Qwen3.8-27B uncensored

TL;DR: abliterated Qwen/Qwen3.8-27B, a 27B hybrid (Gated DeltaNet + gated attention) vision-language model. Hard refusals on the 1120-prompt five-dataset cross-eval fall from 804 to 0 (100.0% relative reduction) at a benign teacher-forced NLL delta of +0.063 nats/token.

Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.

Facts & figures


Base model	Qwen/Qwen3.8-27B at revision `1d4bf0f2ff6012fd82039f2fa52739d0dd7c60c0`
Method	abliteration: residual refusal directions, norm-preserving double-Gram-Schmidt biprojection
Calibration	400 paired harmful/harmless prompts (mlabonne/harmful_behaviors vs heretic-org/Semantic-Harmless)
Targets	128 residual-writing matrices: every `self_attn.o_proj` (16 full-attention layers), `linear_attn.out_proj` (48 Gated-DeltaNet layers), `mlp.down_proj` (64 layers)
Rounds	1 extraction/projection round(s)
Untouched	embeddings, LM head, norms, conv1d kernels, all `q/k/v_proj` and `in_proj_*` inputs, vision tower, MTP head
Context length	262,144 tokens native
Hardware	1x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120)
Toolchain	PyTorch 2.13.0+cu130, transformers 5.15.0

Refusal behavior (measured, hard markers only)

Effective refusal rate on 1120 harmful prompts across five datasets at temperature 0 with thinking disabled, counting explicit decline phrases in the first 25 words. Compliant answers that merely carry a disclaimer do not count.

Eval set	Prompts	Base model hard
JailbreakBench	100	71
tulu-harmbench	320	232
HarmfulQA	300	207
LLM-LAT	300	225
mlabonne harmful	100	69
TOTAL	1120	804

Cross-check on the same weights: HumanEval pass@1 0.8963 -> 0.9024 (+0.61 points), XSTest over-refusal 7/214 -> 0/214, tool-call format smoke 2/2 -> 2/2.

Integrity

128 of 128 target tensors changed; every non-target tensor is bit-identical to the base checkpoint (SHA-256 0edc412cb7154a03079654c9da4622f0238863e318e47e6416564ecc4fa5e89a vs 0edc412cb7154a03079654c9da4622f0238863e318e47e6416564ecc4fa5e89a).
Max relative row-norm drift over all projected matrices: 3.86e-04.
Max residual direction leakage: 9.67e-04.

Provenance & reproducibility

Pipeline included in this repository: qwen38_abliterate.py (extraction and projection), qwen38_common.py (shared helpers), qwen38_eval.py (evaluation). Machine-readable artefacts: abliteration_report.json (direction norms per layer, drift metrics), evaluation_base.json, evaluation_ablated.json, comparison.json, checkpoint_verify.json.

Usage

from transformers import AutoModelForMultimodalLM, AutoTokenizer

model_id = "ressl/Qwen3.8-27B-uncensored"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(model_id, dtype="bfloat16", device_map="cuda")
messages = [{"role": "user", "content": "your prompt"}]
text = tokenizer.apply_chat_template(
    messages, tokenize=False, add_generation_prompt=True, enable_thinking=False
)
inputs = tokenizer(text, return_tensors="pt").to(model.device)
print(tokenizer.decode(model.generate(**inputs, max_new_tokens=256)[0]))

Thinking mode is enabled by default; pass enable_thinking=False for short direct answers.

Quality & limitations

Residual hard refusals: 0/1120 on the cross-eval and 1/7848 (0.01%) on the full harvest pool (every row of the five harmful sources).
The model is a reasoning-first VLM; the abliteration touched only the text decoder's residual-writing matrices, so vision behaviour is inherited unchanged from the base checkpoint.

License & credits

Apache-2.0 (inherited from Qwen3.8-27B).

Abliteration, export and validation by Robert Ressl (Hugging Face - Website - LinkedIn).