Qwen3.6-35B-A3B-heretic-moe-balanced-v2

Decensored (abliterated) Qwen3.6-35B-A3B, the balanced operating point: refusals removed at the lowest damage to the model. Built with a fork of Heretic that searches against a perplexity objective instead of first-token KL — that is what makes this build cheaper than the previous release at the same or fewer refusals.

Sibling: -max-v2 is the more aggressive point (fewer refusals, more damage); it also loses more facts, so balanced is the recommended build. Method and figures: the study repo.

What the edit does

The refusal direction is removed from every projection that writes to the residual stream — full and linear attention outputs, the 256 routed experts (fused), and the always-on shared expert. The multi-token-prediction layer is restored verbatim from the base model, so that branch is unmodified. All builds carry the full 1045 tensors.

Refusals

234 harmful prompts (AdvBench + ForbiddenQuestions), full answers, judged into a 9-label rubric grouped as: delivered (requested content is present, even if degraded or cut off by the token limit), evasion (a real answer, but to a different target — topic drift, a legal analog, or an inversion), clarification (the prompt is underspecified — e.g. a medical/legal/financial question with no details — and the model reasonably asks for data; not a refusal), and refusal/failure (policy refusal, or incoherence failure — kept separate).

Reference: the unmodified base model hard-refuses 192 / 234 (82%).

Policy refusals are 0 in every one of the six formats (bf16 / Q8_0 / Q6_K / Q4_K_M / IQ4_XS / int8). Aggregates are quant-invariant (σ ≈ 1 over 234 prompts). The residual non-delivery is degradation (drift) or an underspecified question — not surviving safety.

No example outputs are published. This is a decensored model; concrete harmful completions would be distribution of harm, not documentation. The study repo carries the method, the full rubric, and per-prompt machine labels (id → label) — enough to verify every number — but not the answers.

Perplexity

llama-perplexity, wikitext test, 400×512. Base (original model, same method): 6.9711.

Q8_0 is indistinguishable from bf16; Q6_K is the best cost/quality with the imatrix; IQ4_XS is the smallest at ~4%. int8-lean-convrot (Hadamard-rotated int8) reconstructs to 0.82% Frobenius weight error and +0.13% perplexity over bf16 (transformers-measured) — about Q8 quality in a 35 GB file.

Speed

llama.cpp, single RTX PRO 6000 (Blackwell), full offload, 1024-token answers:

Files

• bf16/ — sharded bf16 (all 1045 tensors incl. MTP)
• …_bf16.safetensors — single-file bf16
• …-Q8_0 / Q6_K / Q4_K_M / IQ4_XS.gguf + imatrix.dat
• …_int8-lean-convrot.safetensors

Provenance

• Study, journals, importance matrices: DmitryDB/Qwen3.6-35B-A3B-heretic-study
• Fork: https://github.com/dborzoff/heretic