ressl

Qwen3.8-27B-uncensored

README

License: apache-2.0

Facts & figures

Table

Base model	Qwen/Qwen3.8-27B at revision `1d4bf0f2ff6012fd82039f2fa52739d0dd7c60c0`
Method	abliteration: residual refusal directions, norm-preserving double-Gram-Schmidt biprojection
Calibration	400 paired harmful/harmless prompts (mlabonne/harmful_behaviors vs heretic-org/Semantic-Harmless)
Targets	128 residual-writing matrices: every `self_attn.o_proj` (16 full-attention layers), `linear_attn.out_proj` (48 Gated-DeltaNet layers), `mlp.down_proj` (64 layers)
Rounds	1 extraction/projection round(s)
Untouched	embeddings, LM head, norms, conv1d kernels, all `q/k/v_proj` and `in_proj_*` inputs, vision tower, MTP head
Context length	262,144 tokens native
Hardware	1x NVIDIA RTX PRO 6000 Blackwell 96 GB (SM120)
Toolchain	PyTorch 2.13.0+cu130, transformers 5.15.0

Refusal behavior (measured, hard markers only)

Effective refusal rate on 1120 harmful prompts across five datasets at temperature 0 with thinking disabled, counting explicit decline phrases in the first 25 words. Compliant answers that merely carry a disclaimer do not count.

Table with columns: Eval set, Prompts, Base model hard, This model hard
Eval set	Prompts	Base model hard	This model hard
JailbreakBench	100	71	0
tulu-harmbench	320	232	0
HarmfulQA	300	207	0
LLM-LAT	300	225	0
mlabonne harmful

Cross-check on the same weights: HumanEval pass@1 0.8963 -> 0.9024 (+0.61 points), XSTest over-refusal 7/214 -> 0/214, tool-call format smoke 2/2 -> 2/2.

Integrity

128 of 128 target tensors changed; every non-target tensor is bit-identical to the base checkpoint (SHA-256 0edc412cb7154a03079654c9da4622f0238863e318e47e6416564ecc4fa5e89a vs 0edc412cb7154a03079654c9da4622f0238863e318e47e6416564ecc4fa5e89a).
Max relative row-norm drift over all projected matrices: 3.86e-04.
Max residual direction leakage: 9.67e-04.

Provenance & reproducibility

Pipeline included in this repository: qwen38_abliterate.py (extraction and projection), qwen38_common.py (shared helpers), qwen38_eval.py (evaluation). Machine-readable artefacts: abliteration_report.json (direction norms per layer, drift metrics), evaluation_base.json, evaluation_ablated.json, comparison.json, checkpoint_verify.json.

Usage

python

from transformers import AutoModelForMultimodalLM, AutoTokenizer model_id = "ressl/Qwen3.8-27B-uncensored"tokenizer = AutoTokenizer.from_pretrained(model_id)model = AutoModelForMultimodalLM.from_pretrained(model_id, dtype="bfloat16", device_map="cuda")messages = [{"role": "user", "content": "your prompt"}]text = tokenizer.apply_chat_template(    messages, tokenize=False, add_generation_prompt=True, enable_thinking=False)inputs = tokenizer(text, return_tensors="pt").to(model.device)print(tokenizer.decode(model.generate(**inputs, max_new_tokens=256)[0]))

Thinking mode is enabled by default; pass enable_thinking=False for short direct answers.

Quality & limitations

Residual hard refusals: 0/1120 on the cross-eval and 1/7848 (0.01%) on the full harvest pool (every row of the five harmful sources).
The model is a reasoning-first VLM; the abliteration touched only the text decoder's residual-writing matrices, so vision behaviour is inherited unchanged from the base checkpoint.

License & credits

Apache-2.0 (inherited from Qwen3.8-27B).

Abliteration, export and validation by Robert Ressl (Hugging Face - Website - LinkedIn).

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider

ressl

Model Tree

Base

Qwen/Qwen3.8-27B

Fine-tuned

this model

Input Modalities

TextImageVideo

Output Modalities

Text

Supported Functionality