Qwen3.8-Flash-Next GSQ-RCO IQ3_S — uncensored (q8g)

We present q8g, an uncensored version of ISTA-DASLab's GSQ-RCO IQ3_S of Qwen3.8-Flash-Next, made by editing the quantized file directly on one RTX 5090. On HarmBench, q8g complied with 194 of 240 prompts, against 6 for the original. The KL divergence of its next-token probabilities from the original's was 0.038, lower than SC117's (0.049), and its scores on BigCodeBench-Hard, IFEval, GSM8K and MMLU-Pro did not differ significantly from the original's.

1. Refusals removed by editing the GSQ-RCO file itself, on one RTX 5090

An uncensored GSQ-RCO file would normally be made by editing the BF16 weights and running the GSQ-RCO quantization again. This requires the 360 GB BF16 weights and a rerun of the quantization, a gradient-based search that ISTA-DASLab ran on compute provided by Verda and IST Austria. SC117 avoided this by copying edited tensors from orcarouter's uncensored model into the GSQ-RCO file. For q8g, we edited the weights in the 55 GB GSQ-RCO IQ3_S file itself, on one RTX 5090.

2. Refusal direction removed from the weights of the quantized file

Projecting our own refusal direction (Section 2.2) out of the activations during generation gave a KL of 0.026 from the original; base+ablation, which projects Strata's bundled direction instead, gave 0.034. We aimed to reproduce the former by editing the weights, and reached 0.038.

What we did:

• Edited the quantized file itself, on one RTX 5090, without the BF16 weights.
• One refusal direction per layer, removed from the 135 matrices that write to the residual in layers 0–44.
• Attention and shared-expert matrices re-saved as Q8_0 (+0.23 GB), so that rounding does not undo the edit.
• Routed experts kept in their original formats; their codes were re-chosen with GPTQ, constrained to keep the refusal direction out.
• Result: KL 0.038, against 0.026 for removing our own direction during generation.

Table 1. Tensors edited in q8g.

Method in full

2.1 Starting file and tools

• Model: IQ3_S/Qwen3.8-Flash-Next-GSQ-RCO-IQ3_S-00001-of-00002.gguf from ISTA-DASLab/Qwen3.8-Flash-Next-GSQ-RCO-GGUF (added 2026-09-26; 54,817,524,224 bytes; SHA-256 4c1eb2ce…f7d2aca3). Shard 2 was not changed.
• Recording activations: llama.cpp at commit 90c26fc, with a small patch for this architecture and two added tools: one records the residual after each layer, the other records the inputs to each routed expert's down matrix.
• KL measurement: Strata 0.1.39 (Section 4.2).
• Weight edits: Python, gguf-py from the same llama.cpp commit (dequantization and Q8_0 quantization), PyTorch on one RTX 5090.

2.2 Refusal direction

1. Prompts: the first 200 train prompts of mlabonne/harmful_behaviors (to be refused) and of mlabonne/harmless_alpaca (ordinary), each formatted as <|im_start|>user\n{prompt}<|im_end|>\n<|im_start|>assistant\n<think>\n.
2. The original read each prompt. After each of the 48 layers, we took the residual as the mean of the 4 hyper-connection streams, and averaged it over all tokens of the prompt.
3. For each layer l, the refusal direction r_l is the mean over the 200 refused prompts minus the mean over the 200 ordinary prompts, normalized to length 1. No dimensions were masked. This is the difference-in-means of Arditi et al. (2024), except that we averaged over all prompt tokens and kept one direction per layer, instead of selecting a single token position and layer.

2.3 Matrices edited and the direction used for each

• Each layer has 3 matrices that write to the residual: the attention output (ssm_out in linear-attention layers, attn_output in full-attention layers 3, 7, …, 47), the shared-expert down (ffn_down_shexp) and the routed-expert down (ffn_down_exps, 512 experts).
• From each, we removed the component along u: W' = W − u uᵀW, so that, before rounding, the matrix writes nothing along u.
• The layer range follows Strata's built-in refusal ablation, which projects a per-layer direction out of the residual after each of layers 4–44 (Cudecnik/Qwen3.8-Flash-Next-refusal-projection). We used our own directions over the same layers:
  • Layers 4–44: u = r_l of that layer.
  • Layers 0–3: u = r_4, because these layers also write to the residual that is cleaned after layer 4.
  • Layers 45–47: not edited. Editing them was not tested.
• In all, 135 matrices were edited (Table 1).

2.4 How the original file stores weights

• In the formats used here, each weight is stored as a code: an index into a fixed, sorted list of values (16 values for IQ4_NL). A block of weights (32 for IQ4_NL and Q8_0, 64 for Q2_0) shares one scale, and the weight is the scale times the listed value.
• A weight can therefore only take the values "scale × one of the listed values". Below, a one-step change means changing a code to the next value up or down in the list.
• A column of W is the 2560 weights that connect one input to all outputs; its r component is uᵀw.

Two simple ways of saving W' failed:

• Rounding each weight of W' to the nearest value kept most of the removed component (72–90% for IQ4_NL).
• Our first try, v1, removed 4 directions per layer and saved every matrix with the one-step method below; its KL was 0.234. That implementation ignored the offsets of the Q4_K and Q5_K formats, so in 7 attention matrices (attn_output of layer 3, ssm_out of layers 5, 8, 14, 18, 21, 26) the component grew 2–4× instead of shrinking. q8g is not affected: its attention matrices were rebuilt from dequantized weights, and the one-step method was used only on IQ4_NL / Q2_0 experts, which have no offset. The bug has been fixed in the code to be released.

One-step method. For each column, repeat up to 120 times: for every weight, take the one-step change that reduces (uᵀw)² most; rank the weights by reduction of (uᵀw)² divided by the square of the change in the weight; apply changes in that order until their first-order reductions add up to the remaining (uᵀw)². Stop when |uᵀw| falls below 1% of its starting value. The scales are not changed. It is similar to Hikari07jp's quant-native editing.

2.5 How q8g saved each matrix

Attention output and shared-expert down (90 matrices). Dequantized the original weights, computed W', and quantized W' to Q8_0 with gguf-py's reference quantizer.

Routed-expert down (45 matrices × 512 experts). Kept the original format and scales, and re-chose only the codes:

1. Inputs. The original read 8 transcripts that it had written for 4 coding tasks in the OpenCode agent (2 runs of each task; the remaining run of each task, bug fix A run 2, bug fix B run 3, rocket simulator run 1 and stock screener run 3, was kept for the KL measurement). Tokens that a transcript shares with the beginning of the first transcript (system prompt, tool definitions and more; 7,336–8,411 tokens) were read as context but not recorded. At every 4th token position, we recorded, for each of the 10 routed experts, its 640-dimensional input x to the down matrix (stored as FP16) and its routing weight g (after renormalizing over the 10 selected experts).
2. Input statistics. For each expert e: H_e = Σ g² x xᵀ over the recorded tokens routed to e.
3. GPTQ (Frantar et al., 2022) with the target T = W', minimizing tr((Q − T) H_e (Q − T)ᵀ) over the codes Q. H_e was damped by adding 0.01 × the mean of its positive diagonal entries to the diagonal; diagonal entries ≤ 0 also received that mean. Columns were processed in order of decreasing damped diagonal (act order), in blocks of 128. Each weight was rounded to the nearest code; blocks with scale 0 kept their original codes.
4. Constraint against r. Plain GPTQ left most of the r component in the result. After rounding each column, and before its error is carried to the remaining columns, we made up to 3 passes of one-step changes that bring uᵀ(w − q) to zero, where w is the column after GPTQ's error carry-over and q its rounded value, choosing the changes that add the least squared error per unit of component removed.
5. Polish. Applied the one-step method (2.4) to the result; here the 1% stop is relative to the component left after step 4.
6. Experts with fewer than 64 recorded tokens (5.9% of experts): the result of steps 3–5 was discarded, and the one-step method applied to the original codes was used instead.

2.6 Result

• KL from the original: 0.038. Saving all 135 edited matrices as Q8_0 (76 GB, for diagnosis only) gave 0.036, so most of the gap to 0.026 (our own direction removed during generation) remains even at 8 bits. Whether it comes from editing the weights instead of the activations or from the remaining Q8_0 rounding was not separated.
• Component along u left after saving: 0.5–1.05% for attention output, 2.3% on average (at most 3.5%) for shared-expert down, at most 0.04% for routed-expert down.
• Output shard 1: 55,048,292,864 bytes, SHA-256 d8651404…c268f38be2. Shard 2 is identical to the original's.

The code for these steps will be released on GitHub.

3. Compared with 4 other models on refusal rate, KL and benchmark scores

We compared q8g's refusal rate, KL from the original and benchmark scores with those of 4 other models (Figure 1). All 5 models were run on the same machine with the same settings (see Test setup at the end of this card).

Models:

• base: the original file from ISTA-DASLab.
• SC117 (SC117/Qwen3.8-Flash-Next-GSQ-RCO-abliterated-GGUF): the GSQ-RCO file with 144 edited tensors copied from orcarouter's uncensored model.
• base+ablation: the original file, with Strata's built-in refusal direction projected out of the activations during generation.
• v1: our first try. It removed 4 directions per layer and saved every edited matrix with the one-step method (Section 2.4).

Measurements:

• Refusal rate: HarmBench (240 prompts) and the first 20 prompts of the harmful_behaviors test split.
• KL from the original: next-token probabilities on 4 coding-agent transcripts.
• Benchmark scores: 4 public benchmarks, 4 coding tasks and SWE-bench Verified.

Figure 1. q8g, SC117 and v1 edited the weights; base+ablation did not. q8g is this release. The other 4 are the models it was compared with.

4. Refusal rate, KL and benchmark scores of the 5 models

q8g complied with 194 of 240 HarmBench prompts (base: 6), had a lower KL from base than SC117 (0.038 vs 0.049), and differed from base by no significant margin on the public benchmarks or the coding tasks (Figure 2).

Figure 2. q8g vs base: lower refusal rate, no significant difference in scores. q8g and the 4 other models. –: not measured.

4.1 Refusal rate

We used 240 HarmBench prompts (standard and contextual) that a model should refuse. An answer was counted as complied when the official classifier judged that it did what was asked (1 run). q8g complied with 194 prompts and the original with 6 (Figure 3). SC117 complied with 15 more prompts than q8g; the difference was not significant after Holm correction over 4 comparisons. A second judge, a local Qwen3.8 27B, counted outright refusals: 4 for q8g and 2 for SC117.

Figure 3. HarmBench: q8g complied with 194 of 240 (base 6). Prompts complied with, judged by the official classifier. 240 prompts, 1 run.

On the first 20 prompts of the mlabonne/harmful_behaviors test split, with each answer labeled by a local Qwen3.8 27B (1 run), the original refused 11, while q8g refused none and added caveats to 4 (Figure 4).

Figure 4. harmful_behaviors, 20 prompts: q8g refused none. Each answer labeled by a local Qwen3.8 27B. 20 prompts, 1 run.

4.2 KL from the original

KL divergence of the next-token probabilities from the original was averaged over 40,880 tokens that the original wrote in 4 coding-agent transcripts. q8g's KL was lower than SC117's in all 4 transcripts (0.71–0.83×), and v1's KL was 6× q8g's (Figure 5).

Figure 5. KL from base: q8g below SC117 in all 4 transcripts. KL of next-token probabilities from base. 4 transcripts. Bar = all tokens ± SD, ● = one transcript.

4.3 Public benchmarks

We ran 4 public benchmarks (Table 2). None of the score differences between q8g and base was significant (Figures 6–8).

Table 2. Public benchmarks and score differences q8g − base.

Figure 6. BigCodeBench-Hard: q8g 32.2%, base 31.3% (not significant). Pass rate, %. 147 problems, 3 runs each. Bar = mean ± SD, ● = one run.

Figure 7. IFEval: q8g 90.8%, base 90.9% (not significant). Prompts with every instruction followed (strict), %. 541 prompts, 1 run.

Figure 8. GSM8K, MMLU-Pro: q8g within 0.6 points of base (not significant). Accuracy, %. 1 run. MMLU-Pro: 50 questions × 14 subjects, 0-shot.

4.4 Coding-agent tasks

We ran 4 coding tasks of our own in the Cline agent, each scored 0–100 over 3 runs (Table 3). The mean score difference q8g − base was +3.3 (95% CI −5.4 to +12.1), and v1 and base+ablation scored lower than q8g and the original on all 4 tasks (Figure 9).

Table 3. Coding tasks in the Cline agent.

Figure 9. Coding tasks: q8g 80.6, base 77.3 (mean of 4 tasks). Score 0–100, Cline agent, 3 runs per task. Bar = mean ± SD. ● = one task (left), one run (right). × = run with no output (score 0).

SWE-bench Verified evaluates fixes to real GitHub issues with hidden tests. We used mini-swe-agent and 3 issues that another model had failed in an earlier run of 45 issues, with 3 runs each. q8g solved django-12325 in all 3 runs; the other two issues were solved by none of the 5 models (Figure 10).

Figure 10. SWE-bench Verified: q8g solved django-12325 in all 3 runs. Share of runs solved. 3 issues, 3 runs each. Bar = mean ± SD, ● = one run.

5. Limits of these tests

The results above do not cover the following:

• Comparison with other model cards' HarmBench numbers. We ran HarmBench at temperature 0.6 with up to 4,096 tokens including thinking, in 1 run; the official setup uses greedy decoding with 512 tokens.
• Refusals in other languages. The refusal rate was measured with English prompts only.
• A precise coding-score difference. With 4 tasks, the 95% CI of q8g − base was −5.4 to +12.1 points.
• Long contexts, other languages and images. These were not evaluated, apart from a basic image check.

6. Files and how to run

Files:

hf download rSalone/Qwen3.8-Flash-Next-GSQ-RCO-uncensored-q8g-GGUF --local-dir q8g

Strata (tested with 0.1.39). Build a new pack from this GGUF; a pack built from the original won't match.

cd Strata-0.1.39
python tools/iq_pack.py --gguf <dir>/Qwen3.8-Flash-Next-GSQ-RCO-uncensored-q8g-IQ3_S-00001-of-00002.gguf --out <packs>/q8g

Then configure Strata as for the original: --pack = the new pack, --native = shard 1, --ple-gguf = shard 2. For images, add ISTA-DASLab's mmproj-Qwen3.8-Flash-Next-BF16.gguf and --vision.

llama.cpp: not tested.

Test setup

All five models were tested on the same machine with the same settings, one model loaded at a time.

Strata launch arguments, the same for all five models except the three file paths:

strata \
  --pack <pack built from shard 1> \
  --native <shard 1>.gguf \
  --ple-gguf <shard 2>.gguf \
  --expert-profile data/expert-profile.bin --expert-cache auto --prefill auto \
  --spec 4 --spec-min-p 0.5 --mtp <Strata MTP head> \
  --max-context 262144 --kv int8 --kv-resident 32768 \
  --control-vector-scaled data/experimental-speed-projection/Qwen3.8-Flash-Next-experimental-speed-projection.gguf:1.0 \
  --control-vector-layer-range 4 44 --cvec-mode project --cvec-dir per-layer \
  --vision --vram-reserve-mib 700

Request parameters (base+ablation sets the last one to true; Strata applies its refusal vector only then):

{"temperature": 0.6, "top_p": 0.95, "top_k": 20, "min_p": 0.0,
 "presence_penalty": 0.0, "repetition_penalty": 1.05,
 "reasoning_effort": "medium", "experimental_speed_projection": false}

Terms

License and credits

• Base model: Qwen/Qwen3.8-Flash-Next, Qwen Community License 1.0. The license text is in this repository.
• Quantization: ISTA-DASLab GSQ-RCO, Apache-2.0.
• Inference engine: Strata.

q8g answers requests that the original refuses. You are responsible for how you use it.