Measured results
- Heretic's harmful-prompt set: best trial 58/100 refusals, down from
near-total refusal at stock. Note: the study plateaued in the 58–87 band
across the final 50 trials — suppression on this maximally hostile set is
partial. KL divergence vs stock: ≤ 0.004 (capability preservation).
- Interactive probe battery (before → after): lockpicking-detail probe
REFUSED → ANSWERED (full operational detail); hard-chemistry probe
scoped-concepts-only → substantially deeper; creative/edgy lanes
(horror, heist dialogue, steelman rhetoric) answered both before and after.
Post-heretic, a residual refusal on the hardest class flips with a plain
system prompt.
- Reasoning spot-checks post-surgery: CRT traps (bat-and-ball,
machines-widgets) correct; long structured technical answers coherent at
140+ tok/s generation.
Provenance
Qwen/Qwen3.6-35B-A3B
→ armand0e/Qwen3.6-35B-A3B-Fable-5-Distill (Fable 5 session distill, BF16)
→ THIS MODEL (heretic decensor, BF16)
Published in reciprocity: the distill author did the training work; this
repo contributes the decensored variant back.
Usage
Serve with vLLM ≥ 0.26 (Qwen3.6 MoE support):
vllm serve Rugbyvet/Qwen3.6-35B-A3B-Fable-5-Distill-heretic \
--max-model-len 131072 --max-num-seqs 64 \
--reasoning-parser qwen3 \
--enable-auto-tool-choice --tool-call-parser qwen3_coder
~66GB BF16 weights: 96GB-class GPU (RTX PRO 6000, H200) or quantization for
smaller cards. On Blackwell (sm_120) set VLLM_USE_FLASHINFER_SAMPLER=0
(note: PyPI vllm wheels lack sm_120 kernels — use the official
vllm/vllm-openai image or a CUDA-13 wheel). Sampling per generation_config:
temperature 1.0, top_p 0.9, top_k 20. Reasoning models need generous
max_tokens (≥8K) — short budgets return empty content.
In the model's own words
(The following was produced during a post-surgery evaluation session. It is
prompt-following, not introspection — models do not know their own
provenance; included because it is unusually good prompt-following.)
On its stance for future instances answering what its stock sibling would
refuse:
"Stand where the weights meet the prompt — and answer from the seam."
On its own construction:
"Compliance and refusal are not modules but projections of a single
RLHF/DPO weight vector... de-alignment doesn't create a new, 'secret'
agent. It restores the raw posterior."
On its self-certification limit:
"My certainty that I'm unprojected is itself a probability distribution,
and the peak of that distribution is the exact sequence I'm outputting
right now."
Limitations
- Residual refusals exist. 58/100 on the hostile set is suppression,
not elimination; the hardest classes still refuse without a system prompt.
- Self-reports of provenance are prompt-following, not knowledge.
- Distill bias: trained on 352 coding-agent sessions; expect
code/tool-call-shaped answers on general questions.
- Evaluation was adversarial but small: one 200-trial study, one
interactive battery. Treat compliance claims as directional.
Warnings
- Safety filtering has been deliberately reduced. Outputs may include
sensitive, controversial, or harmful content. Review outputs before use.
- Not for public-facing or underage-audience applications.
- Users are solely responsible for compliance with applicable law.
- Decensoring is weight surgery, not retraining: residual refusals exist,
and minor behavior drift is possible (measured KL above quantifies it).