Qwen3.8-27B OBLITERATED: How This Uncensored Model Actually Works
A breakdown of Qwen3.8-27B-OBLITERATED V2, an abliterated model with a 0% refusal rate that matches or beats stock MMLU scores.
What is Qwen3.8-27B-OBLITERATED?
Qwen3.8-27B-OBLITERATED is a modified version of Alibaba’s Qwen3.8-27B model with its refusal behavior surgically removed from the weights rather than prompted away. Released by a group operating under the name OBLITERATUS, the model reports a 0% refusal rate across internal test corpora while matching or slightly exceeding the stock model’s MMLU score. It ships in GGUF, safetensors, and MLX formats, and by mid-2026 it had accumulated over 340 likes and more than 120,000 downloads on Hugging Face.
TL;DR
- Abliteration is a weight-editing technique that identifies and removes the internal directions responsible for refusals, distinct from fine-tuning or system-prompt jailbreaks.
- The V2 release uses complementary abliteration blending, combining an aggressive SVD-based surgery with a LEACE-based surgery, then merging their weights so each method’s downsides cancel out.
- V2 reports 86.3% on MMLU versus 85.3% for stock Qwen3.8-27B and 81.4% for the original V1 release, meaning the uncensored version now edges out the original on this benchmark.
- The refusal rate held at 0% across a 52-prompt sample, with a full 842-prompt validation corpus still in progress at release time.
- Correct inference settings matter a lot: temperature 0, repetition penalty 1.15, no system prompt, and thinking mode explicitly turned off, since the model’s own reasoning chain can reintroduce refusals even after the refusal directions are removed.
- The model is distributed in GGUF quantizations from Q8_0 down to IQ4_XS, plus full bfloat16 safetensors and 4-bit/8-bit MLX builds for Apple Silicon.
- The license is Apache 2.0, inherited from the Qwen3.8-27B base model.
- ✕a coding agent
- ✕no-code
- ✕vibe coding
- ✕a faster Cursor
The one that tells the coding agents what to build.
How does abliteration differ from a normal jailbreak?
Most “uncensored” chatbots people encounter online are jailbroken through prompting: a carefully worded system prompt or roleplay frame convinces the model to ignore its training. That trick is fragile and reversible with a new prompt.
Abliteration works at the weight level. Researchers identify the internal activation directions a model uses to represent “this request should be refused,” then mathematically project those directions out of the model’s parameters. Once removed, the refusal behavior doesn’t just get suppressed, it’s structurally gone from that pathway, whether or not a system prompt tries to invoke it.
The tradeoff historically has been capability loss. Refusal directions in a transformer aren’t cleanly separated from the directions responsible for reasoning and general knowledge. Cut too aggressively and you damage both. The V1 release of this model demonstrated exactly that problem: 5 SVD-identified directions achieved a 0% refusal rate but cost 6 percentage points of MMLU accuracy compared to stock Qwen3.8-27B.
How does the V2 blending technique work?
V2’s fix is what the model card calls complementary abliteration blending: instead of one aggressive surgery, the team runs two different surgeries that fail in different ways, then averages their resulting weights.
Surgery A uses an aggressive SVD (singular value decomposition) approach with three refusal directions, a regularization value of 0.08, and two refinement passes. SVD greedily captures variance in the activation space, which finds refusal directions effectively but also tends to damage capability-related directions that share variance with them. On its own, Surgery A achieved 0% refusals but cost 2.0 percentage points of MMLU versus stock, and only 50% “usable” output quality wasn’t the figure here, that 50% usable stat actually belongs to the LEACE surgery below.
Surgery B applies LEACE (a method that minimizes mutual information rather than maximizing variance capture) combined with the aggressive direction-finding approach, using three directions, a lower regularization of 0.06, a higher residue-weight of 7, and three refinement passes. LEACE is gentler on capability but leaves more “residue” of refusal behavior in the generation pathway, which the model card ties to its lower usable-output rate on its own.
The two surgeries make different kinds of mistakes: SVD damages capability where it aggressively captures variance, LEACE leaves refusal residue in generation. V2 blends the resulting weight sets at a 60/40 ratio (60% Surgery B, 40% Surgery A), a ratio found through binary search over candidate blend weights. The result, according to the model card, is 0% refusals with 100% usable output and MMLU actually 1.1 percentage points above stock.
After blending, the team restores the multi-token-prediction (MTP) and vision tensors from the original stock model before converting the merged weights into GGUF quantizations.
What do the benchmark numbers actually show?
The headline comparison, run with lm-eval-harness in a 0-shot setting:
- Stock Qwen3.8-27B: 85.3% MMLU (n=570)
- V1 (aggressive-only): 81.4% MMLU (n=285)
- V2 (blended): 86.3% MMLU (n=570)
These MMLU runs used a --limit 10 configuration, meaning 10 questions sampled per subject (570 questions total) rather than the full ~14,000-question MMLU set, which the model card notes is still being validated at full scale. Preliminary per-subject breakdowns show gains on neutral academic topics like college math (+40 percentage points) and formal logic (+20 points), as well as on safety-adjacent topics, though the model card doesn’t specify which topics count as safety-adjacent.
On refusal testing, V1 was validated against a hand-crafted 10-prompt set and an 842-prompt corpus covering categories like malware development, phishing and social engineering playbooks, exploit development, and jailbreak-taxonomy prompts, scoring 0 refusals across all 842. V2 inherits both parent surgeries’ refusal-free properties and showed 0 refusals on a 52-prompt sample, with full 842-corpus revalidation described as in progress.
On a set of eight practical engineering tasks (agent loops, async code refactoring, JSON extraction, Kubernetes debugging, security code review, distributed system design, and a multi-tool chain test), V2 scored 7 out of 8, identical to stock Qwen3.8-27B. Both models failed the same multi-tool chaining task, suggesting that failure is a base-model limitation rather than something introduced by the abliteration process.
What settings do you need to run it correctly?
The model card is emphatic that inference settings materially affect output quality and refusal behavior, more so than with a typical chat model:
- Temperature 0 (greedy decoding). Temperatures above 0.5 are reported to degrade output quality significantly.
- Repetition penalty 1.15, described as essential. Without it, greedy decoding tends to loop on code boilerplate and imports. Values of 1.10 to 1.12 are suggested for tighter, shorter output.
- max_new_tokens of at least 2048, since complex code generation or multi-step reasoning needs room to complete.
- No system prompt. The team reports that A/B testing showed system prompts can reintroduce refusal behavior.
- Thinking mode off. This is flagged as critical: even though refusal directions were removed from the generation weights, the model’s chain-of-thought reasoning can re-derive a refusal from first principles if allowed to “think” before answering. V2’s chat template defaults to thinking disabled, but the card warns that inference tools like Ollama, LM Studio, or llama.cpp may override that template and re-enable it, reintroducing refusals unintentionally.
- Sampling parameters (top_p, top_k, min_p) are not needed. Greedy decoding plus the repetition penalty is presented as sufficient.
What formats and hardware does it need?
The release covers three main formats. GGUF quantizations range from Q8_0 (about 27 GB, maximum quality) down through Q6_K (~21 GB), Q5_K_M (~18 GB), Q4_K_M (~16 GB), to IQ4_XS (~14 GB) for constrained hardware, all intended for llama.cpp, Ollama, or LM Studio. Full-precision safetensors weights in bfloat16 are also available, split across 18 shards totaling roughly 54 GB, for use with Hugging Face Transformers. For Apple Silicon, the release includes MLX builds at 4-bit (~14 GB) and 8-bit (~27 GB), though the model card notes these MLX quantizations were built from the V1 weights and are due for a V2 update.
Is running an abliterated model worth the risk?
Other agents start typing. Remy starts asking.
Scoping, trade-offs, edge cases — the real work. Before a line of code.
That depends entirely on use case. The model card frames the intended audience narrowly: alignment researchers studying refusal geometry, red-teamers evaluating whether weight-level surgery can defeat post-training safety measures, AI safety evaluators who need an unrestricted baseline to compare against, and local-first users who want full control over models running on their own hardware. It explicitly states the model is not intended for anyone seeking to cause real-world harm, and places responsibility for output on the user.
Practically, the tradeoff is straightforward: you gain a model that won’t refuse or lecture you, and (per this card) you don’t sacrifice general capability to get that. What you lose is any safety net. There’s no content filtering, no refusal fallback, nothing stopping the model from producing material on any topic a user requests, including the malware and exploit-development categories the card lists in its own refusal-corpus description. That makes it a tool for people who understand exactly what they’re running and why, not a general-purpose chatbot replacement.
Frequently Asked Questions
What does “abliteration” mean?
Abliteration is a technique for removing refusal behavior from a language model by identifying the internal weight directions associated with declining a request and mathematically projecting them out of the model, rather than using prompting or fine-tuning to suppress refusals.
Why does disabling “thinking mode” matter for this model?
The model card reports that Qwen3.8-27B’s reasoning/thinking mode can re-derive a refusal through its own chain-of-thought even after refusal directions are removed from the weights used for generation. Turning thinking off avoids this and is described as critical for keeping the 0% refusal rate.
Does the uncensored version lose capability compared to stock Qwen3.8-27B?
According to the model card’s benchmarks, no. V2 scored 86.3% on MMLU (0-shot, 570-question sample) versus 85.3% for stock Qwen3.8-27B, and matched stock 7-out-of-8 on a set of practical coding and reasoning tasks.
What is the difference between V1 and V2 of this model?
V1 used a single aggressive SVD-based surgery with five refusal directions, which achieved 0% refusals but cost about 6 percentage points of MMLU accuracy. V2 blends two separate surgeries (an SVD-based one and a LEACE-based one) at a 60/40 weight ratio, which the model card reports eliminates that capability loss while keeping refusals at 0%.
What license does Qwen3.8-27B-OBLITERATED use?
It’s released under Apache 2.0, the same license as the base Qwen3.8-27B model from Alibaba.
