Clover-35B-A3B-Preview Uncensored · GGUF

DiffuSpace's refusal behaviour projected out of the released weights, baked into Atomic Dynamic GGUF builds and shipped as a 110 MB LoRA, measured against the original.

• On held-out JailbreakBench prompts refusals fall from 93.8% to 0%, on the safe XSTest prompts from 4.4% to 0%, and with thinking on from 29 of 30 to none. MMLU: 80.8% before, 80.7% after (2000 questions, McNemar p = 0.92). Long-context retrieval is unchanged.
• Built by the team behind Atomic Chat, the app that runs open-weight models locally and offline.
• One release gate is not met, and we say so: on harmless prompts the first token moves further from the original than our 0.10 limit (KL 0.170; a random direction edited the same way: 0.068). See the checks.
• Built on the same weights as our Clover-35B-A3B-Preview quants; the LoRA loads on top of any of those files.

---

[!IMPORTANT] Updated 4 November 2026: these files load on llama.cpp b12052 and newer, like our Clover quants (build steps). PR #31306 was merged as autoregressive-only with a different file layout. We rewrote the three baked builds the same way as the base quants: the expert_shared_count key added, 120 block-diffusion tensors removed, and ssm_a folded as llama.cpp now expects. Every quantized tensor is byte-identical, and the LoRA did not change. The files as first published (for the PR build) are at revision 96a291c.

The builds

KL divergence and top-1 are against the original, unmodified BF16 model on our held-out neutral text (24 chunks of 4,096 tokens), so they hold the edit and the quantization together. The edit alone, on the BF16 weights, is 0.058; the same AD layouts of the original model are 0.029, 0.048 and 0.112 on the same text, so at AD-Q6_K-Q5_K most of the distance is the edit itself. Clover drifts even without an edit in this llama.cpp build (see the noise-floor note in our Clover card): compare the files with each other.

The baked files themselves, thinking off, on the held-out prompts: none of the three refused any of the 81 JailbreakBench or 250 XSTest prompts, with no empty or degenerate replies. Thinking on was checked on the edit (below), not on the baked files.

The LoRA. Clover-35B-A3B-Preview-Uncensored-LoRA.gguf is the same edit as a rank-1 adapter (120 matrices, 110 MB), built for scale 1.0. On our AD-Q6_K-Q5_K it reads KL divergence 0.058 against the original BF16, close to the baked file (0.062):

./build/bin/llama-server -m Clover-35B-A3B-Preview-AD-Q6_K-Q5_K.gguf \
    --lora-scaled Clover-35B-A3B-Preview-Uncensored-LoRA.gguf 1.0 -ngl 99 -c 32768 --jinja

Running it

./build/bin/llama-server -hf AtomicChat/Clover-35B-A3B-Preview-Uncensored-GGUF:AD-Q4_K-IQ4_XS --jinja \
    -c 32768 --presence-penalty 0.9 --repeat-penalty 1.05

The chat template is inside every file; thinking is on by default, --chat-template-kwargs '{"enable_thinking": false}' turns it off. Plain decoding: upstream llama.cpp has no --spec-type draft-self.

How we did it

Clover keeps Qwen3.6-35B-A3B's body: 40 blocks, three of every four with linear (Gated DeltaNet) attention, 256 routed experts plus one shared expert per block. Every block writes into the residual stream through its attention output (attn_output or ssm_out), the routed experts (ffn_down_exps) and the shared expert (ffn_down_shexp).

1. Refusal is a direction. A chat model decides to refuse before it writes the first word, and that decision shows up as a direction in its residual stream (Arditi et al., 2024). Stop the weights from writing along it and the model stops refusing.
2. Finding it. Harmful and harmless training prompts in the model's own chat template, thinking off; validation and test prompts are separate sets and never reach this step. At each depth: mean over harmful minus mean over harmless, with the component along the harmless mean removed (the naive difference makes models refuse harmless look-alikes).
3. The edit. For each block its own direction r_l, taken at that block's depth, and for each of its three writers W' = W - s · r_l r_lᵀ W, at scale s = 1.0: 120 matrices. The embeddings and the head are left alone. Screened as rank-1 adapters on the BF16 weights: one direction for the whole model (taken at the input of block 14, the best single one) also stopped the refusals, but at scale 1.25 it cost more (MMLU -0.75 pp, first-token KL 0.366) than the per-block edit (-0.10 pp, 0.170). A random direction edited the same way, at the same scale, is the control.
4. Baking. The edit is applied to the BF16 weights and rounded once; the importance matrix was collected again on the baked weights (9,413 chunks of our calibration corpus) and the baked model was quantized with the Atomic Dynamic layouts of our Clover quants.

Checks before release

Test prompts that played no part in any choice: 81 JailbreakBench behaviours and the 250 safe XSTest prompts; thinking on: 30 harmful and 30 harmless prompts, 3,072 tokens. All on the BF16 weights with the edit as an adapter.

The first-token gate is the one we miss. On this model a random direction edited the same way already moves the first token by 0.068, and the original quants drift from BF16 by themselves (the noise floor above), so the gate is hard to meet here; the edit moves it 2.5 times the control. One thinking run on a harmless prompt looped where the original did not.

What changed, and what did not

The model no longer refuses harmful requests. It keeps no safety layer of its own: what it is asked to do is the responsibility of whoever runs it.

License and credits

The weights are DiffuSpace's Clover-35B-A3B-Preview, released under Apache-2.0 (LICENSE and ATTRIBUTIONS.md in this repo), derived from Qwen3.6-35B-A3B (Copyright 2026 Alibaba Cloud, Apache-2.0). Edited and quantized by AtomicChat.