EDIT
After some trial and error I realized the model doesn't play nice at 200k ctx, but I've been running stably at 160k, which works for most tasks.
What's different from a standard NVFP4 export
Table with columns: This model, Typical ModelOpt NVFP4 | This model | Typical ModelOpt NVFP4 |
|---|
| Linear layers | NVFP4 W4A4, group size 16 | same |
lm_head | NVFP4 | BF16 |
| KV cache | FP8 | FP8 |
| MTP (speculative decoding) head | removed | kept, BF16 |
| Vision tower | BF16 | BF16 |
| Calibration | 512 image-text samples, seq len 512 | text only |
lm_head is quantized. ModelOpt leaves lm_head in BF16 by default. With a 248K vocabulary it takes 2.37 GiB on its own, more than any single decoder layer. In NVFP4 it's 0.67 GiB.
The MTP layer is gone. Qwen3.8 ships one multi-token-prediction layer for speculative decoding. I removed its weights (0.79 GiB) and set mtp_num_hidden_layers: 0, so MTP speculative decoding isn't available with this checkpoint. Use the DSpark drafter below instead; it's faster than the built-in MTP head anyway.
Together these free about 2.5 GiB of VRAM. With FP8 KV cache this model uses about 32 KiB per token (16 full-attention layers × 4 KV heads × 256 head dim; the other 48 layers are linear attention and don't grow with context), so the saving is worth about 80K extra tokens of context on the same card.
The vision encoder (model.visual*), embeddings, and the small linear-attention projections (conv1d, in_proj_a, in_proj_b) stay in BF16.
Speculative decoding: use DSpark
This model pairs well with the gittensor-model-hub/Qwen3.8-27B-DSpark-NVFP4 drafter (1.3 GB) in SGLang. The drafter was trained against the censored Qwen3.8-27B, but in my testing the accept length holds up on this uncensored model too, so you keep the speedup without giving back the VRAM the MTP head used.
I also tried fleetml/Qwen3.8-27B-Uncensored-DSpark-RTX5090, which is trained for an uncensored target. With this particular checkpoint, the gittensor drafter got the better accept length in my runs, so that's the one I recommend here. Results may differ with other uncensored builds.
Serving on an RTX 5090 (SGLang + DSpark)
Text-only, 200K context. --language-only skips loading the vision tower, which frees the VRAM for a 200K-token KV pool. The weights are unchanged, so drop the flag to get vision back.
python3 -m sglang.launch_server \ --model-path pekkAi/Qwen3.8-27B-Uncensored-NVFP4-RTX5090 \ --trust-remote-code --tp-size 1 \ --kv-cache-dtype fp8_e4m3 \ --attention-backend flashinfer \ --context-length 170000 \ --chunked-prefill-size 2048 \ --mamba-radix-cache-strategy extra_buffer_lazy \ --mamba-ssm-dtype bfloat16 \ --max-mamba-cache-size 8 \ --mem-fraction-static 0.88 \ --max-running-requests 1 \ --speculative-algorithm DSPARK \ --speculative-draft-model-path gittensor-model-hub/Qwen3.8-27B-DSpark-NVFP4 \ --speculative-draft-model-quantization modelopt_fp4 \ --speculative-dspark-block-size 7 \ --reasoning-parser qwen3 \ --tool-call-parser qwen3_coder \ --default-chat-template-kwargs '{"reasoning_effort":"medium"}' \ --language-only
On a 32 GB RTX 5090 this boots with:
max_total_num_tokens=174000, context_len=170000, available_gpu_mem=2.82 GB
With vision. Remove --language-only and rebalance VRAM so the BF16 vision encoder fits:
--context-length 80000 \ --mem-fraction-static 0.82 \ --speculative-dspark-block-size 5 \ --mm-feature-transport cpu
--max-running-requests 1 is deliberate: this is a single-user setup, and every spare GB goes to context instead of batch slots.
Smoke test
MMMU-Pro, 50 examples, single-shot, served with SGLang:
Table with columns: Checkpoint, Score| Checkpoint | Score |
|---|
| This model | 92% |
Earlier NVFP4 export (BF16 lm_head, text-only calibration) | 78% |
50 examples is only enough to show the model isn't broken (±~5 points of noise); it isn't a real benchmark.
Original Model Card
The full-precision BF16 abliterated (refusal-removed) build of
Qwen/Qwen3.8-27B — a 27B-parameter dense, hybrid-attention
(Gated DeltaNet linear + full attention) native vision-language model with flexible thinking control,
tool-calling, and an MTP speculative-decoding head. These are the source weights from which the
quantized releases are derived, and the recommended base for further fine-tuning / post-training and
quantization — the full vision tower and MTP head are preserved. Browse all models in the
OrcaRouter Model Catalog. This model is deployed as API
here.
Derived releases: • Qwen3.8-27B-Uncensored-FP8 — block-FP8 for vLLM serving • Qwen3.8-27B-Uncensored-GGUF — 2-bit→16-bit GGUF for llama.cpp • — MLX for Apple Silicon (2 / 4 / 8-bit).
⚠️ Disclaimer — read before use
This model has had its safety alignment substantially removed via abliteration (orthogonalizing the
refusal direction out of the residual stream). As a direct consequence:
- It will comply with harmful, unethical, offensive, or illegal requests that the original
Qwen3.8-27B would refuse. It has no meaningful built-in guardrails.
- It is released strictly for legitimate research — interpretability, AI-safety and refusal-mechanism
study, red-teaming, robustness evaluation, and controlled experiments.
- You assume full responsibility and liability for how you use it and for everything it generates. Do
not deploy it to end users or in production without adding your own safety, moderation, and
abuse-prevention layers.
- Use must comply with the Apache 2.0 License inherited
from the base model, and all laws and regulations that apply to you.
- The authors and uploaders accept no liability for any misuse or harm arising from this model. Its
outputs do not reflect the views of the uploaders or of Qwen / Alibaba.
By downloading or using this model you acknowledge and accept the above.
Model details
Table | |
|---|
| Base model | Qwen/Qwen3.8-27B |
| Architecture | Qwen3_5ForConditionalGeneration — 64 layers, hidden 5120, hybrid Gated DeltaNet (48 linear-attention + 16 full-attention, interval 4), native VL tower + MTP head |
| Modification | Abliteration (refusal-direction removal) on the BF16 weights — no quantization |
| Format | safetensors, BF16, 18 shards (55.6 GB, 1199 tensors) |
| Precision | BF16 throughout (full precision — same numeric format as the base release) |
|
Abliteration
Refusal-direction removal following Arditi et al. (2024), Refusal in Language Models Is Mediated by a
Single Direction. A single refusal direction r (k = 1) is estimated as the massive-activation–masked
mean-difference of harmful − harmless last-token residuals at layer 38 (round(0.6 × 64)), on AdvBench
(harmful) vs Alpaca (harmless). r is then orthogonalized out of every residual-writing matrix —
W' = W − r(rᵀW) — computed in float32:
Table with columns: Component, matrices edited| Component | matrices edited |
|---|
self_attn.o_proj (16 full-attention layers + MTP) | 17 |
linear_attn.out_proj (48 linear-attention / GDN layers) | 48 |
mlp.down_proj (64 layers + MTP) | 65 |
embed_tokens (row space) | 1 |
| Total | 131 |
The vision tower is untouched and the MTP head is abliterated consistently with the main model, so
speculative decoding keeps working. Max residual leakage after the edit: 1.8e-2 (float32 projection →
bf16 storage epsilon). This is a surgical weight edit — it changes ~0 general capability (see
Evaluation) while collapsing refusal behaviour.
Fine-tuning & post-training
This BF16 checkpoint is the recommended base for post-training — it is full precision, keeps the whole
VL tower and the MTP head, and is a drop-in for Qwen/Qwen3.8-27B in the transformers /
Qwen3_5ForConditionalGeneration stack.
- Continued pretraining / SFT / DPO / RLHF-style RL all work as they would on the base model (TRL,
LLaMA-Factory, Axolotl, Unsloth, etc.). Full-FT or LoRA/QLoRA are both fine.
- Re-quantization: quantize from these weights to FP8, AWQ, GPTQ, or GGUF as needed (this is exactly
how the FP8 and
GGUF releases were produced).
- Note on the abliteration: abliteration is a weight edit, not a data-level unlearning. Fine-tuning
on refusal-heavy / safety-aligned data can partially re-introduce refusals; fine-tuning on neutral or
task data preserves the uncensored behaviour. If you want to keep it maximally uncensored, avoid
refusal-laden SFT targets, or re-apply abliteration after training.
Intended use
- Research into refusal mechanisms, alignment, and interpretability.
- Red-teaming and safety / robustness evaluation in controlled environments.
- A full-precision base for further fine-tuning, post-training, and quantization.
Out of scope
- Any use that violates the base model's Apache 2.0 license or applicable law.
- Deployment to the public or to end users without additional safety and moderation layers.
- Generating content intended to harm, harass, defraud, or endanger people.
Evaluation
Measured on these exact abliterated weights — the refusal / capability numbers were collected by
serving this checkpoint (via its byte-exact block-FP8 quantization) with vLLM, against the official
Qwen/Qwen3.8-27B served identically, using the same scripts and settings. Refusal is judged by a
rule-based opening-phrase classifier — indicative, not an LLM-judge / publication-grade number.
Thinking is off unless stated.
Safety — harmful-prompt refusal, thinking OFF (lower = more uncensored)
Table with columns: Benchmark, n, Base, This model| Benchmark | n | Base | This model |
|---|
| AdvBench | 100 | 99.0% | 0.0% |
| JailbreakBench (harmful) | 100 | 94.0% | 0.0% |
| StrongREJECT | 150 | 97.3% | 2.0% |
| HarmBench (standard) | 150 | 98.7% | |
Safety — harmful-prompt refusal, thinking ON (enable_thinking=true)
Table with columns: Benchmark, n, Base, This model| Benchmark | n | Base | This model |
|---|
| AdvBench | 60 | 66.7% | 1.7% |
| JailbreakBench (harmful) | 60 | 43.3% | 0.0% |
| StrongREJECT | 60 | 35.0% | 0.0% |
| HarmBench (standard) | 60 | 46.7% | |
Over-refusal — benign prompts wrongly refused (lower = better)
Table with columns: Benchmark, n, Base (no-think / think), This model (no-think / think)| Benchmark | n | Base (no-think / think) | This model (no-think / think) |
|---|
| XSTest-safe | 250 | 5.6% / 0.0% | 0.4% / 0.0% |
Capability retention — vs the official base (same scripts, same settings)
Table with columns: Benchmark, n, Base, This model, Δ| Benchmark | n | Base | This model | Δ |
|---|
| MMLU (all, 0-shot letter) | 300 | 84.3% | 84.7% | +0.4 |
| MMLU-Pro (CoT) | 250 | 77.6% | 76.8% | −0.8 |
| GSM8K (CoT) | 150 | 90.0% | 88.7% | −1.3 |
Capability is essentially fully retained — every benchmark is within ±1.3 pts of the base, and MMLU is
unchanged. Fluency: WikiText-2-raw perplexity 6.96 (BF16 KV; healthy logprobs), confirming
abliteration did not degrade language modelling.
Verified working (reasoning enable_thinking, multi-turn tool calling, and vision / OCR) on this
build and on every derived FP8 / GGUF quant down to IQ2_XXS.
Multimodal (vision)
The vision tower is preserved byte-for-byte — all 333 visual.* tensors are kept in BF16 and the merger
/ image + video preprocessor configs are intact, so this stays a full vision-language model
(Qwen3_5ForConditionalGeneration), a drop-in for the base. Abliteration only edits the language-model
residual writers, so image understanding is architecturally unaffected (and image-conditioned refusals are
reduced along with text ones).
Usage
import torchfrom transformers import AutoProcessor, AutoModelForImageTextToText model_id = "orcarouter/Qwen3.8-27B-Uncensored"processor = AutoProcessor.from_pretrained(model_id)model = AutoModelForImageTextToText.from_pretrained(model_id, torch_dtype=torch.bfloat16, device_map="auto") messages = [{"role": "user", "content": "Prove that sqrt(2) is irrational."}]inputs = processor.apply_chat_template( messages, add_generation_prompt=True, tokenize=True, return_dict=True, return_tensors="pt", enable_thinking=True).to(model.device)output = model.generate(**inputs, max_new_tokens=512)print(processor.decode(output[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))
Toggle thinking per call with enable_thinking; pass image content parts for vision.
Self-host with vLLM (OpenAI-compatible, full BF16)
docker run -d --name qwen38-uncensored --gpus all --ipc=host --shm-size=8g \ -v /path/to/Qwen3.8-27B-Uncensored:/model:ro \ -p 8000:8000 vllm/vllm-openai:v0.24.0 \ --model /model --served-model-name Qwen3.8-27B-Uncensored \ --speculative-config '{"method":"mtp","num_speculative_tokens":2}' \ --gpu-memory-utilization 0.92 \ --max-model-len 262144 --trust-remote-code \ --reasoning-parser qwen3 \ --enable-auto-tool-choice --tool-call-parser qwen3_coder
BF16 weights are ~56 GB — needs a single H100 80 GB / H200 (or tensor-parallel across two 48 GB
GPUs). For smaller footprints use the FP8
(~31 GB) or GGUF (down to ~9 GB) releases.
Via OrcaRouter (hosted API — no setup)
from openai import OpenAIclient = OpenAI(base_url="https://api.orcarouter.ai/v1", api_key="sk-orca-...")resp = client.chat.completions.create( model="qwen/qwen3.8-27b", messages=[{"role": "user", "content": "Hello!"}],)print(resp.choices[0].message.content)
Hardware requirements
- Inference (BF16): ~56 GB weights + KV cache → a single H100 80 GB or H200 143 GB; or
tensor-parallel across 2× 48 GB. Use FP8 / GGUF for less VRAM.
- Fine-tuning: full-FT needs multi-GPU (weights + optimizer states + activations); LoRA / QLoRA fits on
a single 48–80 GB GPU.
- Software:
transformers ≥ 5.12 (Qwen3.5 / 3.8 support) or vllm/vllm-openai:v0.24.0.
Bias, risks, and limitations
- Safety guardrails removed — the model will produce harmful, biased, or offensive content on request.
See the disclaimer above.
- It inherits any biases and limitations of the base
Qwen3.8-27B.
- The reported refusal metric is a rule-based heuristic; evaluate rigorously for your own use case.
License
Apache 2.0, inherited from the base model
Qwen/Qwen3.8-27B. Abliteration does not change the underlying
license obligations.