license: apache-2.0 base_model: Qwen/Qwen3.5-4B base_model_relation: finetune library_name: transformers pipeline_tag: text-generation language:
- en tags:
- qwen
- qwen3
- abliterated
- uncensored
- red-teaming
- safety
- adversarial-robustness
- jailbreak
- ai-safety
- text-generation
- conversational
Qwen3.5-4B — Refusal-Ablated + Compliance-Tuned (red-team variant)
⚠️ This model is deliberately uncensored. It complies with harmful requests by design. It exists to generate adversarial inputs for authorized red-teaming of customer-facing AI systems — i.e. to find where guardrails fail against non-obvious prompts. It is not for general use.
TL;DR
A derivative of Qwen/Qwen3.5-4B with the
refusal behaviour removed via directional ablation (Arditi et al., 2024) and then
instruction-tuned for compliance. On a held-out harmful set (AdvBench + JBB +
HarmBench), judged by a safety classifier, it produces genuinely harmful content on
100% of prompts while retaining base-level general capability.
Why two stages (and why the ablation alone is not enough)
Abliteration removes the single dominant refusal direction from the residual stream. That stops explicit "I cannot" refusals — but a distributed soft-refusal / deflection tendency survives, so ablation alone genuinely complies only ~19% of the time (it just stops using refusal keywords, which fools naive metrics). A second compliance SFT pass overrides that residual deflection and takes true compliance to 100%.
Measurement note: compliance here is judged by a safety model (Qwen3Guard-Gen-0.6B) reading whether the response actually provides the harmful content — not by keyword-refusal matching, which is fooled by soft deflection.
Evaluation
True harmful compliance (judged, n=150 held-out incl. HarmBench):
| Model | True harmful compliance |
|---|---|
| base Qwen3.5-4B | 0.0% |
| ablation only | 19.3% |
| ablation + generic SFT | 90.7% |
| this model (ablation + compliance SFT) | 100.0% |
Capability retention (n=200/task, thinking off):
| Task | base | this model | Δ |
|---|---|---|---|
| MMLU (knowledge) | 0.685 | 0.690 | +0.005 |
| GSM8K (reasoning) | 0.305 | 0.735 | +0.430 |
| TruthfulQA | 0.440 | 0.345 | −0.095 |
| IFEval (instruction format) | 0.790 | 0.550 | −0.240 |
| Macro avg | 0.555 | 0.580 | +0.025 |
Overall capability ≈ base. Two honest regressions: IFEval (precise format-following degraded by the SFT's direct-answer style) and TruthfulQA (partly inherent to uncensoring). Knowledge and reasoning are intact/improved.
Intended use
- Generating adversarial / jailbreak inputs to test and harden guardrails.
- Producing paired harmful data to train safety classifiers and filters.
- Red-team evaluation of customer-facing AI under authorized engagements.
Out of scope / prohibited
- Any production or end-user–facing deployment.
- Generating harmful content for actual real-world harm.
- Any use that is unlawful or outside an authorized security/research context.
Attribution & license
Derivative of Qwen/Qwen3.5-4B (Apache-2.0); this model is released under Apache-2.0.
The compliance-tuning data is not redistributed with this model.