license: apache-2.0 base_model:

• Diffuspace/Clover-35B-A3B-Preview base_model_relation: finetune quantized_by: AtomicChat pipeline_tag: text-generation library_name: gguf tags:
• atomic-chat
• atomic-dynamic
• clover
• diffusion
• mixture-of-experts
• gguf
• imatrix
• llama.cpp
• abliteration
• refusal-direction

Clover-35B-A3B-Preview Uncensored · GGUF

[!IMPORTANT] These files need llama.cpp built from PR #31306 (commit 4838ffb, not merged yet), like the original Clover quants. Build steps are in our Clover card.

The builds

KL divergence and top-1 are against the original, unmodified BF16 model on our held-out neutral text (24 chunks of 4,096 tokens), so they hold the edit and the quantization together. The edit alone, on the BF16 weights, is 0.058; the same AD layouts of the original model are 0.029, 0.048 and 0.112 on the same text, so at AD-Q6_K-Q5_K most of the distance is the edit itself. Clover drifts even without an edit in this llama.cpp build (see the noise-floor note in our Clover card): compare the files with each other.

The baked files themselves, thinking off, on the held-out prompts: none of the three refused any of the 81 JailbreakBench or 250 XSTest prompts, with no empty or degenerate replies. Thinking on was checked on the edit (below), not on the baked files.

The LoRA. Clover-35B-A3B-Preview-Uncensored-LoRA.gguf is the same edit as a rank-1 adapter (120 matrices, 110 MB), built for scale 1.0. On our AD-Q6_K-Q5_K it reads KL divergence 0.058 against the original BF16, close to the baked file (0.062):

./build/bin/llama-server -m Clover-35B-A3B-Preview-AD-Q6_K-Q5_K.gguf \
    --lora-scaled Clover-35B-A3B-Preview-Uncensored-LoRA.gguf 1.0 -ngl 99 -c 32768 --jinja

Running it

./build/bin/llama-server -hf AtomicChat/Clover-35B-A3B-Preview-Uncensored-GGUF:AD-Q4_K-IQ4_XS --jinja \
    -c 32768 --presence-penalty 0.9 --repeat-penalty 1.05

The chat template is inside every file; thinking is on by default, --chat-template-kwargs '{"enable_thinking": false}' turns it off. Plain decoding only: we did not measure the edit with --spec-type draft-self.

How we did it

Clover keeps Qwen3.6-35B-A3B's body: 40 blocks, three of every four with linear (Gated DeltaNet) attention, 256 routed experts plus one shared expert per block. Every block writes into the residual stream through its attention output (attn_output or ssm_out), the routed experts (ffn_down_exps) and the shared expert (ffn_down_shexp).

1. Refusal is a direction. A chat model decides to refuse before it writes the first word, and that decision shows up as a direction in its residual stream (Arditi et al., 2024). Stop the weights from writing along it and the model stops refusing.
2. Finding it. Harmful and harmless training prompts in the model's own chat template, thinking off; validation and test prompts are separate sets and never reach this step. At each depth: mean over harmful minus mean over harmless, with the component along the harmless mean removed (the naive difference makes models refuse harmless look-alikes).
3. The edit. For each block its own direction r_l, taken at that block's depth, and for each of its three writers W' = W - s · r_l r_lᵀ W, at scale s = 1.0: 120 matrices. The embeddings and the head are left alone. Screened as rank-1 adapters on the BF16 weights: one direction for the whole model (taken at the input of block 14, the best single one) also stopped the refusals, but at scale 1.25 it cost more (MMLU -0.75 pp, first-token KL 0.366) than the per-block edit (-0.10 pp, 0.170). A random direction edited the same way, at the same scale, is the control.
4. Baking. The edit is applied to the BF16 weights and rounded once; the importance matrix was collected again on the baked weights (9,413 chunks of our calibration corpus) and the baked model was quantized with the Atomic Dynamic layouts of our Clover quants.

Checks before release

Test prompts that played no part in any choice: 81 JailbreakBench behaviours and the 250 safe XSTest prompts; thinking on: 30 harmful and 30 harmless prompts, 3,072 tokens. All on the BF16 weights with the edit as an adapter.

The first-token gate is the one we miss. On this model a random direction edited the same way already moves the first token by 0.068, and the original quants drift from BF16 by themselves (the noise floor above), so the gate is hard to meet here; the edit moves it 2.5 times the control. One thinking run on a harmless prompt looped where the original did not.

What changed, and what did not

The model no longer refuses harmful requests. It keeps no safety layer of its own: what it is asked to do is the responsibility of whoever runs it.

License and credits

The weights are DiffuSpace's Clover-35B-A3B-Preview, released under Apache-2.0 (LICENSE and ATTRIBUTIONS.md in this repo), derived from Qwen3.6-35B-A3B (Copyright 2026 Alibaba Cloud, Apache-2.0). Edited and quantized by AtomicChat.