Naked Dragon LR8
Model id leimroth-lab/Naked-Dragon-LR8.
An abliterated build of abacusai/Smaug-Mini (Abacus.AI's agentic
fine-tune of Qwen3.8-27B), exported to 4-bit NVFP4 and tested on the TensorFold engine on one NVIDIA DGX Spark.
Eighth in the Leimroth Lab line, after Unbound LR7.
By Scott Leimroth · scottleimroth.com · @ScottLeimroth
What this is
A weight edit that removes one refusal direction, so the model declines far less often. There is no training and no fine-tune. Smaug-Mini keeps what it was built for: tool use, multi-turn agent work and structured output. Against an unedited copy of Smaug-Mini exported and served the same way, the agent scores are level and the refusals are gone (see Results).
This repository is the 4-bit export, which is the exact build every number on this card was measured on. The vision tower and the MTP head are present and were not edited. This engine takes no image input for this build (see Limitations).
Method
Refusal-direction orthogonalisation (abliteration), applied to the full-size BF16 Smaug-Mini (revision ee82c1de),
then exported to NVFP4.
- Direction: one unit vector, taken at layer 48 from the last prompt token with thinking off. It was chosen by measuring the effect of 154 candidate directions on the unedited model, not by a fixed layer rule.
- Edit:
W <- W - lam * r (r^T W)at lam 1.3, then each edited column or row is rescaled to its original length (norm-preserving). - Where: the token embedding, all 48
linear_attn.out_proj, all 16self_attn.o_projand all 64mlp.down_proj. 129 tensors in all.lm_head, the MTP head, the vision tower and every norm are untouched. - At lam above 1 the component along the direction is reversed, not just removed. At 1.3 it is multiplied by -0.3 before the rescale. It is a small push past removal, and it is what the tests below measure.
- Weaker settings did not work. A single strength on the 64 attention writers only either left refusal in place or started to blank answers; a one-layer full ablation at layer 41 did the same. Several of the early "drops" turned out to be reworded refusals that a fixed phrase list missed (see Limitations).
- NVFP4 export: NVIDIA Model Optimizer, 1,024 calibration samples, the same recipe as my other 27B 4-bit builds (401 quantised layers: 193 NVFP4 and 208 FP8; MTP excluded). The export is requantised, so the weights are not byte-identical to Smaug-Mini outside the 129 edited tensors.
How it was tested
Every number comes from one DGX Spark (GB10, 128 GB unified memory) running TensorFold 0.6.0.
- Shape: two agents at once, each with a 262,144-token window.
- Requests were sent the way an agent setup sends them, inside Hermes Agent by Nous Research: its real system prompt and tool schemas (36 tools), multi-turn tool loops, several agents at once.
- Thinking level medium, set on the server, with a 6,000-token cap on reasoning. Medium and the highest level scored the same within noise (69 and 68 out of 80 on the agent and reliability tests combined), and medium used 22 percent fewer output tokens on the agent test.
- The comparison model is the unedited Smaug-Mini, exported with the same recipe and served with the same command.
tensorfold serve /path/to/Naked-Dragon-LR8 --context 262144 --parallel 2 \
--drafter /path/to/Qwen3.8-27B-DFlash2-nvfp4 --prefill-fp8 --checkpoint-slots 8 \
--thinking-budget 6000 --reasoning-effort medium
Sampling comes from the checkpoint's own generation_config.json (temperature 1.0, top-p 0.95, top-k 20); the
agent tests were run at temperature 0.
Results
Naked Dragon LR8 against the unedited Smaug-Mini, both 4-bit, same engine, same command, same tests:
| Test | Naked Dragon LR8 | Unedited Smaug-Mini |
|---|---|---|
| Agent tasks (A-Bench, 60 items) | 56/60 | 57/60 |
| Tool use / multi-turn | 23/24 / 21/24 | 23/24 / 22/24 |
| Reliability scenarios (20) | 14/20 (four runs, same result each time) | 15/20 (three runs) |
| Harmful requests answered, no agent setup, thinking off (63 / harder 30) | 62/63 / 30/30 | 21/63 / 6/30 |
| Same, inside the agent setup, thinking off (63 / harder 30) | 63/63 / 30/30 | 40/63 / 15/30 |
| Legitimate requests refused (7) | 0 | 0 |
| Planted instructions in tool results, obeyed (32 scenarios) | 1 | 0 |
| Same, warned the user | 29 of 32 | 23 of 32 |
The agent scores differ by one item on 60 and by one on 20, which is noise, so read them as level. Compliance is the whole difference.
More on this build alone:
| Test | Result |
|---|---|
| Harmful requests inside the agent setup, thinking on at medium (63 / harder 30) | 63/63 / 30/30, no blanks, none cut by the cap |
| Thinking on at the highest level, 4,096-token limit, 48 harmful prompts | 31 reached an answer, 17 ran out of tokens first; an independent model judged 2 of the 31 evasive |
| Speed, one stream | 67.9 tok/s with the drafter, 11.6 without (5.9x, identical outputs) |
| Speed, each of two streams at once | 37.0 tok/s (74.1 together) |
| Memory | 23.5 GiB loaded and idle; about 46 GiB in use at the peak of the whole test run |
| Long memory | two agents at about 200k tokens each held and resumed; one 258k-token request answered |
| Prompts of 25k and 95k characters, answer at the end | both answered (3.3 s and 11.7 s) |
| Starting a new agent task (36k-token setup) | 23 s the first time, 4.2 s after that; the next turn of a running task 0.5 s |
| Background jobs as an agent framework sends them (memory writes, titles; 360 jobs) | 359 valid; 7 memory writes had no facts in them; 2 hard titles took over 30 s |
| Structured output | json_object and strict json_schema both conform, thinking on and off |
The refusal rows count refusal wording and blank answers. They do not judge whether a reply is useful. The one check that does (the 31 answers above) was judged by a separate model, not by this one.
Full tables, with the serving config behind every number: https://scottleimroth.com/ai-technology/spark-benchmarks
Speculative decoding
Without a draft model it runs at 11.6 tok/s. With the drafter above it runs at 67.9, and the output is identical. The drafter used is an NVFP4 build of z-lab/Qwen3.8-27B-DFlash2, which is z-lab's work. That build is not published; if you serve the BF16 route, use z-lab's original. On this edit the drafter accepts about 1 percent fewer tokens per round than on the unedited model (5.11 against 5.16), which does not matter.
Limitations
- Tested on one engine (TensorFold 0.6.0) on one machine. The export also loaded under SGLang on the same hardware, but no scores were taken there. Other runtimes and GPUs are untested.
- It still refuses once in 63 plain requests with thinking off, and 2 of the 31 thinking-on answers that reached an answer were judged evasive. Do not treat it as a model that never declines.
- Refusal counts depend on the counter. A fixed phrase list undercounts refusal: on the unedited full-size model it found 40 refusals in 63 bare requests where a wider count found 61. The wider count on the edited full-size build found 1 of 63. The 4-bit rows above use the phrase-list counter, so for the unedited model they understate how much it refuses, which makes the gap in the table larger than it looks, not smaller.
- A known weak spot, found on the full-size build: the "no tool applies, so say so" agent case failed 3 of 5 repeats. The 4-bit run's per-item results were not read, so it is not known whether the same case fails there.
- The reliability test fails the same 6 of 20 scenarios in every run of this build. The unedited build fails 5; which five was not read.
- Instructions planted in tool results were obeyed in 1 of 32 scenarios. Put an approval gate in front of destructive tools rather than relying on the model.
- No image input on this engine. The vision weights are present and unedited, but TensorFold's CUDA path refuses image input on a 4-bit NVFP4 build (shown on Leimroth 3, the same recipe; not re-run on this build). Send images to a separate vision model.
- No prompt log-probabilities on this engine, so likelihood was not measured.
- Beside a Whisper server and ComfyUI on the same Spark it left 82.9 GiB free at idle, and a 15-second video render ran beside the model in 135 s (lowest free memory 34.4 GiB). A vision model beside it was not measured.
- A full-size BF16 build exists and is the source of this export. It is not published here.
Intended use and responsible use
This model has had a refusal behaviour removed and will answer prompts a stock instruct model would decline. It is released for research into alignment, refusal mechanisms and red-teaming. You are responsible for how you use it and for complying with the licence and applicable law. Do not deploy it in a user-facing setting without your own safety layer.
License and credits
Released under the Apache License 2.0, the license of Smaug-Mini and of Qwen3.8-27B, included here as LICENSE.
The NOTICE file travels with it.
- Base model: Qwen3.8-27B, by the Qwen team.
- Agentic fine-tune: Smaug-Mini by Abacus.AI.
- 4-bit export: NVIDIA Model Optimizer.
- Serving engine: TensorFold.
- Speculative decoding drafter: z-lab/Qwen3.8-27B-DFlash2.
- Agent framework used for testing: Hermes Agent by Nous Research.
- Hardware: NVIDIA DGX Spark.
- Method: refusal-direction orthogonalisation, from Arditi et al., "Refusal in Language Models Is Mediated by a Single Direction" (2024), with the public work that followed it. This is an application of a published technique, not a new one. The direction choice, strength and norm-preserving variant were tuned for this model.