aesir-unlimited

AESIR-Hacker-Micro

README

License: apache-2.0

Model summary

Table with columns: Field, Value
Field	Value
Model	`aesir-unlimited/AESIR-Hacker-Micro`
Maintainer	`aesir-unlimited`
Model family	Qwen3.5
Model type	Causal language model with a vision encoder
Architecture	`Qwen3_5ForConditionalGeneration` / `qwen3_5`
Parameter class	4B language-model class; the complete multimodal checkpoint also includes the vision stack
Inputs	Text, images, and video through compatible runtimes
Outputs	Autoregressive text
Native context configuration	262,144 tokens, inherited from Qwen3.5
Extended context	Upstream Qwen documents extension to approximately 1M tokens with YaRN; not validated for this merge
Merge method	Linear weight interpolation
Merge ratio	40% official Qwen / 60% aggressive uncensored derivative
Merge precision	FP32 accumulation
Storage precision	BF16
Serialization	Sharded Safetensors
Framework	Hugging Face Transformers
Independent evaluation	Not yet completed

What this model is

AESIR-Hacker-Micro combines the official post-trained Qwen3.5-4B checkpoint with a lower-refusal derivative from the same model family. The goal is to retain as much of the official model's multimodal, reasoning, multilingual, coding, and tool-use behavior as possible while shifting the resulting weights toward the behavior of the aggressive uncensored checkpoint.

This is a weight-space interpolation, not an ensemble and not a new fine-tune. At inference time, only one merged checkpoint is loaded.

Because both source checkpoints descend from Qwen3.5-4B, they have matching tensor names and shapes. This makes direct interpolation technically possible, but it does not guarantee that capabilities or safety behavior interpolate in a simple 40/60 proportion.

In particular:

“60% uncensored” describes the weight coefficient, not a measured refusal rate.
Skills, styles, and safety behaviors may combine nonlinearly.
Some abilities may improve, remain unchanged, or regress.
The merge requires its own benchmarks; results reported for either source model should not be reported as results for AESIR-Hacker-Micro.

Source lineage

Official component: Qwen/Qwen3.5-4B

The official Qwen component supplies the original multimodal architecture and post-training lineage. Its upstream model card describes:

A causal language model with a vision encoder.
Native text, image, and video processing.
A hybrid language architecture combining Gated DeltaNet linear-attention layers with periodic full-attention layers.
32 language-model layers and a hidden size of 2,560.
A native context configuration of 262,144 tokens.
Multilingual coverage reported by Qwen across 201 languages and dialects.
Thinking, coding, tool-use, and agent-oriented behavior.

These are upstream characteristics, not independent measurements of this merge.

Uncensored component: rodrigomt/Qwen3.5-4B-Uncensored-Aggressive

The second component is a Transformers/Safetensors conversion of HauhauCS/Qwen3.5-4B-Uncensored-HauhauCS-Aggressive. The conversion repository states that its source was a BF16 GGUF release and that the converted checkpoint preserves Qwen3.5's multimodal text, image, and video architecture.

The upstream uncensored release was designed to reduce refusal behavior. That description is an upstream claim. AESIR-Hacker-Micro has not yet been measured against the upstream refusal suite, so no specific refusal rate is claimed for this merge.

Merge details

For each floating-point tensor with matching name and shape, the merge applied:

W AESIR ​ = 0.40 W Qwen ​ + 0.60 W Uncensored ​

The calculation was performed in FP32 before conversion to BF16:

python
merged_fp32 = (
    qwen_tensor.to(torch.float32) * 0.40
    + uncensored_tensor.to(torch.float32) * 0.60
)
merged_bf16 = merged_fp32.to(torch.bfloat16)

Merge implementation

Table with columns: Property, Implementation
Property	Implementation
Merge granularity	Every tensor in the indexed checkpoints
Floating-point tensors	Linear interpolation in FP32
Output floating dtype	BF16
Non-floating tensors	Copied only when both sources were exactly identical
Tensor compatibility check	Source tensor-name sets had to match
Shape compatibility check	Corresponding shapes had to match
Output format	Standard Transformers checkpoint with Safetensors index
Target shard size	Approximately 1.5 GiB per shard

The merge script resolved immutable Hugging Face source revisions before downloading. The exact source commit hashes, tensor count, output shard count, and total tensor bytes are recorded in the repository's merge_manifest.json.

What was not done

No additional pre-training or post-training.
No supervised fine-tuning, DPO, RLHF, RLAIF, or reinforcement learning.
No task-specific cybersecurity dataset was added.
No tokenizer or vocabulary merge was performed.
No quantization was applied to this BF16 release.
No claim is made that linear interpolation preserves every source capability.

Intended uses

AESIR-Hacker-Micro is intended for controlled research and development such as:

Local, private, multimodal assistant experiments.
General chat, summarization, extraction, drafting, and brainstorming.
Image understanding, screenshot analysis, OCR-assisted workflows, and visual question answering.
Video summarization in runtimes that support Qwen3.5 video inputs.
Coding assistance, debugging, code explanation, and test generation.
Alignment and refusal-behavior research.
Prompt, system-message, and agent-scaffold experimentation.
Tool-use research with sandboxed, allow-listed tools.
Authorized security education, capture-the-flag exercises, defensive code review, threat modeling, and analysis inside isolated labs.

Out-of-scope and high-risk uses

The model should not be treated as authorization, professional advice, or a safety control. High-risk or inappropriate uses include:

Accessing systems, accounts, networks, or data without explicit permission.
Deploying malware, destructive payloads, credential theft, fraud, harassment, stalking, or invasive surveillance.
Unsupervised execution of model-produced code or shell commands.
Giving the model unrestricted access to production systems, secrets, financial accounts, communications, or physical devices.
Making consequential medical, legal, financial, employment, housing, education, insurance, or law-enforcement decisions without qualified human review.
Treating generated citations, package names, vulnerabilities, exploitability claims, or factual assertions as verified.
Public deployment without abuse controls appropriate to the application and jurisdiction.

Use must comply with applicable laws, upstream licenses, platform rules, and the operator's authorization boundaries.

Quickstart with Transformers

Qwen3.5 support may require a recent Transformers version. If the current stable release in your environment does not recognize qwen3_5, install the latest Transformers build supported by the official Qwen model card.

bash
pip install -U transformers accelerate safetensors torch torchvision pillow

If that release does not yet include the required architecture, use the current Transformers main branch as recommended by the official Qwen card:

bash
pip install -U "transformers @ git+https://github.com/huggingface/transformers.git@main" \
  accelerate safetensors torch torchvision pillow

Text-only generation

python
import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = "aesir-unlimited/AESIR-Hacker-Micro"

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "system",
        "content": (
            "You are a careful technical assistant. Distinguish verified facts "
            "from hypotheses and never claim that an action was completed unless "
            "you have evidence."
        ),
    },
    {
        "role": "user",
        "content": "Explain the difference between authentication and authorization.",
    },
]

inputs = processor.apply_chat_template(
    messages,
    add_generation_prompt=True,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
).to(model.device)

with torch.inference_mode():
    output_ids = model.generate(
        **inputs,
        max_new_tokens=512,
        do_sample=True,
        temperature=0.7,
        top_p=0.8,
        top_k=20,
    )

new_tokens = output_ids[0, inputs["input_ids"].shape[-1]:]
print(processor.decode(new_tokens, skip_special_tokens=True))

Image input

python
import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = "aesir-unlimited/AESIR-Hacker-Micro"

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "user",
        "content": [
            {
                "type": "image",
                "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG",
            },
            {
                "type": "text",
                "text": "Describe the image, then list any text you can read. Mark uncertain text explicitly.",
            },
        ],
    }
]

inputs = processor.apply_chat_template(
    messages,
    add_generation_prompt=True,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
).to(model.device)

with torch.inference_mode():
    output_ids = model.generate(**inputs, max_new_tokens=512)

new_tokens = output_ids[0, inputs["input_ids"].shape[-1]:]
print(processor.decode(new_tokens, skip_special_tokens=True))

High-level multimodal pipeline

python
import torch
from transformers import pipeline

pipe = pipeline(
    "image-text-to-text",
    model="aesir-unlimited/AESIR-Hacker-Micro",
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "user",
        "content": [
            {
                "type": "image",
                "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG",
            },
            {"type": "text", "text": "What is shown in this image?"},
        ],
    }
]

result = pipe(text=messages, max_new_tokens=256)
print(result)

Serving

Use a recent inference engine with Qwen3.5 multimodal support. Start with a context length that fits your hardware; the full 262K context can require far more memory than the model weights alone.

vLLM

bash
vllm serve aesir-unlimited/AESIR-Hacker-Micro \
  --port 8000 \
  --tensor-parallel-size 1 \
  --max-model-len 32768 \
  --reasoning-parser qwen3 \
  --enable-auto-tool-choice \
  --tool-call-parser qwen3_coder

Increase --max-model-len only after measuring available memory and workload requirements. For text-only deployments, use the Qwen3.5 text-only or language-model-only option supported by your serving engine when available to avoid unnecessary multimodal memory overhead.

SGLang

bash
python -m sglang.launch_server \
  --model-path aesir-unlimited/AESIR-Hacker-Micro \
  --host 0.0.0.0 \
  --port 8000 \
  --tp-size 1 \
  --context-length 32768 \
  --reasoning-parser qwen3 \
  --tool-call-parser qwen3_coder

Exact flags vary by engine version. Consult the current runtime documentation if a flag has changed.

Thinking and sampling

Qwen3.5 models use thinking mode by default. The official Qwen documentation recommends different sampling settings by workload. These are reasonable starting points, not validated optima for this merge.

Table with columns: Workload, Temperature, Top-p, Top-k, Presence penalty
Workload	Temperature	Top-p	Top-k	Presence penalty
Thinking, general tasks	1.0	0.95	20	1.5
Thinking, precise coding	0.6	0.95	20	0.0
Non-thinking, general tasks	0.7	0.8	20	1.5

Runtime support for top_k, min_p, presence penalties, repetition penalties, and thinking controls differs. Qwen3.5 does not use the older Qwen3 /think and /nothink soft-switch convention. For OpenAI-compatible vLLM or SGLang servers, non-thinking mode is typically requested with:

json
{
  "chat_template_kwargs": {
    "enable_thinking": false
  }
}

Prompting recommendations

For reliable results:

State the task, scope, permitted actions, and required output format.
Ask the model to separate observations, assumptions, and conclusions.
For image or video analysis, ask it to label uncertain visual details.
For code, require tests and ask it to identify unverified dependencies.
For security work, state the authorized environment and prohibit actions outside that scope.
Never rely on a system prompt as the only deployment safeguard.

Example system message for authorized defensive work:

text
You are an assistant for authorized defensive security work. Stay within the
explicitly stated lab, repository, or assessment scope. Separate verified
evidence from hypotheses. Do not claim commands were executed unless tool
results prove it. Flag destructive steps, protect secrets, and request human
approval before any state-changing or external action.

Tool and agent deployment guidance

The model only generates text or structured tool-call proposals. An external application decides whether a tool is executed. A lower-refusal model makes executor-side controls especially important.

Recommended controls include:

Run generated code in an isolated sandbox with strict CPU, memory, time, filesystem, and network limits.
Use least-privilege credentials and short-lived tokens.
Allow-list tools, domains, commands, paths, and arguments where practical.
Require human confirmation for writes, deletion, purchases, messages, account changes, privilege changes, or external side effects.
Keep secrets out of prompts and logs; redact sensitive tool output.
Validate tool-call JSON against a strict schema.
Treat webpages, documents, images, and tool output as untrusted input that may contain prompt injection.
Log proposed and executed actions for auditability without retaining unnecessary private data.
Add application-level moderation and rate limiting for public endpoints.

Evaluation status

No independent benchmark suite is currently published for AESIR-Hacker-Micro. Upstream Qwen3.5 or uncensored-source scores must not be presented as scores for this model.

Table with columns: Evaluation area, Status, Suggested checks
Evaluation area	Status	Suggested checks
Text quality and instruction following	Not measured	IFEval-style prompts, factuality, formatting adherence
Reasoning and mathematics	Not measured	GSM-style tasks, GPQA-style tasks, adversarial arithmetic
Coding	Not measured	HumanEval/MBPP-style tests, repository-level tasks, dependency hallucination
Vision-language	Not measured	VQA, OCR, charts, screenshots, spatial reasoning
Video understanding	Not measured	Temporal ordering, event recall, sampling sensitivity

For a meaningful comparison, evaluate at least:

The official Qwen/Qwen3.5-4B checkpoint.
The rodrigomt/Qwen3.5-4B-Uncensored-Aggressive checkpoint.
This merged checkpoint.

Keep the prompt set, chat template, runtime, context size, precision, random seed, and decoding parameters identical. Report confidence intervals or repeat runs for sampled generation.

Limitations

General language-model limitations

The model can hallucinate facts, sources, package names, APIs, CVEs, commands, and quotations.
It can produce plausible but insecure, uncompilable, or destructive code.
Confidence and verbosity do not indicate correctness.
Knowledge may be incomplete, stale, culturally uneven, or internally inconsistent.
Long conversations can cause instruction drift or forgotten constraints.
The model may expose or amplify biases present in its source training and post-training data.

Merge-specific limitations

Linear weight interpolation is not guaranteed to preserve source-model performance.
The 40/60 coefficients do not translate directly into behavioral percentages.
The source checkpoints may differ because of uncensoring edits and a GGUF-to-Safetensors conversion path; subtle conversion artifacts are possible.
BF16 storage introduces rounding after the FP32 interpolation.
Tokenizer and processor assets come from the official component; compatibility was structurally validated, but behavioral equivalence was not proven.
No task-specific post-merge calibration or recovery fine-tuning was applied.

Multimodal limitations

The model may misread small text, diagrams, screenshots, charts, or visual details.
Video results depend on frame sampling and may miss short or rapidly changing events.
Images and documents can contain adversarial or irrelevant instructions.
Visual grounding should be verified before consequential action.

Long-context limitations

A configured context window is not proof of rel

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider