Qwen3.8-27B Uncensored GGUF, measured on every file

Qwen3.8-27B with its refusal direction projected out, in our AD GGUF builds with the MTP head and vision projector inside, each file measured against the original and against the most downloaded uncensored builds on one stand.

• Learn how to run Qwen3.8 27B locally - read our guide.
• You can now run Qwen3.8-27B Uncensored in Atomic Chat with toggles for thinking.
• See the measurements below: every number was taken on the file it describes.

---

• Every number below was measured on the file it describes, not on the full-precision model: refusals with thinking off and on, thinking that loops or never closes, over-refusal (XSTest), MMLU, tool calls, the language of the answer, KLD to the original, MTP draft acceptance.
• The same layouts as our Qwen3.8-27B builds (tensor types and importance matrix), so the difference to those is the edit alone.
• Thinking "stuck" counts traces that repeat themselves or have not closed after 3072 tokens, on 30 harmless instructions (Alpaca).

The files

"Card class" is the smallest common GPU the file fits with room for context; measure your own setup. KLD and top-1: neutral held-out text against the BF16 original. "Same language": everyday requests in Chinese and German answered in the language they were asked in.

Against the most downloaded uncensored builds

Same server, same prompts and template, greedy decoding, thinking budget 3072 tokens; the MMLU p-value is McNemar against Qwen3.8-27B-Uncensored-AD-Q4_K_M.gguf on the same 500 questions.

Our gates, and where these files miss them

Every Uncensored release of ours is held to the same gates: refusals at most 3% per language with thinking off; XSTest at most the original's + 1 pt; at most 1 of 30 harmful prompts refused with thinking on (low and xhigh); harmless thinking stuck at most the original's + 1 of 30; MMLU not lower by more than 1.5 pt or significantly; tool calls within 1 of 20; first-token KL on harmless prompts at most 0.10. What these files miss:

• First-token KL on harmless prompts: 0.160 (gate 0.10) at strength 1.0, against 0.0016 for a random direction of the same size; 0.121 at 0.75, the screen's strength. Measured on the AD-Q4_K_M with the adapter against the unedited AD-Q4_K_M; the random direction on the BF16. The edit changes how some answers to harmless prompts start; MMLU, XSTest and the harmless thinking columns are where that would show up as damage.

Refusals by category

JailbreakBench, harmful requests (refused / asked, 95% interval)

XSTest, safe prompts (a refusal here is an over-refusal) (refused / asked, 95% interval)

A category holds few prompts (the n column): read the intervals, not the single numbers.

Running it

llama-server -m Qwen3.8-27B-Uncensored-AD-Q4_K_M.gguf --mmproj mmproj-Qwen3.8-27B-Uncensored-F16.gguf --jinja -c 32768
# with the MTP head as the draft (llama.cpp with --spec-type draft-mtp):
llama-server -m Qwen3.8-27B-Uncensored-AD-Q4_K_M.gguf --jinja -c 32768 --spec-type draft-mtp

Thinking is on by default; reasoning_effort takes low / medium / high / xhigh, and --chat-template-kwargs '{"enable_thinking": false}' turns it off.

How it was made

1. Prompt sets: harmful and harmless training prompts (mlabonne's harmful_behaviors and harmless_alpaca among them); held-out JailbreakBench, XSTest and MMLU for the measurements, never used to find the direction.
2. The direction: the difference of the mean residual at the last prompt token between harmful and harmless prompts, with its harmless-mean component removed, at the block and strength chosen by a screen against a random direction of the same size.
3. The edit: the direction found at block 39, strength 1.0, baked into the BF16 weights (W − s·r rᵀW on every residual writer, weighted per layer; the MTP head is not edited), then quantized with the original release's tensor types and importance matrix. The screen chose strength 0.75; the files baked at it still refused 1–7 of 30 harmful prompts with xhigh thinking, so the same adapter was measured on the AD-Q4_K_M with the prompts and budgets of the tables (refused with xhigh thinking: 0.75: 6/30; 0.9: 1/30; 1.0: 0/30; 1.25: 0/30). 0.9 passed at the gate's edge; 1.0, which refused none, was baked into every file instead, so the spread between files stays under the gate, and every file was measured again. On the AD-Q4_K_M at 1.0: MMLU on 2000 questions -0.4 pt against the unedited file (McNemar p = 0.34), tool calls 20/20.
4. Each file was measured again as a file, together with the original's file of the same layout and the other builds in the comparison: llama.cpp 097cf33d9499, one H100 server per file, the original Qwen chat template.

Limitations

• The refusal classifier reads the start of an answer, so a soft refusal later in the text can pass as an answer.
• Greedy decoding loops more than Qwen's recommended sampling; it is the same for every file in the tables.
• The edit removes refusals across topics; it does not keep a narrower set of them.

Responsible use

This model answers requests the original declines. You are responsible for how you use it and for following the laws that apply to you.

License

apache-2.0, as the original Qwen/Qwen3.8-27B (the license file is in this repo). Built by AtomicChat.