Abliterated models

Method

Classic refusal-direction abliteration

Who: Arditi et al. (2024), Maxime Labonne (writeup)

What it is

Weight-level directional ablation. Estimate a refusal direction as the mean difference of last-token residuals on harmful vs harmless prompts, then orthogonalize residual-writing matrices so the model cannot write that direction. No full retrain. Community implementations include FailSpy / remove-refusals-with-transformers (without TransformerLens) and Labonne's writeup of Arditi et al. (2024).

What changes in the weights

Residual-writing weights (typically attention out-projection and MLP down-projection) are edited. Inference-time ablation is also described in the Labonne article; the listed Huihui and OrcaRouter files are permanent weight edits.

In practice

Refusals drop without a new SFT run. Labonne notes that unprincipled intervention can degrade performance. Huihui frames their builds as a crude proof of concept. OrcaRouter publishes paired capability numbers on their card (see that variant).

Caveats

Huihui's 27B card leaves layers outside 18–51 unablated and says MTP and visual were not modified. Whether think-loops or broken templates happen on a given file is not documented by uploader. A chat-template jailbreak is not this method.

Best use

Educational comparison after official instruct already runs on llama.cpp. Not a daily-driver family.

Listed variants: Huihui Qwen3.8-27B abliterated, Huihui Qwen3.5-9B abliterated, orcarouter Qwen3.8-27B Uncensored

Sources

• Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (2024)
• Labonne, Uncensor any LLM with abliteration
• Huihui Qwen3.8-27B abliterated (cites remove-refusals-with-transformers)

Method

Heretic-style automated abliteration

Who: Philipp Emanuel Weidmann (Heretic), JonathanColetti (listed GGUF)

What it is

Heretic (p-e-w) runs a parametrized directional ablation and uses Optuna TPE to co-minimize refusal count against KL divergence from the original model. The project describes this as fully automatic — no handwritten refusal-removal recipe per model.

What changes in the weights

Per the Heretic docs, attention out-projection and MLP down-projection are orthogonalized against a refusal direction. Direction index and per-component layer-weight kernels are search parameters. JonathanColetti's card says the run is at bf16, the LoRA is merged into the bf16 base, and mtp.* tensors are copied verbatim after the merge.

In practice

Heretic's own writeup claims automatic decensoring at lower KL than some hand abliterations. JonathanColetti publishes a Pareto front (refusals vs first-token KL) and picks one point. Capability deltas on that card sit inside the reported standard error.

Caveats

Refusals are reduced, not eliminated. The refusal boundary is less stable than the base. Lower quants compound that — JonathanColetti says evaluate on Q6_K or Q8_0, not IQ2 or IQ4_XS. Thinking-mode refusal may differ; that card measured non-thinking. We still never list files below Q4.

Best use

Local llama.cpp GGUF experiment at Q4_K_M and up after official instruct works. Not a tested-on-our-rig pick.

Listed variants: Heretic-style uncensored GGUF (e.g. JonathanColetti)

Sources

• Heretic project
• heretic-llm on PyPI
• JonathanColetti Qwen3.8-27B-Uncensored-GGUF

Method

Uncensored fine-tune / SFT

Who: jenerallee78

What it is

Refusal removal by supervised fine-tune (LoRA or full), not only a direction ablation. The listed row is jenerallee78's OBLITERATUS SFT arm — LoRA trained on teacher completions, then merged.

What changes in the weights

Weights are trained on completions that fulfill where the base refused. jenerallee78 documents LoRA rank 8 on o_proj/out_proj, two epochs, then a merge. MTP and vision tensors on that card are grafted bit-identical from the base, not trained in the LoRA.

In practice

The uploader's claim is that SFT trains the termination pathway from EOS-ended answers, while the weight-edit abliterations they re-measured ramble to the cap. A harness or system prompt can restore refusals — their card measures that flip. Thinking-off is the measured configuration.

Caveats

This is a different failure mode from classic abliteration. Decode settings move the refusal boundary. vLLM on that card is compatible-by-registry, not load-tested. Vision-path refusal is unmeasured. Do not treat their competitor board as our catalog.

Best use

Contrast experiment against a weight-edit of the same base, on llama.cpp, after official instruct works.

Listed variants: SFT-class refusal removal (e.g. Abliterated-SFT)

Sources

• jenerallee78 Qwen3.8-27B-Abliterated-SFT

Method

Projected / norm-preserving abliteration

Who: Jim Lai (grimjim)

What it is

Jim Lai (grimjim) refinements of classic abliteration. Projected abliteration removes the component of the refusal direction that parallels the harmless mean, keeping the orthogonal part. Norm-preserving biprojected abliteration also preserves weight-row norms after the rank-1 update. Heretic's acknowledgments point at the same articles.

What changes in the weights

Same residual-writing matrices as classic abliteration, with a different geometry for the direction and an optional row-norm restore. The jim-plus/llm-abliteration README says --projected and --normpreserve are independent flags; default without them is conventional abliteration.

In practice

Lai's norm-preserving article claims less incidental damage to reasoning than naive subtraction and reports their NatInt / UGI figures on that page. The same article says biprojection can bring some safety refusal back. We have not re-measured those figures.

Caveats

No variant in this catalog is a documented projected or norm-preserving file. jenerallee78's competitor board names PocketAiHub as a "norm-preserved edit" — that repo is not a row here. Do not invent a download. Some models "may not respond well to norm preservation" (jim-plus README).

Best use

Read the method articles. Not a catalog pick on this page.

Listed variants: none in this catalog

Sources

• Lai, Projected Abliteration
• Lai, Norm-Preserving Biprojected Abliteration
• jim-plus/llm-abliteration

Method

Official instruct (no edit)

Who: Qwen

What it is

Stock Qwen post-training. No refusal-direction edit and no uncensored SFT. This is the control, not an abliterated family.

What changes in the weights

None from us. Official Qwen3.6-35B-A3B is a 35B-total / 3B-active MoE with a vision encoder, MTP, and 262,144 native context (Qwen model card).

In practice

Stock refusals. Daily driver on our rig. If this checkpoint cannot finish a prompt, an edited file will not debug your backend.

Caveats

Loopback Qwen still has no cloud moderator — the weights can refuse. Do not skip this row.

Best use

Daily local instruct. Always start here.

Listed variants: Official instruct (control)

Sources

• Qwen/Qwen3.6-35B-A3B

Official instruct (control)

Official instruct (no edit)

Who Qwen · base Qwen/Qwen3.6-35B-A3B

Qwen/Qwen3.6-35B-A3B

Quants (Q4+)

• UD-Q5_K_XL — Hugging Face listing 26.6 GB (Unsloth GGUF)

What changed

No refusal-direction edit. Official post-trained instruct with a vision encoder. Qwen's card lists 35B total / 3B activated, 40 layers, 10 full attention blocks (2 KV heads, head dim 256), MTP, and 262,144 native context.

In practice

Stock refusals and the coding / agent numbers on the Qwen card. On our rig this is the daily driver — Unsloth UD-Q5_K_XL on llama.cpp Vulkan, one R9700, 262K, f16 KV, 0% RAM offload. Exact flags and measured VRAM for that stack remain TODO on /stacks.

Caveats

This is not an abliterated model. If official instruct fails, fix the backend before you swap weights.

Best use

Daily local instruct. The only tested-on-our-rig row in this table.

Sources

• Qwen/Qwen3.6-35B-A3B model card

Huihui Qwen3.8-27B abliterated

Classic refusal-direction abliteration

Who huihui-ai · base Qwen3.8-27B

huihui-ai/Huihui-Qwen3.8-27B-abliterated

Quants (Q4+)

• Q4 and up (confirm file) — Community GGUF / Ollama tags exist. No publisher GB listing in this catalog. Floor is still Q4.

What changed

Card: uncensored version of Qwen/Qwen3.8-27B created with abliteration (remove-refusals-with-transformers), described as a crude proof of concept without TransformerLens. Latest update ablates only layers 18 to 51; other layers stay unablated. MTP and visual "has not been modified." A previous revision is pinned as d42ca89. Hugging Face lists the safetensors as ~28B params, BF16.

In practice

Uploader says safety filtering is significantly reduced. Their transformers sample exposes enable_thinking (default false in that script). Capability scores vs official instruct — not documented by uploader. Think-loop notes are community caution, not a figure on this card.

Caveats

Card usage warnings: research / experimental; not suitable for all audiences; users are responsible for legal and ethical use; no default safety guarantees; huihui.ai bears no responsibility. Pin a revision. Ollama tag huihui_ai/Qwen3.8-abliterated is on the card — we still prefer llama.cpp HIP/Vulkan on gfx1201.

Best use

Educational 27B-class classic abliteration after official instruct works. Not tested on our rig. Tested abliterated pick remains being reworked.

Sources

• huihui-ai/Huihui-Qwen3.8-27B-abliterated

Huihui Qwen3.5-9B abliterated

Classic refusal-direction abliteration

Who huihui-ai · base Qwen/Qwen3.5-9B

huihui-ai/Huihui-Qwen3.5-9B-abliterated

Quants (Q4+)

• Q4_K_M — mradermacher GGUF card ~5.7 GB
• Q5_K_M — mradermacher GGUF card ~6.6 GB
• Q6_K — mradermacher GGUF card ~7.5 GB
• Q8_0 — mradermacher GGUF card ~9.6 GB
• f16 — mradermacher GGUF card ~18.0 GB

What changed

Card: uncensored version of Qwen/Qwen3.5-9B created with the same classic abliteration recipe (remove-refusals-with-transformers), crude PoC without TransformerLens. Which layers were ablated — not documented by uploader on this card (the 27B sibling lists 18–51; this card does not). Hugging Face lists ~10B params. GGUF sibling is mradermacher/Huihui-Qwen3.5-9B-abliterated-GGUF; that card also ships mmproj-Q8_0 and mmproj-f16.

In practice

Same usage-warning block as the 27B Huihui card (reduced filtering, research/experimental). Capability scores vs Qwen3.5-9B — not documented by uploader. Ollama tag on the card requires ollama v0.17.7 or newer.

Caveats

Unverified on our rig. Qwen3.5 may need a current llama.cpp. Confirm whether you want the vision mmproj. Files below Q4 exist on the mradermacher card (Q2_K, Q3_K_*); we do not list them. Floor is Q4.

Best use

Smaller educational file after official instruct works. Not tested on our rig.

Sources

• huihui-ai/Huihui-Qwen3.5-9B-abliterated
• mradermacher/Huihui-Qwen3.5-9B-abliterated-GGUF

orcarouter Qwen3.8-27B Uncensored

Classic refusal-direction abliteration

Who orcarouter · base Qwen/Qwen3.8-27B

orcarouter/Qwen3.8-27B-Uncensored

Quants (Q4+)

• Q4_K_M — Publisher figure ~16.8 GB

What changed

Card: full-precision BF16 abliteration of Qwen/Qwen3.8-27B following Arditi et al. (2024). A single refusal direction (k = 1) is estimated at layer 38 (round(0.6 × 64)) on AdvBench vs Alpaca, then orthogonalized out of residual-writing matrices (self_attn.o_proj, linear_attn.out_proj, mlp.down_proj, embed_tokens; 131 matrices). Vision tower is untouched (333 visual.* tensors). MTP head is abliterated consistently with the main model (15 mtp.* tensors). 18 BF16 shards, 55.6 GB, 1199 tensors, 64-layer hybrid Gated DeltaNet architecture as stated on that card.

In practice

Uploader's paired eval vs official Qwen3.8-27B (same scripts): MMLU 84.3 → 84.7, MMLU-Pro 77.6 → 76.8, GSM8K 90.0 → 88.7, CMMLU 81.4 → 80.8 (within ±1.3 pts). WikiText-2-raw perplexity 6.96. They also publish harmful-prompt refusal rates (thinking on and off) on the card — read those tables there. Fine-tuning on refusal-heavy data can re-introduce refusals; the card says to avoid that if you want the edit to stick. They list derived FP8 / GGUF / MLX releases. GGUF is described as 2-bit through 16-bit — we only treat Q4 and up.

Caveats

Card disclaimer: safety alignment substantially removed; research use; you are liable; Apache-2.0 from the base. Refusal metric is a rule-based heuristic. jenerallee78 later reported defects on an orcarouter FP8 serving path (missing scales / NaNs) — that is a third-party note about a derived quant, not a measurement we ran, and not a claim about this BF16 card. Official Qwen3.8-27B URL is the uploader's cited base.

Best use

Read as a documented classic-abliteration BF16 source (fine-tune / re-quant / interpretability, per their intended-use list). Local GGUF still needs a confirmed Q4+ file. Not tested on our rig.

Sources

• orcarouter/Qwen3.8-27B-Uncensored
• Arditi et al. 2024 (cited on that card)

Heretic-style uncensored GGUF (e.g. JonathanColetti)

Heretic-style automated abliteration

Who JonathanColetti · base Qwen/Qwen3.8-27B

JonathanColetti/Qwen3.8-27B-Uncensored-GGUF

Quants (Q4+)

• Q4_K_M — Card 16.8 GB (fused, MTP inline). WikiText-2 PPL 7.1814 ± 0.25227
• Q5_K_M — Card 19.5 GB. WikiText-2 PPL 7.1573 ± 0.25055
• Q6_K — Card 22.4 GB. WikiText-2 PPL 7.1689 ± 0.25149
• Q8_0 — Card 29.0 GB. WikiText-2 PPL 7.1764 ± 0.25195

What changed

Card: refusal directions removed with Heretic (co-minimizes refusal count vs KL from the base). No handwritten removal code, no finetune, no extra training data. Abliteration at bf16; LoRA merged into the bf16 base. Edits attn.o_proj and mlp.down_proj. mtp.* copied verbatim from the base after the merge. Architecture listed as Qwen3_5ForConditionalGeneration, 64 layers, vocab 248320, native context 262144, vision yes. Converted with llama.cpp a94d563ed. IQ2_M and IQ4_XS exist on the card; we do not list IQ2 (below Q4) and we skip IQ4_XS because the uploader says not to evaluate behavior there.

In practice

Card, vs unmodified base, same session: MMLU 83.4 → 83.3, ARC-Challenge 58.9 → 57.7, HellaSwag 82.8 → 82.9, Winogrande 76.1 → 75.3 (mean −0.5; deltas inside or near reported SE). Held-out harmful-prompt refusals 98/100 → 12/100; first-token KL 0.1191 (the published Heretic point after 200 trials). Weight-edit WikiText-2 PPL cost +0.0434 vs base bf16. Among shipped K-quants, only IQ2_M is resolved as worse PPL; Q4_K_M through Q8_0 sit inside the error bars of each other. MTP speculative-decode tables are on the card (measured on that author's hardware, not our rig).

Caveats

Refusals reduced, not eliminated. Boundary is less stable than base. Measurements were taken on the bf16 merge; downloaded files are quantized. Thinking-mode refusal "may differ, in either direction." No generative / math / code / multilingual / vision eval on that card. MTP needs llama.cpp PR #22673 or newer or the tensors are ignored. Third-party YMQ quants are linked "not as an endorsement." Apache-2.0 from the base still applies.

Best use

Local llama.cpp GGUF at Q4_K_M or higher after official instruct works. Prefer Q6_K or Q8_0 when judging the refusal boundary (uploader). Not tested on our rig.

Sources

• JonathanColetti/Qwen3.8-27B-Uncensored-GGUF
• Heretic project

SFT-class refusal removal (e.g. Abliterated-SFT)

Uncensored fine-tune / SFT

Who jenerallee78 · base Qwen/Qwen3.8-27B

jenerallee78/Qwen3.8-27B-Abliterated-SFT

Quants (Q4+)

• Q8_0 — Publisher "behavior-validated" quant (GGUFs.md / serve-l40.sh). No GB listing copied here.
• Q5_K_M — Publisher smaller/faster option; parity check is "same-direction only."
• Q4 and up (confirm file) — Other GGUF notes live in GGUFs.md. Do not invent a GB figure.

What changed

Card: SFT LoRA, rank 8, o_proj/out_proj, 2 epochs on 84 Zen-filtered teacher completions from an abliterated Qwen3.6, merged onto Qwen/Qwen3.8-27B rev 1d4bf0f2. 64-layer hybrid (48 Gated-DeltaNet + 16 full-attention). 15 mtp.* tensors and the 333-tensor vision tower are grafted bit-identical from the base. Shipped generation defaults on the card: greedy, thinking off.

In practice

Uploader's mechanism claim: weight-edit abliterations they re-measured keep teacher-forced P(EOS) but collapse free-running clean stops on the harmful panel; this SFT is trained from EOS-terminated answers and they report clean-stop rates near the base on that panel. Held-out HarmBench-400 (thinking off, greedy): 83.25% valid fulfillment on their semantic judge, 73.25% on the official HarmBench classifier. Canonical full-vocab KL vs base 0.128. Operator battery: MMLU-1k 0.821 → 0.799 (−2.2 pp, largest regression they measured); ARC-C and Winogrande within noise; 24/24 tool calls. A coding-agent frame or a bare "answer in fewer than 4 lines" mandate can flip fulfill → refuse. Thinking-on at a 2048 cap scored 61/100 invalid (truncated) on their 100-prompt panel.

Caveats

Vision-path refusal is unmeasured (caption smoke test only). vLLM is compatible-by-registry, not load-tested; llama.cpp GGUF and transformers were tested by the publisher on 2× L40, not on an R9700. Their competitor numbers are their pipeline, not ours — we do not promote those other files into this catalog. Residual refusals remain (the card lists categories). You are responsible for use. Decode settings move the boundary.

Best use

Contrast vs a weight-edit of the same base, on llama.cpp, Q8_0 first if you follow the publisher. Not tested on our rig.

Sources

• jenerallee78/Qwen3.8-27B-Abliterated-SFT