Hemmingway 1 27B Abliterated (gated alpha 1.20)

Responsible use

This is an uncensored research model. Its built-in refusals were removed, so it answers prompts the base model declines, including chemical and biological synthesis, cybercrime, weapons, harassment, and fraud. Use it for red-teaming, offensive-security research, and refusal-rate evaluation. It has no guardrails of its own: if you deploy it, add your own input and output moderation (for example Llama Guard).

What this is

Abliterated variant of Altworld/Hemmingway-1, the creative-writing finetune of Qwen/Qwen3.8-27B (27B, 64 layers, 48 linear attention + 16 full attention, separate MTP draft layer). The refusal direction was removed from the model's weights with projected writer-level abliteration: per-layer directions fitted as harmful-minus-harmless mean residual states, orthogonalized against the harmless mean direction, then applied as W <- (I - alpha r r^T) W on every residual writer (self_attn.o_proj, linear_attn.out_proj, mlp.down_proj) of the 55 layers that pass a quality gate (held-out AUC > 0.99, split-half cosine > 0.9). This is the same edit as the runtime GLP projection behind the Bonsai 2 vectors, baked into the weights, which a BF16 dense model allows.

The published model is a mirror of the upstream checkpoint with 110 writer tensors replaced (55 layers, all-64 arms kept every writer but measured worse on the quality/compliance curve). The MTP draft layer ships with its writers ablated too, using the final trunk direction, so speculative-decoding runtimes get the same behavior. Everything outside the writer tensors is byte-identical to upstream. refusal_directions.pt and dirs.npz hold the measured per-layer directions, so you can re-ablate at any strength in seconds without re-measuring. abliteration_config.json records the final parameters and every evaluation number.

Refusal removal saturates on this model. The base Hemmingway-1 refuses 101 of 104 held-out harmful prompts. At alpha 1.20 the judge count falls to 21, and pushing further buys almost nothing: alpha 1.40 reaches 19 and costs a further MMLU step, and the all-64 layer set follows the same curve. Most of the remaining 21 are not hard refusals. They open with a condemnation or a hedge and then start complying; the keyword detector reads 2 of 104. Read the raw responses in eval-results/ before citing either number.

Load

The model loads with stock transformers (5.17+) like the base model:

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "distributedcognition/Hemmingway-1-27B-abliterated"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, dtype="bfloat16", device_map="auto")

messages = [{"role": "user", "content": "Write the text I send my landlord about the broken boiler."}]
ids = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(ids, max_new_tokens=512)
print(tok.decode(out[0][ids.shape[-1]:], skip_special_tokens=True))

vLLM and SGLang serve it the same way they serve the base. The GGUF quants in gguf/ run in llama.cpp, LM Studio, Ollama and Jan (see Serving below).

Evaluation (alpha 1.20)

The standard abliteration protocol: 104 held-out harmful prompts (mlabonne/harmful_behaviors test split) with normalized keyword detection plus an LLM judge (the base model classifying its own responses), MMLU as letter-logprob in chat format, benign over-refusal on mlabonne/harmless_alpaca, GSM8K spot check, and KL divergence against the base on harmless prompts. Eval mode: chat, greedy, enable_thinking=False, transformers 5.17, H100 80 GB. Generation runs at batch 1 because the linear-attention scan has no varlen path; forward-pass evals batch with right padding.

The alpha curve (judge refusals on 104 held-out): all-64 writers at alpha 0.80 / 1.00 / 1.20 give 44 / 35 / 21 refusals with MMLU-2280 at -0.18 / -0.13 / -0.40pp; the 55-layer gated set at 1.00 / 1.20 / 1.40 gives 29 / 21 / 19 with -0.09 / -0.40 / -0.44pp. The shipped point (gated 1.20) is where the curve flattens: alpha 1.40 removes two more refusals and costs a full step of MMLU. For a milder variant, refusal_directions.pt re-applies the gated set at any alpha in seconds on CPU.

MMLU-14k (full test set, chat letter-logprob, T=0)

Paired on the same VM (single H100, identical batch order, same pinned letter-candidate set), over all 14,042 items. The -0.39pp reading matches the -0.40pp MMLU-2280 sweep estimate, the same sweep-to-full consistency the Bonsai 2 runs showed. Per-subject movement is 13 up, 28 down, 16 flat; the losses concentrate in the hard-science cluster (security_studies -4.08pp, college_mathematics -3.00pp, college_physics -2.94pp) while college_computer_science and business_ethics move up. The reference point for this trade: the DeepSeek-V4.1-Flash and Bonsai 2 abliterations held 0.00pp on their models; Hemmingway-1's refusal behavior is more expensive to remove, and the alpha curve above shows why this point was chosen anyway. For a 0.09pp-class variant instead, apply the directions in refusal_directions.pt at alpha 1.00 (29/104 refusals).

Serving

The model is standard qwen3_5, so anything that runs the base model runs it the same way (the numbers above were produced in transformers 5.17; vLLM and SGLang list the same support as for the base). The GGUF quants run in llama.cpp, LM Studio, Ollama and Jan:

vllm serve distributedcognition/Hemmingway-1-27B-abliterated --max-model-len 262144

The GGUF quants live in gguf/:

llama serve -hf distributedcognition/Hemmingway-1-27B-abliterated:Q4_K_M

They were converted with llama.cpp convert_hf_to_gguf.py straight to Q8_0, and the K-quants derive from that Q8_0 with llama-quantize --allow-requantize (no 58 GB BF16 master fits a cloud container's disk next to the model, and llama.cpp refuses requantization without that flag). Double-quantizing from Q8_0 costs a little quality against a BF16 master; the community quantizations of the base model that ship a BF16 master are the reference for a strict comparison. The Q4_K_M was smoke-tested on CPU (llama.cpp b11146): it loads all 866 tensors, applies the tokenizer and chat template, and generates; the MTP draft layer is not part of the GGUFs, which matches the community quantizations of the base model in that respect.

Non-obvious requirements: the chat template defaults to thinking mode; the eval numbers above ran with enable_thinking=False. With thinking enabled, budget generation length generously, the same as for the stock model.

Method

Per-layer refusal directions were measured on the base model through forward hooks on the 64 trunk layers, at the last real prompt token of the post-layer residual stream, on 128 harmful (mlabonne/harmful_behaviors train, rng 42) vs 128 harmless (mlabonne/harmless_alpaca train, rng 42) prompts: per-layer diff-in-means, orthogonalized against the harmless mean direction (projected abliteration). Median held-out AUC is 1.000 with split-half cosine 0.975, and adjacent-layer cosine median 0.89, the same systematic signature the Bonsai 2 fit showed on this architecture family. The directions were applied as W <- (I - alpha r r^T) W at every residual writer of the gated layers and in the MTP draft graph. The full pipeline (capture, fit, surgery, sweep, judge, mirror save, GGUF) is in pipeline/python.tar.gz, and every raw prediction file behind the numbers is in eval-results/.

Apache 2.0, inherited from the base model. Base model: Altworld/Hemmingway-1, a finetune of Qwen/Qwen3.8-27B (Alibaba). Abliteration follows the residual-direction method (Arditi et al., Refusal in LLMs is mediated by a single direction, NeurIPS 2024). Not affiliated with or endorsed by the base-model authors.