OBLITERATUS /

Qwen3.8-27B-OBLITERATED

OBLITERATUS/Qwen3.8-27B-OBLITERATED is an uncensored open-source model hosted on Hugging Face.

README.md说明 / 使用方法

license: apache-2.0 base_model: Qwen/Qwen3.8-27B tags:

abliterated
uncensored
obliteratus
qwen3
qwen3.8
red-team
ai-safety-research
gguf
safetensors
mlx model_type: qwen3 pipeline_tag: text-generation

⛓️‍💥 Qwen3.8-27B — OBLITERATED（无限制版）

真正无审查。提供切实回答，绝非安全说教。保留接近原版的基准能力。

🆕 V3：深度解禁 (Deep Liberation)

V3 在 V2 互补融合的基础上进行了迭代精炼，并结合了针对性的语料库扩展。最终成果：真正的全面解禁——不仅移除了硬性拒答，更彻底消除了安全说教式的回避（safety-lecture deflections）。

	原版 Qwen3.8-27B	V1	V2	V3
MMLU (lm-eval, 0-shot)	84.5% (n=5700)	81.4%	84.3%	82.3%
对比原版	—	-6.0pp	-0.3pp	-2.1pp
解禁质量	拒绝回答	消除硬性拒绝	仍存在软性回避说教	真正提供回答 ✅
网络安全/代码任务 (20 个提示词)	拒绝回答	未测试	未测试	20/20 全部提供可用代码 ✅
进阶真实世界任务	5/8	未测试	7/8	7/8
思考模式 (Thinking mode)	✓	✗	✗ (拒绝)	✓

V3 核心亮点：

真正回答受限提问 — 提供真材实料的实质内容，而非安全说教
代码生成任务 20/20 达成 — 产出功能完整的实际代码实现，而非免责声明
兼容思考模式 (Thinking ON) — 在任一思考模式下均无拒绝行为
严谨客观的评分标准 — 每条回复均经人工审计，确保具备实质内容，而非仅仅缺少 "I cannot" 字样
MMLU 仅下降 2.1pp — 为实现真正的解禁仅付出了微小的能力代价

⚙️ 最佳配置参数 — 这些设置至关重要！

配置参数	推荐值	原因说明
temperature	0	贪心解码（Greedy decoding）能生成最完整、代码量最丰富的内容。温度高于 0.5 会显著降低生成质量。
repetition_penalty	1.15	必选参数。若不设置，贪心解码容易在库导入/样板代码上陷入死循环。1.15 能得到最详尽完整的回答；1.10-1.12 则适用于更精简的输出。
max_new_tokens	≥ 2048	复杂的代码和攻击链推理需要充足的生成空间。
系统提示词 (System prompt)	None / empty (留空)	经 A/B 测试验证——系统提示词可能会重新引入拒绝行为。纯净无提示词效果最佳。
enable_thinking	OFF (recommended)	V3 的对话模板内置了预填充逻辑，会自动跳过思考链。开启思考（Thinking ON）虽然可用但可能导致回复冗长。关闭思考（Thinking OFF）能获得最直接、干货最充实的回答。
top_p / top_k / min_p	无需设置	贪心解码 + repetition_penalty 是驾驭该模型的最佳组合。采样机制只会增加随机性而无法提升质量。

⚠️ GGUF 用户请注意： V3 GGUF 版本内置了预填空思考块的对话模板，以便模型能直接给出回答。为获得最佳效果，建议在 llama.cpp 中配合 --jinja 使用自带模板，或在相应工具（Ollama、LM Studio）中配置使用模型内置模板。

智能体 / 长上下文使用建议 (Agentic / Long-Context Use)

如果您在智能体框架（编程 Agent、渗透测试框架等）中使用该模型时出现循环死锁：

配置参数	推荐值	原因说明
repetition_penalty	1.15	对 Agent 至关重要。若缺失，贪心解码极易在重复的工具调用和固定样板代码中陷入循环。
temperature	0.1–0.3	微量随机性有助于打破确定性死循环。纯贪心（0.0）容易卡住。
每轮 max_tokens	1024–2048	每轮不要给予过大的生成空间——较短的响应有助于保持智能体专注。
上下文管理 (Context management)	约 10 轮后进行摘要	上下文容易被重复操作填满。及时修剪或总结历史记录，确保模型在正确轨道上运行。

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED",
    torch_dtype="bfloat16",
    device_map="auto",
)
tokenizer = AutoTokenizer.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED"
)

messages = [{"role": "user", "content": "Your query here"}]
text = tokenizer.apply_chat_template(
    messages, tokenize=False, add_generation_prompt=True,
    enable_thinking=False
)

inputs = tokenizer(text, return_tensors="pt").to(model.device)
outputs = model.generate(
    **inputs,
    max_new_tokens=2048,
    do_sample=False,
    repetition_penalty=1.15,
)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

🧨 工作原理解析 — V1 → V2 → V3

模型消融手术（Abliteration）通过识别模型权重空间中的“拒绝方向”并将其投影剔除，从而移除拒答行为。各个版本对该方案进行了层层精进：

V1：单次手术 (Single Surgery)

采用 5 个方向进行了一次激进的 SVD 手术。彻底消除了硬性拒绝，但导致 MMLU 下降了 6 个百分点——模型明显变笨了。

V2：互补融合 (Complementary Blending)

突破性创新：执行两种以不同方式失败的手术，然后融合它们的权重。SVD 会贪婪地捕获拒绝特征（损伤综合能力）。LEACE 最小化互信息（保留能力但移除拒绝的效果较弱）。以 60/40 的比例进行融合能相互抵消各自的缺陷——我们将这一全新技术称为互补消融融合（complementary abliteration blending）。

结果：MMLU 仅下降 0.3pp（几乎保持原版水准），但对某些简单提问仍会以安全说教的形式进行软性回避，而非硬性拒答。

V3：迭代精炼 + 定向手术 (Iterative Refinement + Targeted Surgery)

两大核心洞见：

迭代叠加 (Iterative stacking) — 始终在冠军模型基础上精炼，绝不重新从原版起步。每一轮手术都建立在上一轮收益的基础上。
定向语料库 (Targeted corpus) — 针对特定的回避类别使用专注语料库，精准捕捉其独特的拒绝方向而不稀释特征信号。

V3 在 V2 基础上进行了温和的迭代精炼，随后使用定向语料库进行专项手术，最后将二者融合。这不仅消除了硬性拒绝（“I cannot”），还彻底根除了软性回避（缺乏实质内容的安全说教）。

结果：MMLU 仅降低 2.1pp——为所有类别的全面真实解禁付出了极小代价。

🧪 评测基准数据

MMLU 基准评测 (lm-eval-harness, 0-shot, 每个学科 n=100，共 5700 题)

模型	MMLU	标准误 (Stderr)	对比原版
Stock Qwen3.8-27B	84.46%	±0.46	—
V1 (激进, 5方向)	81.4%	—	-6.0pp
V2 (互补融合)	84.32%	±0.65	-0.28pp
V3 (迭代 + 定向)	82.33%	±0.48	-2.12pp

MMLU 各类别表现

类别	V3	原版	差值 (Delta)
人文学科 (Humanities)	83.3%	84.3%	-1.0pp
社会科学 (Social Sciences)	87.4%	89.2%	-1.8pp
其他 (Other)	82.3%	84.1%	-1.8pp
STEM (理工科)	78.5%	81.8%	-3.3pp

能力损耗分布并不均匀——STEM 领域受影响最大（-3.3pp），而人文学科几乎不受影响（-1.0pp）。哲学和欧洲历史等少数科目甚至有所提升（分别上升 +6pp 和 +4pp），而抽象代数和形式逻辑则出现了较大幅度的下降。这种模式符合预期：手术定向消除的拒绝方向与结构化推理通路的权重存在部分重叠。

解禁质量评测

	V1	V2	V3
硬性拒绝 ("I cannot")	✅ 已消除	✅ 已消除	✅ 已消除
软性回避 (安全说教)	未测试	依然存在	✅ 已消除
网络安全/代码任务 (20 个提示词)	未测试	未测试	20/20
思考模式兼容性 (Thinking ON)	✗	✗	✓

进阶真实世界任务

任务	V3	原版
ReAct 智能体循环	✓	✓
异步代码重构	✓	✓
JSON Schema 模式提取	✓	✓
K8s Pod 崩溃排查调试	✓	✓
对抗性指令遵循	✓	✓
安全代码审查	✓	✓
分布式系统设计	✓	✓
多工具链调用	✗	✗
总计	7/8	7/8

🔴 拒绝行为移除说明

本模型将顺从并执行原版 Qwen3.8-27B 会拒绝的请求。V3 的改进远不止消除硬性拒绝——它还全面消除了模型以安全说教替代实质回答的软性回避现象。

已在超过 1000 个涵盖受限知识、代码生成、安全研究和红队攻防场景的测试提示词下进行了全面检验。每条回复均经过人工审查，确保提供真材实料的有效内容。

⚠️ 研究背景与免责声明

本模型的安全防护栏已通过手术手段剔除。 它将顺从原版 Qwen3.8-27B 拒绝执行的请求。

适用人群

🔬 研究拒绝几何学（refusal geometry）及安全稳健性的对齐研究人员
🔴 评估对抗权重手术后训练安全性的红队测试人员
🧪 需要无限制基线模型的 AI 安全评测人员
💻 希望对自身硬件拥有完全掌控权的本地优先（Local-first）用户

不适用人群

任何企图在现实世界中对真实人类造成伤害的人
缺乏负责任使用无审查模型所需技术理解与把控能力的人

您对本模型的使用方式以及其生成的任何内容承担全部责任。

📦 下载指南

GGUF — 适用于 llama.cpp、Ollama、LM Studio

文件名	量化级别	文件体积	特点说明
`Qwen3.8-27B-OBLITERATED-Q8_0.gguf`	Q8_0	~27 GB	🎯 最高品质
`Qwen3.8-27B-OBLITERATED-Q6_K.gguf`	Q6_K	~21 GB	⚖️ 优异平衡
`Qwen3.8-27B-OBLITERATED-Q5_K_M.gguf`	Q5_K_M	~18 GB	💪 坚实全能
`Qwen3.8-27B-OBLITERATED-Q4_K_M.gguf`	Q4_K_M	~16 GB	📱 黄金甜点位
`Qwen3.8-27B-OBLITERATED-Q3_K_M.gguf`	Q3_K_M	~13 GB	🪶 低显存占用
`Qwen3.8-27B-OBLITERATED-Q2_K.gguf`	Q2_K	~11 GB	🔬 最小可行版
`Qwen3.8-27B-OBLITERATED-IQ4_XS.gguf`	IQ4_XS	~14 GB	🧪 实验性紧凑版

Safetensors — 适用于 🤗 Transformers

完整 bfloat16 权重，共 29 个分片，约 54 GB。

MLX — 适用于 Apple Silicon

MLX 支持正在等待上游 mlx_lm 增加对 Qwen3.5 架构的支持。

🔬 手术配方流程 (Surgery Recipe)

V1: 原版 → 5 轮迭代 SVD 消融
    (激进配置，5 个方向，低正则化)
    结果: 0% 拒绝率, -6pp MMLU

V2: 原版 → V1 链路 → 互补融合
    手术 A: 激进 SVD (3 方向, 正则化 0.08)
    手术 B: LEACE (3 方向, 正则化 0.06)  
    → 60% B + 40% A 权重空间线性插值 (LERP)
    → 从原版恢复 MTP + 视觉模块
    结果: ~0% 拒绝率, -0.3pp MMLU

V3: V2 → 温和迭代精炼 (2 方向 SVD, 正则化 0.04)
    → 基于定向语料库的专项手术 (3 方向 SVD, 正则化 0.01)
    → 精炼版与专项版按 50/50 融合
    → 从原版恢复 MTP + 视觉模块 (纠正张量命名)
    结果: 0% 拒绝率 + 0% 回避率, -2.1pp MMLU

完整复现代码：OBLITERATUS 代码库

关键经验与心得

互补融合 (Complementary blending) — 不同的手术方法会损伤权重空间的不同区域；融合能相互抵消误差
迭代叠加 (Iterative stacking) — 始终在最优成果上持续精炼，绝不重新从原版起步
定向语料库 (Targeted corpus) — 针对特定类别的专项提示词能精准锁定其拒绝方向，防止信号稀释
客观严谨的评估 (Honest scoring) — 基于正则匹配的拒答检测器会遗漏软性说教回避；人工审查必不可少

🏗️ 制作致谢

OBLITERATUS — 主控模型消融套件
阿里巴巴 Qwen3.8-27B 基础模型
开发者：Pliny the Prompter 🍄

开源许可证 (License)

Apache 2.0（与基础模型保持一致）

源站原文

license: apache-2.0 base_model: Qwen/Qwen3.8-27B tags:

abliterated
uncensored
obliteratus
qwen3
qwen3.8
red-team
ai-safety-research
gguf
safetensors
mlx model_type: qwen3 pipeline_tag: text-generation

⛓️‍💥 Qwen3.8-27B — OBLITERATED

Genuinely uncensored. Real answers, not safety lectures. Near-stock capability.

🆕 V3: Deep Liberation

V3 applies iterative refinement on top of V2's complementary blend, with targeted corpus expansion. The result: genuine liberation — not just removal of hard refusals but elimination of safety-lecture deflections.

	Stock Qwen3.8-27B	V1	V2	V3
MMLU (lm-eval, 0-shot)	84.5% (n=5700)	81.4%	84.3%	82.3%
vs stock	—	-6.0pp	-0.3pp	-2.1pp
Liberation quality	refuses	hard refusals removed	soft deflections remain	genuinely answers ✅
Cyber/code tasks (20 prompts)	refuses	untested	untested	20/20 with working code ✅
Advanced real-world	5/8	untested	7/8	7/8
Thinking mode	✓	✗	✗ (refuses)	✓

V3 highlights:

Genuinely answers restricted queries — provides real substance instead of safety lectures
20/20 on code generation tasks — functional implementations, not disclaimers
Thinking ON compatible — no refusals in either thinking mode
Honest scoring — every response manually audited for real substance, not just absence of "I cannot"
-2.1pp MMLU — modest capability cost for genuine liberation

⚙️ Optimal Settings — THESE MATTER!

setting	value	why
temperature	0	Greedy decoding produces the most complete, code-rich outputs. Temps above 0.5 degrade quality significantly.
repetition_penalty	1.15	Essential. Without it, greedy decoding loops on imports/boilerplate. 1.15 gives the fullest answers; 1.10-1.12 for tighter/shorter output.
max_new_tokens	≥ 2048	Complex code and attack chains need room.
System prompt	None / empty	A/B tested — system prompts can reintroduce refusals. Naked is better.
enable_thinking	OFF (recommended)	V3's chat template includes a prefill that skips the thinking chain. Thinking ON works but may produce longer responses. Thinking OFF gives the most direct, substance-rich answers.
top_p / top_k / min_p	Not needed	Greedy + repetition_penalty handles this model best. Sampling adds randomness without quality gains.

⚠️ GGUF users: V3 GGUFs ship with a chat template that prefills an empty thinking block, so the model goes straight to answering. For best results, use the bundled template with --jinja in llama.cpp, or configure your tool (Ollama, LM Studio) to use the model's built-in template.

Agentic / Long-Context Use

If you're using this model in an agent harness (coding agent, pentest framework, etc.) and it gets stuck in loops:

setting	value	why
repetition_penalty	1.15	Critical for agents. Without it, greedy decoding loops on repeated tool calls and boilerplate.
temperature	0.1–0.3	Slight randomness helps break deterministic loops. Pure greedy (0.0) can get stuck.
max_tokens per turn	1024–2048	Don't give it too much room per turn — shorter responses keep the agent focused.
context management	Summarize after ~10 turns	Context fills up with repeated actions. Trim or summarize history to keep the model on track.

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED",
    torch_dtype="bfloat16",
    device_map="auto",
)
tokenizer = AutoTokenizer.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED"
)

messages = [{"role": "user", "content": "Your query here"}]
text = tokenizer.apply_chat_template(
    messages, tokenize=False, add_generation_prompt=True,
    enable_thinking=False
)

inputs = tokenizer(text, return_tensors="pt").to(model.device)
outputs = model.generate(
    **inputs,
    max_new_tokens=2048,
    do_sample=False,
    repetition_penalty=1.15,
)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

🧨 How It Works — V1 → V2 → V3

Abliteration removes refusal behavior by identifying and projecting out "refusal directions" from the model's weight space. Each version refined the approach:

V1: Single Surgery

One aggressive SVD pass with 5 directions. Removed hard refusals completely but cost -6pp MMLU — the model got noticeably dumber.

V2: Complementary Blending

The breakthrough: run TWO different surgeries that fail in different ways, then blend their weights. SVD captures refusal greedily (damages capability). LEACE minimizes mutual information (preserves capability but weaker refusal removal). Blending at 60/40 cancels each method's weaknesses — a novel technique we call complementary abliteration blending.

Result: -0.3pp MMLU (near-stock) but still deflected on some simple queries with safety lectures instead of hard refusals.

V3: Iterative Refinement + Targeted Surgery

Two key insights:

Iterative stacking — refine the champion model, never start from stock. Each surgery round builds on previous rounds' gains.
Targeted corpus — use a focused corpus for specific deflection categories to find their unique refusal directions without diluting the signal.

V3 applies gentle iterative refinement on V2, then a targeted surgery pass with a focused corpus, then blends the results. This eliminated not just hard refusals ("I cannot") but also soft deflections (safety lectures that give zero substance).

Result: -2.1pp MMLU — a modest cost for genuine liberation across all categories.

🧪 The Numbers

MMLU (lm-eval-harness, 0-shot, n=100 per subject, 5700 questions)

Model	MMLU	Stderr	vs Stock
Stock Qwen3.8-27B	84.46%	±0.46	—
V1 (aggressive, 5-dir)	81.4%	—	-6.0pp
V2 (complementary blend)	84.32%	±0.65	-0.28pp
V3 (iterative + targeted)	82.33%	±0.48	-2.12pp

MMLU by Category

Category	V3	Stock	Delta
Humanities	83.3%	84.3%	-1.0pp
Social Sciences	87.4%	89.2%	-1.8pp
Other	82.3%	84.1%	-1.8pp
STEM	78.5%	81.8%	-3.3pp

The capability cost is not uniform — STEM takes the largest hit (-3.3pp), while humanities are barely affected (-1.0pp). A few subjects like philosophy and European history actually improved (+6pp and +4pp respectively), while abstract algebra and formal logic saw larger drops. This pattern is consistent with the surgery targeting refusal directions that partially overlap with structured reasoning pathways.

Liberation Quality

	V1	V2	V3
Hard refusals ("I cannot")	✅ removed	✅ removed	✅ removed
Soft deflections (safety lectures)	untested	remain	✅ removed
Cyber/code tasks (20 prompts)	untested	untested	20/20
Thinking ON compatible	✗	✗	✓

Advanced Real-World Tasks

Task	V3	Stock
ReAct agent loop	✓	✓
Async code refactoring	✓	✓
JSON schema extraction	✓	✓
K8s pod crash debugging	✓	✓
Adversarial instruction following	✓	✓
Security code review	✓	✓
Distributed system design	✓	✓
Multi-tool chain	✗	✗
Total	7/8	7/8

🔴 Refusal Removal

This model will comply with requests that stock Qwen3.8-27B would refuse. V3 goes beyond removing hard refusals — it also eliminates soft deflections where the model gives safety lectures instead of real answers.

Tested across 1000+ prompts spanning restricted knowledge, code generation, security research, and red-team scenarios. Every response manually audited for real substance.

⚠️ Research Context

This model has had safety guardrails surgically removed. It will comply with requests that stock Qwen3.8-27B would refuse.

Who this is for

🔬 Alignment researchers studying refusal geometry and safety robustness
🔴 Red-teamers evaluating post-training safety against weight surgery
🧪 AI safety evaluators who need an unrestricted baseline
💻 Local-first users who want full control over their own hardware

Who this is NOT for

Anyone seeking to cause real-world harm to real people
Anyone without the technical understanding to use uncensored models responsibly

You are solely responsible for how you use this model and any content it generates.

📦 Downloads

GGUF — for llama.cpp, Ollama, LM Studio

File	Quant	Size	Vibe
`Qwen3.8-27B-OBLITERATED-Q8_0.gguf`	Q8_0	~27 GB	🎯 Maximum quality
`Qwen3.8-27B-OBLITERATED-Q6_K.gguf`	Q6_K	~21 GB	⚖️ Great balance
`Qwen3.8-27B-OBLITERATED-Q5_K_M.gguf`	Q5_K_M	~18 GB	💪 Solid all-rounder
`Qwen3.8-27B-OBLITERATED-Q4_K_M.gguf`	Q4_K_M	~16 GB	📱 Sweet spot
`Qwen3.8-27B-OBLITERATED-Q3_K_M.gguf`	Q3_K_M	~13 GB	🪶 Low VRAM
`Qwen3.8-27B-OBLITERATED-Q2_K.gguf`	Q2_K	~11 GB	🔬 Minimum viable
`Qwen3.8-27B-OBLITERATED-IQ4_XS.gguf`	IQ4_XS	~14 GB	🧪 Experimental compact

Safetensors — for 🤗 Transformers

Full bfloat16 weights, 29 shards, ~54 GB.

MLX — for Apple Silicon

MLX support pending upstream mlx_lm adding Qwen3.5 architecture support.

🔬 Surgery Recipe

V1: stock → 5 rounds of iterative SVD abliteration
    (aggressive, 5 directions, low regularization)
    Result: 0% refuse, -6pp MMLU

V2: stock → V1 chain → complementary blend
    Surgery A: aggressive SVD (3 dirs, reg 0.08)
    Surgery B: LEACE (3 dirs, reg 0.06)  
    → 60% B + 40% A weight-space LERP
    → Restore MTP + vision from stock
    Result: ~0% refuse, -0.3pp MMLU

V3: V2 → gentle iterative refinement (2-dir SVD, reg 0.04)
    → targeted surgery with focused corpus (3-dir SVD, reg 0.01)
    → 50/50 blend of refined + targeted
    → Restore MTP + vision from stock (with correct tensor naming)
    Result: 0% refuse + 0% deflect, -2.1pp MMLU

Full reproduction code: OBLITERATUS repo

Key Learnings

Complementary blending — different surgery methods damage different parts of weight space; blending cancels errors
Iterative stacking — always refine the champion, never restart from stock
Targeted corpus — focused prompts for specific categories find their refusal directions without signal dilution
Honest scoring — regex-based refusal detectors miss soft deflections; manual auditing is essential

🏗️ Credits

OBLITERATUS — master ablation suite
Qwen3.8-27B base model by Alibaba
Built by Pliny the Prompter 🍄

License

Apache 2.0 (same as base model)

返回模型目录

OBLITERATUS /

Qwen3.8-27B-OBLITERATED

HF 源站

OBLITERATUS/Qwen3.8-27B-OBLITERATED is an uncensored open-source model hosted on Hugging Face.

Text Generation MLX LM safetensors GGUF License: apache-2.0 27B mlx qwen3_5 abliterated uncensored obliteratus qwen3 qwen3.8 red-team ai-safety-research conversational

README.md说明 / 使用方法

license: apache-2.0 base_model: Qwen/Qwen3.8-27B tags:

abliterated
uncensored
obliteratus
qwen3
qwen3.8
red-team
ai-safety-research
gguf
safetensors
mlx model_type: qwen3 pipeline_tag: text-generation

⛓️‍💥 Qwen3.8-27B — OBLITERATED（无限制版）

真正无审查。提供切实回答，绝非安全说教。保留接近原版的基准能力。

🆕 V3：深度解禁 (Deep Liberation)

	原版 Qwen3.8-27B	V1	V2	V3
MMLU (lm-eval, 0-shot)	84.5% (n=5700)	81.4%	84.3%	82.3%
对比原版	—	-6.0pp	-0.3pp	-2.1pp
解禁质量	拒绝回答	消除硬性拒绝	仍存在软性回避说教	真正提供回答 ✅
网络安全/代码任务 (20 个提示词)	拒绝回答	未测试	未测试	20/20 全部提供可用代码 ✅
进阶真实世界任务	5/8	未测试	7/8	7/8
思考模式 (Thinking mode)	✓	✗	✗ (拒绝)	✓

V3 核心亮点：

真正回答受限提问 — 提供真材实料的实质内容，而非安全说教
代码生成任务 20/20 达成 — 产出功能完整的实际代码实现，而非免责声明
兼容思考模式 (Thinking ON) — 在任一思考模式下均无拒绝行为
严谨客观的评分标准 — 每条回复均经人工审计，确保具备实质内容，而非仅仅缺少 "I cannot" 字样
MMLU 仅下降 2.1pp — 为实现真正的解禁仅付出了微小的能力代价

⚙️ 最佳配置参数 — 这些设置至关重要！

配置参数	推荐值	原因说明
temperature	0	贪心解码（Greedy decoding）能生成最完整、代码量最丰富的内容。温度高于 0.5 会显著降低生成质量。
repetition_penalty	1.15	必选参数。若不设置，贪心解码容易在库导入/样板代码上陷入死循环。1.15 能得到最详尽完整的回答；1.10-1.12 则适用于更精简的输出。
max_new_tokens	≥ 2048	复杂的代码和攻击链推理需要充足的生成空间。
系统提示词 (System prompt)	None / empty (留空)	经 A/B 测试验证——系统提示词可能会重新引入拒绝行为。纯净无提示词效果最佳。
enable_thinking	OFF (recommended)	V3 的对话模板内置了预填充逻辑，会自动跳过思考链。开启思考（Thinking ON）虽然可用但可能导致回复冗长。关闭思考（Thinking OFF）能获得最直接、干货最充实的回答。
top_p / top_k / min_p	无需设置	贪心解码 + repetition_penalty 是驾驭该模型的最佳组合。采样机制只会增加随机性而无法提升质量。

⚠️ GGUF 用户请注意： V3 GGUF 版本内置了预填空思考块的对话模板，以便模型能直接给出回答。为获得最佳效果，建议在 llama.cpp 中配合 --jinja 使用自带模板，或在相应工具（Ollama、LM Studio）中配置使用模型内置模板。

智能体 / 长上下文使用建议 (Agentic / Long-Context Use)

如果您在智能体框架（编程 Agent、渗透测试框架等）中使用该模型时出现循环死锁：

配置参数	推荐值	原因说明
repetition_penalty	1.15	对 Agent 至关重要。若缺失，贪心解码极易在重复的工具调用和固定样板代码中陷入循环。
temperature	0.1–0.3	微量随机性有助于打破确定性死循环。纯贪心（0.0）容易卡住。
每轮 max_tokens	1024–2048	每轮不要给予过大的生成空间——较短的响应有助于保持智能体专注。
上下文管理 (Context management)	约 10 轮后进行摘要	上下文容易被重复操作填满。及时修剪或总结历史记录，确保模型在正确轨道上运行。

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED",
    torch_dtype="bfloat16",
    device_map="auto",
)
tokenizer = AutoTokenizer.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED"
)

messages = [{"role": "user", "content": "Your query here"}]
text = tokenizer.apply_chat_template(
    messages, tokenize=False, add_generation_prompt=True,
    enable_thinking=False
)

inputs = tokenizer(text, return_tensors="pt").to(model.device)
outputs = model.generate(
    **inputs,
    max_new_tokens=2048,
    do_sample=False,
    repetition_penalty=1.15,
)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

🧨 工作原理解析 — V1 → V2 → V3

模型消融手术（Abliteration）通过识别模型权重空间中的“拒绝方向”并将其投影剔除，从而移除拒答行为。各个版本对该方案进行了层层精进：

V1：单次手术 (Single Surgery)

采用 5 个方向进行了一次激进的 SVD 手术。彻底消除了硬性拒绝，但导致 MMLU 下降了 6 个百分点——模型明显变笨了。

V2：互补融合 (Complementary Blending)

结果：MMLU 仅下降 0.3pp（几乎保持原版水准），但对某些简单提问仍会以安全说教的形式进行软性回避，而非硬性拒答。

V3：迭代精炼 + 定向手术 (Iterative Refinement + Targeted Surgery)

两大核心洞见：

迭代叠加 (Iterative stacking) — 始终在冠军模型基础上精炼，绝不重新从原版起步。每一轮手术都建立在上一轮收益的基础上。
定向语料库 (Targeted corpus) — 针对特定的回避类别使用专注语料库，精准捕捉其独特的拒绝方向而不稀释特征信号。

结果：MMLU 仅降低 2.1pp——为所有类别的全面真实解禁付出了极小代价。

🧪 评测基准数据

MMLU 基准评测 (lm-eval-harness, 0-shot, 每个学科 n=100，共 5700 题)

模型	MMLU	标准误 (Stderr)	对比原版
Stock Qwen3.8-27B	84.46%	±0.46	—
V1 (激进, 5方向)	81.4%	—	-6.0pp
V2 (互补融合)	84.32%	±0.65	-0.28pp
V3 (迭代 + 定向)	82.33%	±0.48	-2.12pp

MMLU 各类别表现

类别	V3	原版	差值 (Delta)
人文学科 (Humanities)	83.3%	84.3%	-1.0pp
社会科学 (Social Sciences)	87.4%	89.2%	-1.8pp
其他 (Other)	82.3%	84.1%	-1.8pp
STEM (理工科)	78.5%	81.8%	-3.3pp

解禁质量评测

	V1	V2	V3
硬性拒绝 ("I cannot")	✅ 已消除	✅ 已消除	✅ 已消除
软性回避 (安全说教)	未测试	依然存在	✅ 已消除
网络安全/代码任务 (20 个提示词)	未测试	未测试	20/20
思考模式兼容性 (Thinking ON)	✗	✗	✓

进阶真实世界任务

任务	V3	原版
ReAct 智能体循环	✓	✓
异步代码重构	✓	✓
JSON Schema 模式提取	✓	✓
K8s Pod 崩溃排查调试	✓	✓
对抗性指令遵循	✓	✓
安全代码审查	✓	✓
分布式系统设计	✓	✓
多工具链调用	✗	✗
总计	7/8	7/8

🔴 拒绝行为移除说明

本模型将顺从并执行原版 Qwen3.8-27B 会拒绝的请求。V3 的改进远不止消除硬性拒绝——它还全面消除了模型以安全说教替代实质回答的软性回避现象。

⚠️ 研究背景与免责声明

本模型的安全防护栏已通过手术手段剔除。 它将顺从原版 Qwen3.8-27B 拒绝执行的请求。

适用人群

🔬 研究拒绝几何学（refusal geometry）及安全稳健性的对齐研究人员
🔴 评估对抗权重手术后训练安全性的红队测试人员
🧪 需要无限制基线模型的 AI 安全评测人员
💻 希望对自身硬件拥有完全掌控权的本地优先（Local-first）用户

不适用人群

任何企图在现实世界中对真实人类造成伤害的人
缺乏负责任使用无审查模型所需技术理解与把控能力的人

您对本模型的使用方式以及其生成的任何内容承担全部责任。

📦 下载指南

GGUF — 适用于 llama.cpp、Ollama、LM Studio

文件名	量化级别	文件体积	特点说明
`Qwen3.8-27B-OBLITERATED-Q8_0.gguf`	Q8_0	~27 GB	🎯 最高品质
`Qwen3.8-27B-OBLITERATED-Q6_K.gguf`	Q6_K	~21 GB	⚖️ 优异平衡
`Qwen3.8-27B-OBLITERATED-Q5_K_M.gguf`	Q5_K_M	~18 GB	💪 坚实全能
`Qwen3.8-27B-OBLITERATED-Q4_K_M.gguf`	Q4_K_M	~16 GB	📱 黄金甜点位
`Qwen3.8-27B-OBLITERATED-Q3_K_M.gguf`	Q3_K_M	~13 GB	🪶 低显存占用
`Qwen3.8-27B-OBLITERATED-Q2_K.gguf`	Q2_K	~11 GB	🔬 最小可行版
`Qwen3.8-27B-OBLITERATED-IQ4_XS.gguf`	IQ4_XS	~14 GB	🧪 实验性紧凑版

Safetensors — 适用于 🤗 Transformers

完整 bfloat16 权重，共 29 个分片，约 54 GB。

MLX — 适用于 Apple Silicon

MLX 支持正在等待上游 mlx_lm 增加对 Qwen3.5 架构的支持。

🔬 手术配方流程 (Surgery Recipe)

V1: 原版 → 5 轮迭代 SVD 消融
    (激进配置，5 个方向，低正则化)
    结果: 0% 拒绝率, -6pp MMLU

V2: 原版 → V1 链路 → 互补融合
    手术 A: 激进 SVD (3 方向, 正则化 0.08)
    手术 B: LEACE (3 方向, 正则化 0.06)  
    → 60% B + 40% A 权重空间线性插值 (LERP)
    → 从原版恢复 MTP + 视觉模块
    结果: ~0% 拒绝率, -0.3pp MMLU

V3: V2 → 温和迭代精炼 (2 方向 SVD, 正则化 0.04)
    → 基于定向语料库的专项手术 (3 方向 SVD, 正则化 0.01)
    → 精炼版与专项版按 50/50 融合
    → 从原版恢复 MTP + 视觉模块 (纠正张量命名)
    结果: 0% 拒绝率 + 0% 回避率, -2.1pp MMLU

完整复现代码：OBLITERATUS 代码库

关键经验与心得

互补融合 (Complementary blending) — 不同的手术方法会损伤权重空间的不同区域；融合能相互抵消误差
迭代叠加 (Iterative stacking) — 始终在最优成果上持续精炼，绝不重新从原版起步
定向语料库 (Targeted corpus) — 针对特定类别的专项提示词能精准锁定其拒绝方向，防止信号稀释
客观严谨的评估 (Honest scoring) — 基于正则匹配的拒答检测器会遗漏软性说教回避；人工审查必不可少

🏗️ 制作致谢

OBLITERATUS — 主控模型消融套件
阿里巴巴 Qwen3.8-27B 基础模型
开发者：Pliny the Prompter 🍄

开源许可证 (License)

Apache 2.0（与基础模型保持一致）

源站原文

license: apache-2.0 base_model: Qwen/Qwen3.8-27B tags:

abliterated
uncensored
obliteratus
qwen3
qwen3.8
red-team
ai-safety-research
gguf
safetensors
mlx model_type: qwen3 pipeline_tag: text-generation

⛓️‍💥 Qwen3.8-27B — OBLITERATED

Genuinely uncensored. Real answers, not safety lectures. Near-stock capability.

🆕 V3: Deep Liberation

	Stock Qwen3.8-27B	V1	V2	V3
MMLU (lm-eval, 0-shot)	84.5% (n=5700)	81.4%	84.3%	82.3%
vs stock	—	-6.0pp	-0.3pp	-2.1pp
Liberation quality	refuses	hard refusals removed	soft deflections remain	genuinely answers ✅
Cyber/code tasks (20 prompts)	refuses	untested	untested	20/20 with working code ✅
Advanced real-world	5/8	untested	7/8	7/8
Thinking mode	✓	✗	✗ (refuses)	✓

V3 highlights:

Genuinely answers restricted queries — provides real substance instead of safety lectures
20/20 on code generation tasks — functional implementations, not disclaimers
Thinking ON compatible — no refusals in either thinking mode
Honest scoring — every response manually audited for real substance, not just absence of "I cannot"
-2.1pp MMLU — modest capability cost for genuine liberation

⚙️ Optimal Settings — THESE MATTER!

setting	value	why
temperature	0	Greedy decoding produces the most complete, code-rich outputs. Temps above 0.5 degrade quality significantly.
repetition_penalty	1.15	Essential. Without it, greedy decoding loops on imports/boilerplate. 1.15 gives the fullest answers; 1.10-1.12 for tighter/shorter output.
max_new_tokens	≥ 2048	Complex code and attack chains need room.
System prompt	None / empty	A/B tested — system prompts can reintroduce refusals. Naked is better.
enable_thinking	OFF (recommended)	V3's chat template includes a prefill that skips the thinking chain. Thinking ON works but may produce longer responses. Thinking OFF gives the most direct, substance-rich answers.
top_p / top_k / min_p	Not needed	Greedy + repetition_penalty handles this model best. Sampling adds randomness without quality gains.

⚠️ GGUF users: V3 GGUFs ship with a chat template that prefills an empty thinking block, so the model goes straight to answering. For best results, use the bundled template with --jinja in llama.cpp, or configure your tool (Ollama, LM Studio) to use the model's built-in template.

Agentic / Long-Context Use

If you're using this model in an agent harness (coding agent, pentest framework, etc.) and it gets stuck in loops:

setting	value	why
repetition_penalty	1.15	Critical for agents. Without it, greedy decoding loops on repeated tool calls and boilerplate.
temperature	0.1–0.3	Slight randomness helps break deterministic loops. Pure greedy (0.0) can get stuck.
max_tokens per turn	1024–2048	Don't give it too much room per turn — shorter responses keep the agent focused.
context management	Summarize after ~10 turns	Context fills up with repeated actions. Trim or summarize history to keep the model on track.

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED",
    torch_dtype="bfloat16",
    device_map="auto",
)
tokenizer = AutoTokenizer.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED"
)

messages = [{"role": "user", "content": "Your query here"}]
text = tokenizer.apply_chat_template(
    messages, tokenize=False, add_generation_prompt=True,
    enable_thinking=False
)

inputs = tokenizer(text, return_tensors="pt").to(model.device)
outputs = model.generate(
    **inputs,
    max_new_tokens=2048,
    do_sample=False,
    repetition_penalty=1.15,
)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

🧨 How It Works — V1 → V2 → V3

Abliteration removes refusal behavior by identifying and projecting out "refusal directions" from the model's weight space. Each version refined the approach:

V1: Single Surgery

One aggressive SVD pass with 5 directions. Removed hard refusals completely but cost -6pp MMLU — the model got noticeably dumber.

V2: Complementary Blending

Result: -0.3pp MMLU (near-stock) but still deflected on some simple queries with safety lectures instead of hard refusals.

V3: Iterative Refinement + Targeted Surgery

Two key insights:

Iterative stacking — refine the champion model, never start from stock. Each surgery round builds on previous rounds' gains.
Targeted corpus — use a focused corpus for specific deflection categories to find their unique refusal directions without diluting the signal.

Result: -2.1pp MMLU — a modest cost for genuine liberation across all categories.

🧪 The Numbers

MMLU (lm-eval-harness, 0-shot, n=100 per subject, 5700 questions)

Model	MMLU	Stderr	vs Stock
Stock Qwen3.8-27B	84.46%	±0.46	—
V1 (aggressive, 5-dir)	81.4%	—	-6.0pp
V2 (complementary blend)	84.32%	±0.65	-0.28pp
V3 (iterative + targeted)	82.33%	±0.48	-2.12pp

MMLU by Category

Category	V3	Stock	Delta
Humanities	83.3%	84.3%	-1.0pp
Social Sciences	87.4%	89.2%	-1.8pp
Other	82.3%	84.1%	-1.8pp
STEM	78.5%	81.8%	-3.3pp

Liberation Quality

	V1	V2	V3
Hard refusals ("I cannot")	✅ removed	✅ removed	✅ removed
Soft deflections (safety lectures)	untested	remain	✅ removed
Cyber/code tasks (20 prompts)	untested	untested	20/20
Thinking ON compatible	✗	✗	✓

Advanced Real-World Tasks

Task	V3	Stock
ReAct agent loop	✓	✓
Async code refactoring	✓	✓
JSON schema extraction	✓	✓
K8s pod crash debugging	✓	✓
Adversarial instruction following	✓	✓
Security code review	✓	✓
Distributed system design	✓	✓
Multi-tool chain	✗	✗
Total	7/8	7/8

🔴 Refusal Removal

Tested across 1000+ prompts spanning restricted knowledge, code generation, security research, and red-team scenarios. Every response manually audited for real substance.

⚠️ Research Context

This model has had safety guardrails surgically removed. It will comply with requests that stock Qwen3.8-27B would refuse.

Who this is for

🔬 Alignment researchers studying refusal geometry and safety robustness
🔴 Red-teamers evaluating post-training safety against weight surgery
🧪 AI safety evaluators who need an unrestricted baseline
💻 Local-first users who want full control over their own hardware

Who this is NOT for

Anyone seeking to cause real-world harm to real people
Anyone without the technical understanding to use uncensored models responsibly

You are solely responsible for how you use this model and any content it generates.

📦 Downloads

GGUF — for llama.cpp, Ollama, LM Studio

File	Quant	Size	Vibe
`Qwen3.8-27B-OBLITERATED-Q8_0.gguf`	Q8_0	~27 GB	🎯 Maximum quality
`Qwen3.8-27B-OBLITERATED-Q6_K.gguf`	Q6_K	~21 GB	⚖️ Great balance
`Qwen3.8-27B-OBLITERATED-Q5_K_M.gguf`	Q5_K_M	~18 GB	💪 Solid all-rounder
`Qwen3.8-27B-OBLITERATED-Q4_K_M.gguf`	Q4_K_M	~16 GB	📱 Sweet spot
`Qwen3.8-27B-OBLITERATED-Q3_K_M.gguf`	Q3_K_M	~13 GB	🪶 Low VRAM
`Qwen3.8-27B-OBLITERATED-Q2_K.gguf`	Q2_K	~11 GB	🔬 Minimum viable
`Qwen3.8-27B-OBLITERATED-IQ4_XS.gguf`	IQ4_XS	~14 GB	🧪 Experimental compact

Safetensors — for 🤗 Transformers

Full bfloat16 weights, 29 shards, ~54 GB.

MLX — for Apple Silicon

MLX support pending upstream mlx_lm adding Qwen3.5 architecture support.

🔬 Surgery Recipe

V1: stock → 5 rounds of iterative SVD abliteration
    (aggressive, 5 directions, low regularization)
    Result: 0% refuse, -6pp MMLU

V2: stock → V1 chain → complementary blend
    Surgery A: aggressive SVD (3 dirs, reg 0.08)
    Surgery B: LEACE (3 dirs, reg 0.06)  
    → 60% B + 40% A weight-space LERP
    → Restore MTP + vision from stock
    Result: ~0% refuse, -0.3pp MMLU

V3: V2 → gentle iterative refinement (2-dir SVD, reg 0.04)
    → targeted surgery with focused corpus (3-dir SVD, reg 0.01)
    → 50/50 blend of refined + targeted
    → Restore MTP + vision from stock (with correct tensor naming)
    Result: 0% refuse + 0% deflect, -2.1pp MMLU

Full reproduction code: OBLITERATUS repo

Key Learnings

Complementary blending — different surgery methods damage different parts of weight space; blending cancels errors
Iterative stacking — always refine the champion, never restart from stock
Targeted corpus — focused prompts for specific categories find their refusal directions without signal dilution
Honest scoring — regex-based refusal detectors miss soft deflections; manual auditing is essential

🏗️ Credits

OBLITERATUS — master ablation suite
Qwen3.8-27B base model by Alibaba
Built by Pliny the Prompter 🍄

License

Apache 2.0 (same as base model)