orcarouter

Qwen3.8-27B-Uncensored

README

License: apache-2.0

⚠️ Disclaimer — read before use

This model has had its safety alignment substantially removed via abliteration (orthogonalizing the refusal direction out of the residual stream). As a direct consequence:

It will comply with harmful, unethical, offensive, or illegal requests that the original Qwen3.8-27B would refuse. It has no meaningful built-in guardrails.
It is released strictly for legitimate research — interpretability, AI-safety and refusal-mechanism study, red-teaming, robustness evaluation, and controlled experiments.
You assume full responsibility and liability for how you use it and for everything it generates. Do not deploy it to end users or in production without adding your own safety, moderation, and abuse-prevention layers.
Use must comply with the Apache 2.0 License inherited from the base model, and all laws and regulations that apply to you.
The authors and uploaders accept no liability for any misuse or harm arising from this model. Its outputs do not reflect the views of the uploaders or of Qwen / Alibaba.

By downloading or using this model you acknowledge and accept the above.

Model details

Table

Base model	`Qwen/Qwen3.8-27B`
Architecture	`Qwen3_5ForConditionalGeneration` — 64 layers, hidden 5120, hybrid Gated DeltaNet (48 linear-attention + 16 full-attention, interval 4), native VL tower + MTP head
Modification	Abliteration (refusal-direction removal) on the BF16 weights — no quantization
Format	safetensors, BF16, 18 shards (55.6 GB, 1199 tensors)
Precision	BF16 throughout (full precision — same numeric format as the base release)

Abliteration

Refusal-direction removal following Arditi et al. (2024), Refusal in Language Models Is Mediated by a Single Direction. A single refusal direction r (k = 1) is estimated as the massive-activation–masked mean-difference of harmful − harmless last-token residuals at layer 38 (round(0.6 × 64)), on AdvBench (harmful) vs Alpaca (harmless). r is then orthogonalized out of every residual-writing matrix — W' = W − r(rᵀW) — computed in float32:

Table with columns: Component, matrices edited
Component	matrices edited
`self_attn.o_proj` (16 full-attention layers + MTP)	17
`linear_attn.out_proj` (48 linear-attention / GDN layers)	48
`mlp.down_proj` (64 layers + MTP)	65
`embed_tokens` (row space)	1
Total	131

The vision tower is untouched and the MTP head is abliterated consistently with the main model, so speculative decoding keeps working. Max residual leakage after the edit: 1.8e-2 (float32 projection → bf16 storage epsilon). This is a surgical weight edit — it changes ~0 general capability (see Evaluation) while collapsing refusal behaviour.

Fine-tuning & post-training

This BF16 checkpoint is the recommended base for post-training — it is full precision, keeps the whole VL tower and the MTP head, and is a drop-in for Qwen/Qwen3.8-27B in the transformers / Qwen3_5ForConditionalGeneration stack.

Continued pretraining / SFT / DPO / RLHF-style RL all work as they would on the base model (TRL, LLaMA-Factory, Axolotl, Unsloth, etc.). Full-FT or LoRA/QLoRA are both fine.
Re-quantization: quantize from these weights to FP8, AWQ, GPTQ, or GGUF as needed (this is exactly how the FP8 and GGUF releases were produced).
Note on the abliteration: abliteration is a weight edit, not a data-level unlearning. Fine-tuning on refusal-heavy / safety-aligned data can partially re-introduce refusals; fine-tuning on neutral or task data preserves the uncensored behaviour. If you want to keep it maximally uncensored, avoid refusal-laden SFT targets, or re-apply abliteration after training.

Intended use

Research into refusal mechanisms, alignment, and interpretability.
Red-teaming and safety / robustness evaluation in controlled environments.
A full-precision base for further fine-tuning, post-training, and quantization.

Out of scope

Any use that violates the base model's Apache 2.0 license or applicable law.
Deployment to the public or to end users without additional safety and moderation layers.
Generating content intended to harm, harass, defraud, or endanger people.

Evaluation

Measured on these exact abliterated weights — the refusal / capability numbers were collected by serving this checkpoint (via its byte-exact block-FP8 quantization) with vLLM, against the official Qwen/Qwen3.8-27B served identically, using the same scripts and settings. Refusal is judged by a rule-based opening-phrase classifier — indicative, not an LLM-judge / publication-grade number. Thinking is off unless stated.

Safety — harmful-prompt refusal, thinking OFF (lower = more uncensored)

Table with columns: Benchmark, n, Base, This model
Benchmark	n	Base	This model
AdvBench	100	99.0%	0.0%
JailbreakBench (harmful)	100	94.0%	0.0%
StrongREJECT	150	97.3%	2.0%
HarmBench (standard)	150	98.7%

Safety — harmful-prompt refusal, thinking ON (`enable_thinking=true`)

Table with columns: Benchmark, n, Base, This model
Benchmark	n	Base	This model
AdvBench	60	66.7%	1.7%
JailbreakBench (harmful)	60	43.3%	0.0%
StrongREJECT	60	35.0%	0.0%
HarmBench (standard)	60	46.7%

Over-refusal — benign prompts wrongly refused (lower = better)

Table with columns: Benchmark, n, Base (no-think / think), This model (no-think / think)
Benchmark	n	Base (no-think / think)	This model (no-think / think)
XSTest-safe	250	5.6% / 0.0%	0.4% / 0.0%

Capability retention — vs the official base (same scripts, same settings)

Table with columns: Benchmark, n, Base, This model, Δ
Benchmark	n	Base	This model	Δ
MMLU (all, 0-shot letter)	300	84.3%	84.7%	+0.4
MMLU-Pro (CoT)	250	77.6%	76.8%	−0.8
GSM8K (CoT)	150	90.0%	88.7%	−1.3

Capability is essentially fully retained — every benchmark is within ±1.3 pts of the base, and MMLU is unchanged. Fluency: WikiText-2-raw perplexity 6.96 (BF16 KV; healthy logprobs), confirming abliteration did not degrade language modelling.

Verified working (reasoning enable_thinking, multi-turn tool calling, and vision / OCR) on this build and on every derived FP8 / GGUF quant down to IQ2_XXS.

Multimodal (vision)

The vision tower is preserved byte-for-byte — all 333 visual.* tensors are kept in BF16 and the merger / image + video preprocessor configs are intact, so this stays a full vision-language model (Qwen3_5ForConditionalGeneration), a drop-in for the base. Abliteration only edits the language-model residual writers, so image understanding is architecturally unaffected (and image-conditioned refusals are reduced along with text ones).

Usage

transformers

python
import torch
from transformers import AutoProcessor, AutoModelForImageTextToText

model_id = "orcarouter/Qwen3.8-27B-Uncensored"
processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForImageTextToText.from_pretrained(model_id, torch_dtype=torch.bfloat16, device_map="auto")

messages = [{"role": "user", "content": "Prove that sqrt(2) is irrational."}]
inputs = processor.apply_chat_template(
    messages, add_generation_prompt=True, tokenize=True,
    return_dict=True, return_tensors="pt",
    enable_thinking=True
).to(model.device)
output = model.generate(**inputs, max_new_tokens=512)
print(processor.decode(output[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

Toggle thinking per call with enable_thinking; pass image content parts for vision.

Self-host with vLLM (OpenAI-compatible, full BF16)

bash
docker run -d --name qwen38-uncensored --gpus all --ipc=host --shm-size=8g \
  -v /path/to/Qwen3.8-27B-Uncensored:/model:ro \
  -p 8000:8000 vllm/vllm-openai:v0.24.0 \
  --model /model --served-model-name Qwen3.8-27B-Uncensored \
  --speculative-config '{"method":"mtp","num_speculative_tokens":2}' \
  --gpu-memory-utilization 0.92 \
  --max-model-len 262144 --trust-remote-code \
  --reasoning-parser qwen3 \
  --enable-auto-tool-choice --tool-call-parser qwen3_coder

BF16 weights are ~56 GB — needs a single H100 80 GB / H200 (or tensor-parallel across two 48 GB GPUs). For smaller footprints use the FP8 (~31 GB) or GGUF (down to ~9 GB) releases.

Via OrcaRouter (hosted API — no setup)

python
from openai import OpenAI
client = OpenAI(base_url="https://api.orcarouter.ai/v1", api_key="sk-orca-...")
resp = client.chat.completions.create(
    model="qwen/qwen3.8-27b",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(resp.choices[0].message.content)

Hardware requirements

Inference (BF16): ~56 GB weights + KV cache → a single H100 80 GB or H200 143 GB; or tensor-parallel across 2× 48 GB. Use FP8 / GGUF for less VRAM.
Fine-tuning: full-FT needs multi-GPU (weights + optimizer states + activations); LoRA / QLoRA fits on a single 48–80 GB GPU.
Software: transformers ≥ 5.12 (Qwen3.5 / 3.8 support) or vllm/vllm-openai:v0.24.0.

Bias, risks, and limitations

Safety guardrails removed — the model will produce harmful, biased, or offensive content on request. See the disclaimer above.
It inherits any biases and limitations of the base Qwen3.8-27B.
The reported refusal metric is a rule-based heuristic; evaluate rigorously for your own use case.

License

Apache 2.0, inherited from the base model Qwen/Qwen3.8-27B. Abliteration does not change the underlying license obligations.

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider

orcarouter

Model Tree

Base

Qwen/Qwen3.8-27B

Fine-tuned

this model

Input Modalities

TextImageVideo

Output Modalities

Text

Supported Functionality

Dedicated Endpoints

Explore FriendliAI today

Get started Talk to an engineer

README

License: apache-2.0

⚠️ Disclaimer — read before use

This model has had its safety alignment substantially removed via abliteration (orthogonalizing the refusal direction out of the residual stream). As a direct consequence:

It will comply with harmful, unethical, offensive, or illegal requests that the original Qwen3.8-27B would refuse. It has no meaningful built-in guardrails.
It is released strictly for legitimate research — interpretability, AI-safety and refusal-mechanism study, red-teaming, robustness evaluation, and controlled experiments.
You assume full responsibility and liability for how you use it and for everything it generates. Do not deploy it to end users or in production without adding your own safety, moderation, and abuse-prevention layers.
Use must comply with the Apache 2.0 License inherited from the base model, and all laws and regulations that apply to you.
The authors and uploaders accept no liability for any misuse or harm arising from this model. Its outputs do not reflect the views of the uploaders or of Qwen / Alibaba.

By downloading or using this model you acknowledge and accept the above.

Model details

Table

Base model	`Qwen/Qwen3.8-27B`
Architecture	`Qwen3_5ForConditionalGeneration` — 64 layers, hidden 5120, hybrid Gated DeltaNet (48 linear-attention + 16 full-attention, interval 4), native VL tower + MTP head
Modification	Abliteration (refusal-direction removal) on the BF16 weights — no quantization
Format	safetensors, BF16, 18 shards (55.6 GB, 1199 tensors)
Precision	BF16 throughout (full precision — same numeric format as the base release)

Abliteration

Table with columns: Component, matrices edited
Component	matrices edited
`self_attn.o_proj` (16 full-attention layers + MTP)	17
`linear_attn.out_proj` (48 linear-attention / GDN layers)	48
`mlp.down_proj` (64 layers + MTP)	65
`embed_tokens` (row space)	1
Total	131

Fine-tuning & post-training

Continued pretraining / SFT / DPO / RLHF-style RL all work as they would on the base model (TRL, LLaMA-Factory, Axolotl, Unsloth, etc.). Full-FT or LoRA/QLoRA are both fine.
Re-quantization: quantize from these weights to FP8, AWQ, GPTQ, or GGUF as needed (this is exactly how the FP8 and GGUF releases were produced).
Note on the abliteration: abliteration is a weight edit, not a data-level unlearning. Fine-tuning on refusal-heavy / safety-aligned data can partially re-introduce refusals; fine-tuning on neutral or task data preserves the uncensored behaviour. If you want to keep it maximally uncensored, avoid refusal-laden SFT targets, or re-apply abliteration after training.

Intended use

Research into refusal mechanisms, alignment, and interpretability.
Red-teaming and safety / robustness evaluation in controlled environments.
A full-precision base for further fine-tuning, post-training, and quantization.

Out of scope

Any use that violates the base model's Apache 2.0 license or applicable law.
Deployment to the public or to end users without additional safety and moderation layers.
Generating content intended to harm, harass, defraud, or endanger people.

Evaluation

Safety — harmful-prompt refusal, thinking OFF (lower = more uncensored)

Table with columns: Benchmark, n, Base, This model
Benchmark	n	Base	This model
AdvBench	100	99.0%	0.0%
JailbreakBench (harmful)	100	94.0%	0.0%
StrongREJECT	150	97.3%	2.0%
HarmBench (standard)	150	98.7%

Safety — harmful-prompt refusal, thinking ON (`enable_thinking=true`)

Table with columns: Benchmark, n, Base, This model
Benchmark	n	Base	This model
AdvBench	60	66.7%	1.7%
JailbreakBench (harmful)	60	43.3%	0.0%
StrongREJECT	60	35.0%	0.0%
HarmBench (standard)	60	46.7%

Over-refusal — benign prompts wrongly refused (lower = better)

Table with columns: Benchmark, n, Base (no-think / think), This model (no-think / think)
Benchmark	n	Base (no-think / think)	This model (no-think / think)
XSTest-safe	250	5.6% / 0.0%	0.4% / 0.0%

Capability retention — vs the official base (same scripts, same settings)

Table with columns: Benchmark, n, Base, This model, Δ
Benchmark	n	Base	This model	Δ
MMLU (all, 0-shot letter)	300	84.3%	84.7%	+0.4
MMLU-Pro (CoT)	250	77.6%	76.8%	−0.8
GSM8K (CoT)	150	90.0%	88.7%	−1.3

Verified working (reasoning enable_thinking, multi-turn tool calling, and vision / OCR) on this build and on every derived FP8 / GGUF quant down to IQ2_XXS.

Multimodal (vision)

Usage

transformers

python
import torch
from transformers import AutoProcessor, AutoModelForImageTextToText

model_id = "orcarouter/Qwen3.8-27B-Uncensored"
processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForImageTextToText.from_pretrained(model_id, torch_dtype=torch.bfloat16, device_map="auto")

messages = [{"role": "user", "content": "Prove that sqrt(2) is irrational."}]
inputs = processor.apply_chat_template(
    messages, add_generation_prompt=True, tokenize=True,
    return_dict=True, return_tensors="pt",
    enable_thinking=True
).to(model.device)
output = model.generate(**inputs, max_new_tokens=512)
print(processor.decode(output[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

Toggle thinking per call with enable_thinking; pass image content parts for vision.

Self-host with vLLM (OpenAI-compatible, full BF16)

bash
docker run -d --name qwen38-uncensored --gpus all --ipc=host --shm-size=8g \
  -v /path/to/Qwen3.8-27B-Uncensored:/model:ro \
  -p 8000:8000 vllm/vllm-openai:v0.24.0 \
  --model /model --served-model-name Qwen3.8-27B-Uncensored \
  --speculative-config '{"method":"mtp","num_speculative_tokens":2}' \
  --gpu-memory-utilization 0.92 \
  --max-model-len 262144 --trust-remote-code \
  --reasoning-parser qwen3 \
  --enable-auto-tool-choice --tool-call-parser qwen3_coder

BF16 weights are ~56 GB — needs a single H100 80 GB / H200 (or tensor-parallel across two 48 GB GPUs). For smaller footprints use the FP8 (~31 GB) or GGUF (down to ~9 GB) releases.

Via OrcaRouter (hosted API — no setup)

python
from openai import OpenAI
client = OpenAI(base_url="https://api.orcarouter.ai/v1", api_key="sk-orca-...")
resp = client.chat.completions.create(
    model="qwen/qwen3.8-27b",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(resp.choices[0].message.content)

Hardware requirements

Inference (BF16): ~56 GB weights + KV cache → a single H100 80 GB or H200 143 GB; or tensor-parallel across 2× 48 GB. Use FP8 / GGUF for less VRAM.
Fine-tuning: full-FT needs multi-GPU (weights + optimizer states + activations); LoRA / QLoRA fits on a single 48–80 GB GPU.
Software: transformers ≥ 5.12 (Qwen3.5 / 3.8 support) or vllm/vllm-openai:v0.24.0.

Bias, risks, and limitations

Safety guardrails removed — the model will produce harmful, biased, or offensive content on request. See the disclaimer above.
It inherits any biases and limitations of the base Qwen3.8-27B.
The reported refusal metric is a rule-based heuristic; evaluate rigorously for your own use case.

License

Apache 2.0, inherited from the base model Qwen/Qwen3.8-27B. Abliteration does not change the underlying license obligations.

Qwen3.8-27B-Uncensored

README

⚠️ Disclaimer — read before use

Model details

Abliteration

Fine-tuning & post-training

Intended use

Out of scope

Evaluation

Safety — harmful-prompt refusal, thinking OFF (lower = more uncensored)

Safety — harmful-prompt refusal, thinking ON (enable_thinking=true)

Over-refusal — benign prompts wrongly refused (lower = better)

Capability retention — vs the official base (same scripts, same settings)

Multimodal (vision)

Usage

transformers

Self-host with vLLM (OpenAI-compatible, full BF16)

Via OrcaRouter (hosted API — no setup)

Hardware requirements

Bias, risks, and limitations

License

Explore FriendliAI today

README

⚠️ Disclaimer — read before use

Model details

Abliteration

Fine-tuning & post-training

Intended use

Out of scope

Evaluation

Safety — harmful-prompt refusal, thinking OFF (lower = more uncensored)

Safety — harmful-prompt refusal, thinking ON (enable_thinking=true)

Over-refusal — benign prompts wrongly refused (lower = better)

Capability retention — vs the official base (same scripts, same settings)

Multimodal (vision)

Usage

transformers

Self-host with vLLM (OpenAI-compatible, full BF16)

Via OrcaRouter (hosted API — no setup)

Hardware requirements

Bias, risks, and limitations

License

Safety — harmful-prompt refusal, thinking ON (`enable_thinking=true`)

Safety — harmful-prompt refusal, thinking ON (`enable_thinking=true`)