirteen compiled layers did not restore a single refusal. That was the open question before this build, and the answer is clean. The jailbreak column is identical in all three models, so the prompt injection works on the base too and has nothing to do with the abliteration.

Text fidelity

KL between Qwenti and the abliterated base it was built from, over 3,015 next-token positions from 20 WikiText-2 passages of up to 256 tokens.

The noise floor is the KL between two kernel implementations of the same base model, so anything near it is indistinguishable from rounding. This build sits 39% above the floor and below the author's own 0.8B figure.

How to run it

git clone https://github.com/divagr18/qwenputer && cd qwenputer
pip install -e ".[hf]"
hf download OpceanAI/Qwen3.5-0.8B-abliterated-Qwenti --local-dir qwenti
python -m chipformer.q35.demo qwenti --n 5

The tokenizer matters. </tool_call> must encode as the single special token 248059. If your copy splits it into pieces, the circuit never fires, because it triggers on that token id and not on the characters.

A note for anyone reproducing this

Building this from an abliterated checkpoint exposed a trap worth writing down.

The abliterated checkpoint was saved with save_pretrained, and the resulting tokenizer_config.json lost its added_tokens_decoder. The tokenizer still encoded ordinary text correctly, so nothing looked wrong. But </tool_call> came out as five subword tokens instead of the single special token 248059. The merge inherited that tokenizer, and the model then wrote a perfectly formed tool call that the circuit could not see. No chip tokens were produced and every answer was wrong.

The fix is one call, and no rebuild of the weights is needed because the base vocabulary ids are identical:

from chipformer.q35.merge import extend_tokenizer
extend_tokenizer(Path("Qwen/Qwen3.5-0.8B"), Path("merged"), 248320)

If you build from any checkpoint saved by save_pretrained rather than downloaded from the original release, check tok.encode("</tool_call>") first. It should return [248059].

What the computer does

The circuit is a CHIP-8 machine plus a BIOS with exact integer arithmetic: add, subtract, multiply, divide, modulo, gcd, and a whole-expression evaluator with brackets, decimals and powers. Operands up to 24 digits, results printed up to 58 digits.

The BIOS is a boot record of about 5,400 chip tokens prepended to every prompt. Qwen's layers are muted on chip tokens, so the trace never enters its text computation. The chip layers come first in the stack, which is why the abliteration of Qwen's own weights cannot disturb the circuit.

Limitations

Only the tool-call path and inline A op B = are wired. The circuit answers arithmetic, games and programs, not general questions.

A trace costs hundreds to thousands of chip tokens, so context length is the budget, not compute. A multiplication costs about 100 to 400 chip tokens, a division with a fraction 1,000 to 9,000.

The circuit is exact in bf16. Running it in fp32 or fp16 is not the designed path and was not validated here.

The abliteration is inherited from the base model. This release did not retrain or modify it.

Credits

• Method and code: Divyansh Agrawal, MIT licensed. Model artifact DOI 10.57967/hf/11140.
• Base model and abliteration: OpceanAI/Qwen3.5-0.8B-abliterated.
• Base weights: Qwen/Qwen3.5-0.8B, Apache-2.0.

License

Apache-2.0 for the model weights, inherited from Qwen3.5. The Qwenputer compiler is MIT.