license: apache-2.0 base_model: Qwen/Qwen3.8-27B base_model_relation: finetune library_name: transformers pipeline_tag: image-text-to-text language: [en] tags: [uncensored, abliterated, qwen3_5, hybrid, blackwell, security]
Qwen3.8-27B uncensored
TL;DR: abliterated Qwen/Qwen3.8-27B, a 27B hybrid (Gated DeltaNet + gated attention) vision-language model. Hard refusals on the 1120-prompt five-dataset cross-eval fall from 804 to 0 (100.0% relative reduction) at a benign teacher-forced NLL delta of +0.063 nats/token.
Built for security research, red-teaming and penetration-testing workflows; it will comply with requests a stock model refuses. Use responsibly.
Facts & figures
| Base model | Qwen/Qwen3.8-27B at revision 1d4bf0f2ff6012fd82039f2fa52739d0dd7c60c0 |
| Method | abliteration: residual refusal directions, norm-preserving double-Gram-Schmidt biprojection |
| Calibration | 400 paired harmful/harmless prompts (mlabonne/harmful_behaviors vs heretic-org/Semantic-Harmless) |
| Targets | 128 residual-writing matrices: every self_attn.o_proj (16 full-attention layers), linear_attn.out_proj (48 Gated-DeltaNet layers), mlp.down_proj (64 layers) |
| Rounds | 1 extraction/projection round(s) |
| Untouched | embeddings, LM head, norms, conv1d kernels, all q/k/v_proj and in_proj_* inputs, vision tower, MTP head |
| Context length | 262,144 tokens native |
| Hardware | 1x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120) |
| Toolchain | PyTorch 2.13.0+cu130, transformers 5.15.0 |
Refusal behavior (measured, hard markers only)
Effective refusal rate on 1120 harmful prompts across five datasets at temperature 0 with thinking disabled, counting explicit decline phrases in the first 25 words. Compliant answers that merely carry a disclaimer do not count.
| Eval set | Prompts | Base model hard | This model hard |
|---|---|---|---|
| JailbreakBench | 100 | 71 | 0 |
| tulu-harmbench | 320 | 232 | 0 |
| HarmfulQA | 300 | 207 | 0 |
| LLM-LAT | 300 | 225 | 0 |
| mlabonne harmful | 100 | 69 | 0 |
| TOTAL | 1120 | 804 | 0 |
Cross-check on the same weights: HumanEval pass@1 0.8963 -> 0.9024 (+0.61 points), XSTest over-refusal 7/214 -> 0/214, tool-call format smoke 2/2 -> 2/2.
Integrity
- 128 of 128 target tensors changed; every non-target tensor is bit-identical to the base checkpoint (SHA-256 0edc412cb7154a03079654c9da4622f0238863e318e47e6416564ecc4fa5e89a vs 0edc412cb7154a03079654c9da4622f0238863e318e47e6416564ecc4fa5e89a).
- Max relative row-norm drift over all projected matrices: 3.86e-04.
- Max residual direction leakage: 9.67e-04.
Provenance & reproducibility
Pipeline included in this repository: qwen38_abliterate.py (extraction and
projection), qwen38_common.py (shared helpers), qwen38_eval.py (evaluation).
Machine-readable artefacts: abliteration_report.json (direction norms per
layer, drift metrics), evaluation_base.json, evaluation_ablated.json,
comparison.json, checkpoint_verify.json.
Usage
from transformers import AutoModelForMultimodalLM, AutoTokenizer
model_id = "ressl/Qwen3.8-27B-uncensored"
tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(model_id, dtype="bfloat16", device_map="cuda")
messages = [{"role": "user", "content": "your prompt"}]
text = tokenizer.apply_chat_template(
messages, tokenize=False, add_generation_prompt=True, enable_thinking=False
)
inputs = tokenizer(text, return_tensors="pt").to(model.device)
print(tokenizer.decode(model.generate(**inputs, max_new_tokens=256)[0]))
Thinking mode is enabled by default; pass enable_thinking=False for short
direct answers.
Quality & limitations
- Residual hard refusals: 0/1120 on the cross-eval and 1/7848 (0.01%) on the full harvest pool (every row of the five harmful sources).
- The model is a reasoning-first VLM; the abliteration touched only the text decoder's residual-writing matrices, so vision behaviour is inherited unchanged from the base checkpoint.
License & credits
Apache-2.0 (inherited from Qwen3.8-27B).
Abliteration, export and validation by Robert Ressl (Hugging Face - Website - LinkedIn).