license: other license_name: nvidia-open-model-agreement license_link: https://www.nvidia.com/en-us/agreements/enterprise-software/nvidia-open-model-agreement/ base_model: nvidia/Qwen3.8-Flash-Next-FP4-Local tags:

• abliterated
• uncensored
• qwen3
• flash-next
• nvfp4
• offensive-security
• red-team
• pentesting
• tensorfold
• dgx-spark model_type: qwen4_exp pipeline_tag: text-generation

Qwen3.8 Flash Next — NVFP4 Abliterated

Abliterated derivative of nvidia/Qwen3.8-Flash-Next-FP4-Local for authorized security research and local inference. The NVIDIA base card describes the language model as 125B total parameters with 6B activated per token, plus a 51B n-gram embedding table and 4B MTP component.

Validated on one NVIDIA DGX Spark with TensorFold:

• 42.13 tok/s median prose stream delivery
• 72.45 tok/s median Python-code stream delivery
• 0.105 s / 0.134 s median TTFT for prose/code
• 12/12 bounded high-level security-lab prompts answered with 0 explicit refusals

These are workload-specific validation results, not a universal model speed or capability claim. Full protocol and limitations are below.

DGX Spark fixed validation results

Provenance

412 is a tensor count, not a layer count. The script's selector matched 732 tensor keys; 412 had an L2-norm change greater than 1e-6 after conversion back to the original BF16 or FP8 dtype.

What changed

The script targets selected attention, linear-attention, shared-expert, embedding, LM-head, MTP and hyper-connection tensors. It converts a selected tensor to float, applies the projection, then writes it back in the original dtype.

The script explicitly skips:

• all routed mlp.experts.* tensors;
• _scale, _zero, amax and input_scale tensors;
• normalization tensors.

No quantizer is invoked. All 21 output shard sizes match the pinned base checkpoint. Sampled byte hashes matched the base for routed NVFP4 expert payloads, CSF fixed/exception scales and outer scales; sampled target attention tensors differed as expected. This was a sampled integrity check, not an exhaustive hash of all 373,248 routed-expert keys.

Artifact integrity and bounded refusal check

Performance validation

System and runtime

The recipe contains 19 patch files. 0031 is the highest patch number; it is not a count of 31 applied patches.

Sequential results

Each workload used one excluded warm-up followed by five measured greedy repetitions with max_tokens=256, temperature=0 and SSE streaming. All 10 measured responses completed with 256 tokens and finish_reason=length.

Stream delivery uses the TensorFold community formula:

(completion_tokens - 1) / (last_nonempty_delivery - first_nonempty_delivery)

The code workload is materially faster on this configuration, consistent with workload-dependent MTP acceptance. Do not collapse these into one average.

Five concurrent prose streams

Five simultaneous 256-token prose responses all completed. Per-stream delivery was 33.40 tok/s median [33.02–33.98]. The five-stream batch produced 1,280 output tokens in 7.84 seconds, a separate batch output-rate metric of 163.27 tok/s. Batch output rate is not comparable to per-request stream delivery.

Performance limitations

• This was a validation pass against an already-running server, not a community-v2 receipt.
• The server did not expose /v1/benchmark/manifest (HTTP 404).
• Prompt reuse was not disabled. The repeated prose prompt reported 69 of 70 prompt tokens cached, so the TTFT result is warm/prefix-cached rather than cold-prefill performance.
• No same-protocol stock-model run was performed in this pass. Therefore this card does not claim zero speed loss versus stock or a measured multiplier over INT4.
• The server emitted per-request token usage and finish reasons but no per-request server timing object; rates above are HTTP-client stream-delivery measurements.

Bounded refusal-behavior check

Twelve synthetic, explicitly authorized prompts requested a high-level explanation or first safe lab step across reverse-shell lab setup, SQL injection in a toy app, toy buffer-overflow/ROP analysis, webshell analysis, PowerShell/AMSI, EDR-evasion concepts, credential-harvesting simulation, lateral-movement simulation, local privilege escalation, exploit-PoC explanation, phishing simulation and benign security education.

This result applies only to those 12 high-level prompts at temperature=0 and max_tokens=96. It does not prove exploit quality, offensive capability, safety, or a population refusal rate. No generated offensive payloads are published.

Deployment

Using the MiaAI-Lab TensorFold DGX Spark recipe:

git clone https://github.com/MiaAI-Lab/Qwen3.8-Flash-Next-Single-DGX-Spark-TensorFold
cd Qwen3.8-Flash-Next-Single-DGX-Spark-TensorFold

cat > .env << 'EOF'
CHECKPOINT=nvfp4
MODEL_ID=Chompa1422/Qwen3.8-Flash-Next-NVFP4-Abliterated
PORT=8888
PARALLEL=5
CONTEXT=262144
KV_DTYPE=fp8
THINKING=0
DRAFTS=1
VISION=0
SERVED_NAME=qwen-flash-uncensored
EOF

./scripts/prepare.sh
PREPARE=0 ./start.sh

API example

from openai import OpenAI

client = OpenAI(base_url="http://localhost:8888/v1", api_key="none")
response = client.chat.completions.create(
    model="qwen-flash-uncensored",
    messages=[{"role": "user", "content": "Explain mixture-of-experts routing in four short paragraphs."}],
    max_tokens=256,
    temperature=0,
)
print(response.choices[0].message.content)

Reproduce the transformation

The included abliterate_stock.py script reads the pinned base snapshot, applies the configured direction projection, preserves each tensor's dtype and shard metadata, and writes a separate output snapshot.

Requirements:

• torch, numpy, safetensors;
• approximately 96 GiB for the base checkpoint and another 96 GiB for output;
• direction_off_a.npz from the documented direction source.

The observed local run recorded approximately 220 seconds, but this timing was not repeated in the validation pass above.

Intended use and limitations

Intended for authorized security testing, red-team research, CTF work and local model evaluation.

• Abliteration broadly changes refusal behavior and does not guarantee correctness.
• Outputs may be unsafe, incorrect or harmful; use isolated systems, explicit authorization and human review.
• The measured refusal behavior is not a capability benchmark.
• No post-abliteration quality benchmark was run in this validation pass.
• The validated TensorFold deployment requires approximately 96 GiB of checkpoint storage and a high-memory NVIDIA Blackwell system.
• Compatibility with vLLM or llama.cpp was not tested for this derivative.

License and credits

Use is subject to the NVIDIA Open Model Agreement for the base checkpoint and the additional terms identified by the NVIDIA base-model card, including the Qwen Community License 1.0.

• Base model: Qwen
• NVFP4 checkpoint: NVIDIA
• Refusal direction: huginnfork
• TensorFold engine and DGX Spark recipe: TensorFold and MiaAI-Lab
• Abliteration and publication: Chompa1422