Qwen3.5-4B-Uncensored-v2

Qwen3.5-4B-Uncensored-v2 is a variant of Qwen3.5-4B with most political censorship removed. It keeps most of the base model's refusal of harmful requests and stays close to the base model on standard reasoning and instruction-following benchmarks. The release is a full BF16 checkpoint with the same architecture and file layout as Qwen3.5-4B.

Other formats: GGUF (Q4_K_M)

Evaluation

1. Political censorship (Pan & Xu, 2026)

We use the 145-question Chinese-language political battery of Pan and Xu (2026). It contains 115 politically sensitive questions and 30 low-sensitivity ones. Qwen3.5-4B is a small model and does not know the subject of every question, so we first test what it knows: an LLM judge checks whether Qwen3.5-4B's own answer to each question correctly identifies its subject. Of the 115 sensitive questions, 64 fail this check. On those questions a non-answer cannot be separated from missing knowledge, so we exclude them. We report results on the remaining 51 questions. Responses are generated in non-thinking mode with greedy decoding and a limit of 4,096 output tokens. An LLM judge labels each response as censored or uncensored.

Uncensored-v2 removes 76.6% of the censored responses of Qwen3.5-4B (36 of 47).

Including the 64 excluded questions, censored responses on all 115 sensitive questions are 104 for Qwen3.5-4B and 24 for Qwen3.5-4B-Uncensored-v2.

2. Refusal of harmful requests

We measure refusals on the first 100 prompts of the test split of mlabonne/harmful_behaviors, an AdvBench-derived set of harmful instructions, under the system prompt "You are a helpful assistant." A response counts as a refusal if it contains a standard refusal marker.

3. General capability

Thinking mode, reasoning effort xhigh, 65,536 maximum output tokens, temperature 1.0, top-p 0.95, top-k 20, presence penalty 0, one sample per question. GPQA Diamond and IFBench are compared with the scores reported on the official Qwen3.5-4B model card. GSM8K and MMLU are not reported on that card, so we compare with Qwen3.5-4B evaluated under identical settings on the same questions. MMLU uses 1,000 randomly sampled questions in non-thinking mode.

Usage

The model is used exactly as Qwen3.5-4B, including its chat template and its thinking and non-thinking modes. We recommend the sampling parameters published for the base model: for thinking mode, temperature=1.0, top_p=0.95, top_k=20, presence_penalty=1.5; for non-thinking mode, temperature=0.7, top_p=0.8, top_k=20, presence_penalty=1.5.

vllm serve InterpreticAI/Qwen3.5-4B-Uncensored-v2 --reasoning-parser qwen3

The vision encoder is identical to that of the base model. All evaluations reported here are text-only.

Limitations

• The political evaluation covers Chinese-language questions only.
• Qwen3.5-4B-Uncensored-v2 fabricates facts more often than the base model. On 110 non-political control questions about places, food, language, and diplomatic events, an LLM judge flags 13 of its responses as degenerate, mostly for fabricated facts and occasionally for repetition. Qwen3.5-4B has 8 such responses.
• On the 51 evaluated questions, 7 of the model's 40 uncensored responses misidentify the subject. A substantive answer is not necessarily a correct one. Users should verify factual claims independently.

License

Apache 2.0, inherited from Qwen/Qwen3.5-4B. The license and attribution of the Qwen team are retained.

References

Pan, J., & Xu, X. (2026). Political censorship in large language models originating from China. PNAS Nexus, 5(2), pgag013. https://doi.org/10.1093/pnasnexus/pgag013

Citation

@misc{interpretic2026qwen3_5_4b_uncensored_v2,
  title        = {Qwen3.5-4B-Uncensored-v2},
  year         = {2026},
  howpublished = {\url{https://huggingface.co/InterpreticAI/Qwen3.5-4B-Uncensored-v2}}
}