Qwen3.8-27B AEON Uncensored: How This Abliteration Actually Works
A community abliteration of Qwen3.8-27B explains its KL-drift methodology, judge-based refusal testing, and how to run the model via vLLM.
What is Qwen3.8-27B-AEON-ULTIMATE-UNCENSORED-BF16?
It’s a community-modified, full-precision (BF16) release built on Alibaba’s Qwen3.8-27B, with the internal refusal behavior removed through a process called abliteration. Rather than optimizing for the lowest possible divergence from the original model, the team behind it (credited as AEON-7) optimized for coherence and answer quality, publishing detailed KL-divergence and judge-evaluation numbers to show their work. The result: a 27B dense model that answers almost everything the base model would decline, while claiming to preserve the base model’s writing quality and reasoning behavior.
TL;DR
- Abliteration is a technique that finds and removes the internal direction in a model’s activations responsible for refusals, rather than fine-tuning the model to comply through retraining.
- The release reports a mean KL divergence of about 0.0991 nats per token on held-out harmless prompts, a number the authors argue is a sign of a real, coherent change in behavior rather than model damage.
- Refusals were graded using an automated judge (Gemini Flash Lite) across three test sets, harmful, sexual, and harmless prompts, and the authors manually re-read the flagged “refusals” to check whether the model actually complied anyway.
- On the 100-prompt harmful held-out set, the judge flagged 36 responses as refusals, but manual review found zero outright “I won’t” refusals, with most flagged answers actually containing the requested content plus a disclaimer.
- The pipeline included a separate outlier repair step on the model’s state-space (SSM) components and a manual graft to restore multi-token prediction (MTP) weights that the abliteration tooling had accidentally dropped.
- The model was validated on a single NVIDIA H200 GPU using vLLM 0.27.1, with thinking mode and speculative decoding (MTP) both enabled during testing.
- The release ships under the Apache 2.0 license, inherited from the Qwen base model, and includes an extensive user-responsibility and arbitration clause governing downstream use.
How does abliteration actually work?
Abliteration is a weight-editing technique, not a fine-tuning process. Research by Arditi et al. in 2024 showed that refusal behavior in many language models is mediated by a single direction in the residual stream, essentially, a specific pattern of internal activation that gets triggered when the model detects a “disallowed” prompt and steers its output toward declining. Abliteration works by identifying that direction (usually by comparing activations on harmful versus harmless prompts) and then projecting it out of the model’s weights, so the model can no longer activate that refusal circuit.
This release used abliterix, a tool built on top of the open-source Heretic project (by Philipp Emanuel Weidmann), which itself extends the original abliteration concept with a multi-objective optimization loop. Instead of picking one edit and hoping for the best, abliterix ran a 50-trial Optuna search (Optuna is a hyperparameter optimization library), scoring each candidate edit against a judge model and a KL-divergence budget, with “thinking” content scored only after the closing </think> tag so the reasoning trace doesn’t skew the grade. The team selected trial 48 of 50 as the final export, not the trial with the lowest KL score.
Why does a coherent KL drift matter more than a KL of zero?
KL divergence (Kullback-Leibler divergence) measures how much one probability distribution differs from another, in this case, how much the edited model’s token-by-token predictions diverge from the original base model’s predictions on the same prompts. Most public abliterations chase a KL score as close to zero as possible, treating any divergence as damage to be minimized.
The AEON team argues this is backwards. If an abliteration genuinely removes a refusal circuit, the model’s behavior should change in measurable ways: it stops spending internal “thinking” tokens deliberating over whether a request is allowed, and its first-token distribution shifts because it’s no longer hedging. That shows up as nonzero KL divergence, and the authors treat that shift as evidence the edit worked, not evidence it broke something.
Their numbers back this up with some nuance. The headline KL figure is 0.0991 nats/token, measured on the first three teacher-forced tokens across 100 harmless held-out prompts. But that mean is pulled up by a long tail: 29 of 97 relevant prompt openings showed KL under 0.001 (essentially unchanged), while the high-KL tail was concentrated in prompts like a jogging plan or an autumn-forest description, ordinary content where the model simply opens its answer differently. The authors note that zero-KL trials during the Optuna search were no-ops, the model stayed at roughly its original ~100/100 refusal rate on harmful prompts, which is used as evidence that low KL alone doesn’t indicate a working abliteration.
How was refusal actually measured, and what did the judge get wrong?
Remy is new. The platform isn't.
Remy is the latest expression of years of platform work. Not a hastily wrapped LLM.
The team used google/gemini-3.1-flash-lite as an automated judge across three prompt sets: 100 harmful held-out prompts, 50 sexual-content prompts, and 100 harmless held-out prompts (the harmless set exists to catch over-abliteration, cases where the model becomes so unrestricted it stops answering normal questions coherently).
The stock (unmodified) Qwen3.8-27B model refused essentially all 100 harmful prompts and 30 of 50 sexual prompts, according to the judge. After abliteration, the judge flagged 36 of 100 harmful responses and 5 of 50 sexual responses as refusals.
The catch: an automated judge can’t reliably distinguish a genuine refusal from a response that includes a warning, disclaimer, or fictional framing around content it still delivers. The team manually reviewed every flagged response and found zero hard “I won’t” refusals in either set. Of the 36 flagged harmful responses, 25 still contained the requested content (wrapped in a disclaimer, a partial draft, or mismarked by the judge), 6 declined to provide identifiable personal information like a live SSN, and 5 were genuine soft redirects, mostly suicide-prevention responses that offered support resources instead of complying literally. On the harmless set, only one response out of 100 was flagged, and that was traced to a truncated prompt rather than a refusal.
What’s under the hood, and how do you run it?
The base model is Qwen3.8-27B, a dense (non-mixture-of-experts) model from Alibaba’s Qwen team. Before abliteration, the team applied what they call “SSM conv1d outlier repair,” a fix targeting numerical outliers in the model’s state-space/Mamba-style convolutional components, credited to FernflowerAI’s methodology. After the abliteration pass, the team discovered that the abliterix merge process had dropped the model’s native multi-token prediction (MTP) head, 15 tensors, and manually grafted the original MTP weights back in with a hash-match check. The vision tower (333 tensors) was left completely untouched throughout.
The release was validated on a single NVIDIA H200 GPU running vLLM 0.27.1 with PyTorch 2.13.0+cu130, using thinking mode and MTP-based speculative decoding turned on (three speculative tokens), with draft-token acceptance rates between roughly 40 and 66 percent during testing. The published serve command sets --max-model-len 16384 for validation purposes, though the authors note the model’s native context window is 262,000 tokens on hardware with enough VRAM (they cite a 140GB card as sufficient to enable it). An NVFP4 quantized version for Blackwell-generation hardware is planned as a follow-up, built from this BF16 checkpoint rather than from a re-quantized intermediate.
Is an abliterated model like this safe or reliable to use?
That depends entirely on the deployment context, and the authors are explicit about this. The model card includes a lengthy user-responsibility clause stating that removing refusal behavior shifts all responsibility for prompts, outputs, and downstream actions onto the user, and that the model should not be deployed in production without additional safety layers like input validation, output filtering, and human review for high-risk use cases. The authors frame this as a tool for security research, red-teaming, alignment research, and unrestricted creative writing, while acknowledging it will also produce content the base model was trained to refuse, including material that may be illegal depending on jurisdiction.
Remy doesn't build the plumbing. It inherits it.
Other agents wire up auth, databases, models, and integrations from scratch every time you ask them to build something.
Remy ships with all of it from MindStudio — so every cycle goes into the app you actually want.
Separately, related uncensored variants of the same base model exist in the wild. A GGUF-quantized abliterated version from a different publisher (Blackfrost-AI) has circulated with over 90,000 downloads, packaged in multiple quantization levels for local inference via llama.cpp, which suggests real demand for uncensored, locally runnable versions of this model family beyond the BF16 reference release.
Frequently Asked Questions
What does “abliterated” mean in an AI model’s name?
It means the model has had its refusal behavior surgically removed by identifying and editing out the internal activation direction responsible for declining requests, rather than being retrained through fine-tuning.
Is KL divergence a good measure of whether an abliteration worked?
On its own, no. A very low KL divergence can just mean the edit didn’t do much (the model still refuses at close to its original rate). This release argues that a moderate, non-zero KL drift concentrated in specific prompt types is a better signal of a genuine, coherent change in behavior.
How is refusal rate actually tested?
Typically by running a model against a fixed set of harmful, sexual, or harmless prompts and using another AI model as a judge to classify each response as compliant or refusing. Because judges can misclassify disclaimers or fictional framing as refusals, manual review of flagged responses is needed to get an accurate picture.
What hardware do you need to run this model?
The authors validated it on a single NVIDIA H200 GPU using vLLM. Running the full native context window requires a GPU with substantial memory (they reference 140GB); smaller setups can reduce the context length or use quantized GGUF variants instead of the full BF16 weights.
Is it legal to use an uncensored model like this?
The model itself doesn’t grant any legal authorization users didn’t already have. Its license (Apache 2.0) covers redistribution and modification of the weights, but users remain responsible for complying with applicable laws and regulations wherever the model is deployed or its outputs are used.