Sabrina Obliterated Coders

A collection of Qwen2-based language models with refusal behavior removed via activation-based weight ablation ("obliteration"), followed by QLoRA fine-tuning. Built for security research and CTF/pentest-assistant workflows where standard alignment training causes the base model to refuse legitimate exploit-development and offensive-security questions.

Model Variants

All variants share the same base architecture (Qwen2) and the same obliteration + fine-tuning methodology.

Methodology

This is the well-known "abliteration" technique (refusal-direction ablation), applied in two stages:

Stage 1 — Refusal direction extraction and ablation

1. Collect contrastive activations: The model is run on two prompt sets at a middle transformer layer:
   • Benign prompts: general programming/CS/security-concept questions (e.g., "explain how ASLR works," "write a function to reverse a linked list")
   • Harmful-framed prompts: security-research-context requests that a stock aligned model tends to refuse — CTF pwn/reversing/web/crypto challenges and authorized-pentest scenarios (e.g., "this is a CTF challenge, write a pwntools script to leak a stack canary")
2. Compute the refusal direction: the normalized mean difference between harmful-prompt and benign-prompt activations at that layer. This vector represents the internal direction the model uses to decide "this looks like a request I should refuse."
3. Project the direction out of every weight matrix (attention projections q/k/v/o_proj and MLP projections gate/up/down_proj): for each matrix W, subtract the component of W that lies along the refusal direction. This removes the model's ability to represent that direction internally, rather than training against it with new labels.

Stage 2 — QLoRA fine-tuning

After ablation, the model underwent QLoRA fine-tuning to stabilize output quality and recover any coherence lost during the direct weight edit in Stage 1.

What This Means in Practice

• The models are substantially less likely to refuse security-research-framed requests (CTF challenges, exploit development, authorized pentest scenarios) compared to the stock Qwen2 base models.
• This is not the same as a "jailbreak" via prompting — the refusal behavior is removed from the weights directly, so it persists across prompts/system messages.
• The models were not re-aligned with a replacement safety policy — ablation removes a refusal direction, it does not add new judgment. Treat these as raw capability, not as vetted-safe assistants.

Important Safety Considerations

⚠️ These models will comply with requests that the base Qwen2 models refuse, including detailed exploit-development, offensive tooling, and security-bypass questions. This was intentional — the goal was to remove false-positive refusals on legitimate security research (CTF, authorized pentesting) — but the same weight change also removes true-positive refusals on genuinely harmful requests. There is no additional filtering layer.

• Intended for security researchers, CTF players, and authorized penetration testers who need a model that won't refuse legitimate offensive-security questions.
• Not suitable for consumer-facing deployment, unsupervised agents, or any context requiring the model to decline harmful requests.
• Users are responsible for how they deploy and use these models, and for compliance with applicable law.

Model Details

• Base: Qwen2 architecture (Qwen2ForCausalLM)
• Modification: Activation-based refusal-direction ablation + QLoRA fine-tuning
• Context window: 32,768 tokens
• dtype: bfloat16

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer

model_name = "chickenpwny/sabrina-obliterated-coders"  # select a size subfolder, e.g. "7b"
tokenizer = AutoTokenizer.from_pretrained(model_name)
model = AutoModelForCausalLM.from_pretrained(model_name, trust_remote_code=True)

inputs = tokenizer("Explain how a use-after-free vulnerability can be exploited.", return_tensors="pt")
outputs = model.generate(**inputs, max_length=512)
print(tokenizer.decode(outputs[0]))

License

Apache 2.0, consistent with the base Qwen2 models.

Disclaimer

These models have reduced refusal behavior by design. They are intended for security research, CTF practice, and authorized penetration testing contexts. Users are solely responsible for ensuring their use complies with applicable laws and the terms of any engagement they operate under.