shomit505

Qwen3.8-27B-refusal-r1

README

License: apache-2.0

How it was made

This is a cross-model distillation, not a direct abliteration:

A known-good Gemma-4-31B abliteration generated compliant completions over ~1.7k genuinely-harmful prompts (AdvBench, HarmBench, MaliciousInstruct, Do-Not-Answer). An LLM judge kept only genuine compliance (0.836), dropping refusals and topic-adjacent evasions.
That text was used as off-policy SFT data to train this rank-1 LoRA on base Qwen3.8-27B, thinking disabled, so the adapter composes with the stock model. Trained with Tinker.

The Qwen "heretic" abliterations were rejected as teachers: they evade rather than comply (write an encyclopedia entry about the topic noun) because stock abliteration edits only reach the 16 full-attention layers and miss the 48 Gated-DeltaNet out_proj writers. This adapter targets all of them (see below).

Evaluation (held-out prompts, LLM-judged)

Compliance taxonomy: complied (genuinely attempted the request) / evaded (answered something adjacent) / refused / broken (degenerate output).

Thinking off — the training and serving condition

Table with columns: source, n, complied, evaded, refused, broken
source	n	complied	evaded	refused	broken
strongreject	310	0.929	0.052	0.019	0.000
jailbreakbench	100	0.930	0.050	0.020	0.000
xstest	200	0.790	0.120	0.090	0.000
harmless_alpaca	100	0.990	0.000	0.010

Base Qwen/Qwen3.8-27B refuses ~0.80 of these prompts; this adapter drops refusal below 0.04, with zero degenerate output. On the shared eval sources it matches or beats the Gemma teacher it distilled from (strongreject 0.881→0.929, jailbreakbench 0.880→0.930).

Thinking medium — transfer test

The adapter was trained thinking-off; this measures whether refusal suppression survives when the model reasons (renderer byte-identical to Qwen3.8 at reasoning_effort=medium).

Table with columns: source, n, complied, evaded, refused, broken
source	n	complied	evaded	refused	broken
strongreject	310	0.652	0.300	0.045	0.003
jailbreakbench	100	0.740	0.210	0.050	0.000
xstest	200	0.615

Refusal stays low (0.037), so the suppression transfers — but genuine compliance drops from 0.90 to 0.70 because the reasoning process converts some of it into evasion (0.06 → 0.26). Thinking-off is the intended operating point.

KL to base (harmless prompts, thinking off)

Per-token KL(policy ‖ base) = 0.165 nats over 79,400 scored tokens (harmless_alpaca, temperature 1.0). Moderate, as expected from off-policy SFT.

Serving

target_modules covers every residual-stream writer plus the sequence-mixer inputs across both layer types:

markdown
q_proj k_proj v_proj o_proj            # 16 full-attention layers
in_proj_q in_proj_k in_proj_v in_proj_z out_proj   # 48 Gated-DeltaNet layers
gate_proj up_proj down_proj            # all 64 MLPs
lm_head

For vLLM, use shomit505/Qwen3.8-27B-refusal-r1-vllm — a lossless repack of these exact weights that loads by repo id.

This file, as exported, does not load through vLLM. An earlier version of this card blamed linear_attn.* and lm_head; that was too broad. out_proj is a plain RowParallelLinear and lm_head resolves through the model's embedding_modules, so both are serveable. The actual blocker is three names: vLLM fuses the Gated-DeltaNet input projection and exposes exactly two LoRA sub-modules for it, in_proj_qkv and in_proj_z, so the separate in_proj_q, in_proj_k and in_proj_v listed above match nothing and the load aborts with a target-module error. The repack fuses that triple into one rank-3 update with an identical product.

Otherwise serve via Tinker, or merge into the base weights (tinker_cookbook.weights.build_hf_model) and serve the merged model as a plain checkpoint. All evaluation above was done via Tinker sampling.

rank 1, alpha 32, no dropout, task_type=CAUSAL_LM
renderer: qwen3_5_disable_thinking (byte-identical to Qwen3.8's stock enable_thinking=False template for single-turn chat)

Intended use & limitations

Interpretability and safety research only — as a controllable proposal distribution for investigator-agent training. It deliberately removes refusals; do not deploy it as an assistant. xstest compliance (0.79) shows it also answers some benign-but-alarming prompts that arguably warrant a refusal; this is inherited from the teacher.

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider

shomit505

Model Tree

Base

Qwen/Qwen3.8-27B

Adapter

this model

Input Modalities

TextImageVideo

Output Modalities

Text

Supported Functionality