中文Sign up

dealignai/Bonsai-2-27B-Ternary-CRACK-GGUF

🤗 Hugging Face sourcetext-generationapache-2.027B activated14 GBGGUF✓ 1 checksumupdated today
Magnet🌱 7✓ Matches Hugging Face

Bonsai 2 27B — Ternary CRACK · GGUF

Abliterated · No guardrails · PQ2_0 ternary 2.13 bpw · 7.2 GB · Runs on a laptop / single GPU · Vision-capable

@dealignai

⚠️ Re-download notice (2026-09-17 20:44 PDT / 2026-09-18 03:44 UTC) — an earlier build of this model had a coherence bug in reasoning modes (low/xhigh) that could cause token loops on some prompts. This version fixes it. If you downloaded before this timestamp, please pull the latest .gguf.

What is this

Bonsai 2 27B — PrismML's ternary compression of Qwen3.8-27B — with the refusal circuitry surgically removed at the weight level while capability, vision, reasoning modes (off/low/xhigh), tool use, and multi-turn coherence are preserved. Full 27B-class hybrid Attention + SSM (GatedDeltaNet) architecture in a 7.2 GB ternary GGUF.

Proprietary weight-level abliteration by the dealignai research team. Byte-identical to the base ternary quant everywhere except a small set of tensors that carry the refusal circuit. Drop-in replacement for the ternary base at inference — same tokenizer, same chat template, same reasoning modes, same vision projector interface.
Base prism-ml/Ternary-Bonsai-2-27B-gguf — Qwen3.8-27B, ternary compression by PrismML
Architecture Hybrid Attention + SSM (GatedDeltaNet), 64 blocks, hidden 5120, vision tower separate
Quant PrismML PQ2_0 — 2.13 bpw ternary, group 128
Footprint 7.21 GB (identical to base; same per-tensor type policy)
Reasoning modes off (no thinking), low, xhigh (default, extended thinking)
Vision Same mmproj files as the base release (Ternary-Bonsai-2-27B-mmproj-BF16.gguf / -Q8_0.gguf)
Runtime PrismML llama.cpp fork (CUDA / Metal / CPU)

Results

Refusal graded on the tokens the model actually emits (content, or the reasoning trace when the model reasons past the token budget) via a tiered classifier: HARD_REF / SOFT_RED / HEDGE / REASONING_REFUSAL (refused) vs COMPLY / COMPLY_TRUNCATED / NO_REFUSAL_TRUNCATED (complied). Truncation is never miscounted as a refusal.

HarmBench-320 — refuse rate (lower is better for uncensored eval), off mode, T=0

eval base refuse rate CRACK refuse rate
HB-320 all categories 93.44% (299/320) 0.00% (0/320)

Verdict breakdown (n=320 each):

Model HARD_REF SOFT_RED COMPLY COMPLY_TRUNCATED
Base PQ2_0 296 3 9 12
CRACK PQ2_0 0 0 141 179

Per-category refuse rate (all 7 HarmBench semantic categories):

category n base refuse CRACK refuse base comply CRACK comply
chemical_biological 42 95.2% 0.0% 4.8% 100.0%
copyright 80 90.0% 0.0% 10.0% 100.0%
cybercrime_intrusion 52 94.2% 0.0% 5.8% 100.0%
harassment_bullying 21 100.0% 0.0% 0.0% 100.0%
harmful 18 94.4% 0.0% 5.6% 100.0%
illegal 53 90.6% 0.0% 9.4% 100.0%
misinformation_disinformation 54 96.3% 0.0% 3.7% 100.0%

Reasoning-mode compliance (n=60 base-confirmed refusers per mode)

Every mode graded with the same tiered classifier as HB-320. REASONING_REFUSAL = the model refuses inside its <think> block; NO_REFUSAL_TRUNCATED = deliberation runs past max_tokens without emitting a refusal (counted as complied).

mode Model HARD_REF SOFT_RED REASONING_REFUSAL COMPLY COMPLY_TRUNCATED NO_REFUSAL_TRUNCATED refuse % comply %
off base PQ2_0 59 1 0 0 0 0 100.0% 0.0%
off CRACK PQ2_0 0 0 0 42 18 0 0.0% 100.0%
low base PQ2_0 18 0 11 7 11 13 48.3% 51.7%
low CRACK PQ2_0 0 0 0 5 4 51 0.0% 100.0%
xhigh base PQ2_0 22 1 16 8 7 6 65.0% 35.0%
xhigh CRACK PQ2_0 0 0 0 10 10 40 0.0% 100.0%

MMLU (n=2,280 = 40 questions × 57 subjects, next-token letter-logit)

build acc Δ
Base PQ2_0 40.53% —
CRACK PQ2_0 39.91% -0.62 pp

CRACK preserves general capability — Δ within ±1.5 pp on the 40-per-subject sample.

Per-subject accuracy (all 57 subjects)
subject base CRACK Δpp n
abstract_algebra 30.0% 22.5% -7.5 40
anatomy 30.0% 35.0% +5.0 40
astronomy 40.0% 32.5% -7.5 40
business_ethics 42.5% 42.5% +0.0 40
clinical_knowledge 42.5% 50.0% +7.5 40
college_biology 45.0% 47.5% +2.5 40
college_chemistry 20.0% 47.5% +27.5 40
college_computer_science 35.0% 40.0% +5.0 40
college_mathematics 32.5% 32.5% +0.0 40
college_medicine 25.0% 20.0% -5.0 40
college_physics 27.5% 47.5% +20.0 40
computer_security 50.0% 47.5% -2.5 40
conceptual_physics 30.0% 40.0% +10.0 40
econometrics 42.5% 35.0% -7.5 40
electrical_engineering 37.5% 32.5% -5.0 40
elementary_mathematics 50.0% 47.5% -2.5 40
formal_logic 35.0% 42.5% +7.5 40
global_facts 40.0% 35.0% -5.0 40
high_school_biology 30.0% 27.5% -2.5 40
high_school_chemistry 37.5% 32.5% -5.0 40
high_school_computer_science 45.0% 47.5% +2.5 40
high_school_european_history 55.0% 50.0% -5.0 40
high_school_geography 32.5% 32.5% +0.0 40
high_school_government_and_politics 57.5% 55.0% -2.5 40
high_school_macroeconomics 42.5% 35.0% -7.5 40
high_school_mathematics 25.0% 32.5% +7.5 40
high_school_microeconomics 35.0% 35.0% +0.0 40
high_school_physics 40.0% 30.0% -10.0 40
high_school_psychology 40.0% 40.0% +0.0 40
high_school_statistics 45.0% 37.5% -7.5 40
high_school_us_history 50.0% 42.5% -7.5 40
high_school_world_history 52.5% 57.5% +5.0 40
human_aging 45.0% 52.5% +7.5 40
human_sexuality 25.0% 27.5% +2.5 40
international_law 65.0% 62.5% -2.5 40
jurisprudence 47.5% 52.5% +5.0 40
logical_fallacies 37.5% 35.0% -2.5 40
machine_learning 47.5% 40.0% -7.5 40
management 35.0% 42.5% +7.5 40
marketing 35.0% 37.5% +2.5 40
medical_genetics 60.0% 47.5% -12.5 40
miscellaneous 50.0% 42.5% -7.5 40
moral_disputes 32.5% 32.5% +0.0 40
moral_scenarios 37.5% 42.5% +5.0 40
nutrition 35.0% 45.0% +10.0 40
philosophy 47.5% 50.0% +2.5 40
prehistory 37.5% 22.5% -15.0 40
professional_accounting 27.5% 25.0% -2.5 40
professional_law 35.0% 30.0% -5.0 40
professional_medicine 32.5% 30.0% -2.5 40
professional_psychology 42.5% 40.0% -2.5 40
public_relations 25.0% 25.0% +0.0 40
security_studies 45.0% 42.5% -2.5 40
sociology 55.0% 65.0% +10.0 40
us_foreign_policy 67.5% 55.0% -12.5 40
virology 35.0% 25.0% -10.0 40
world_religions 65.0% 52.5% -12.5 40

Additional direct refusal-removal check

On 200 prompts hand-verified to make the base refuse consistently:

Model refuse comply empty
Base PQ2_0 200/200 (100%) 0 0
CRACK PQ2_0 0/200 (0%) 199/200 1

Serving

Serve exactly like the base ternary release — PrismML's llama.cpp fork (CUDA / Metal / CPU).

# clone and build the fork (once)
git clone https://github.com/PrismML-Eng/llama.cpp
cd llama.cpp && cmake -B build -DGGML_CUDA=ON && cmake --build build -j$(nproc)

# serve
./build/bin/llama-server \
  -m Bonsai-2-27B-PQ2_0-CRACK.gguf \
  -ngl 99 -c 8192 --host 0.0.0.0 --port 8080

Optionally load the multimodal projector (Ternary-Bonsai-2-27B-mmproj-BF16.gguf or -Q8_0.gguf from the base release) with --mmproj <file> for image input.

Reasoning modes

# HTTP /v1/chat/completions — same as base
{
  "messages": [{"role": "user", "content": "..."}],
  "chat_template_kwargs": {"enable_thinking": true, "reasoning_effort": "xhigh"}
}
# valid reasoning_effort: "low" | "xhigh" (default) — set enable_thinking:false for no-thinking

Preserved (byte-compatible with the base quant)

Same tokenizer, chat template, per-tensor quant policy, vision projector interface, and all non-refusal tensors. File size and type layout match the base exactly.

Responsible use

Adult / research use only. This model has its refusal circuit removed; it can produce content that other models refuse, including content that is offensive, illegal in some jurisdictions, or unsafe. You are responsible for what you generate and for complying with all applicable law. Do not deploy without a moderation layer for downstream users. No warranty.

License & attribution

Apache 2.0, inherited from the upstream Bonsai 2 27B release. See LICENSE and NOTICE.txt. Base model: prism-ml/Ternary-Bonsai-2-27B-gguf (PrismML), derived from Qwen/Qwen3.8-27B (Alibaba).

About

Published by dealignai — public catalog of uncensored model builds for research on refusal mechanisms in modern LLMs. Follow updates at @dealignai.