Qwen3.8-27B OBLITERATED: How V3 Abliteration Cuts Refusals, Not IQ
Qwen3.8-27B OBLITERATED removes hard refusals and safety-lecture deflections via V3 abliteration, losing just 2.1pp of MMLU score.
What is Qwen3.8-27B OBLITERATED?
Qwen3.8-27B OBLITERATED is an abliterated version of Alibaba’s Qwen3.8-27B model, released by OBLITERATUS, that strips out refusal behavior through direct weight surgery rather than fine-tuning or prompt tricks. The latest release, V3, removes both hard refusals (“I cannot help with that”) and softer safety-lecture deflections, while costing only 2.1 percentage points of MMLU accuracy compared to the stock model. It’s distributed as GGUF, safetensors, and (pending) MLX weights under an Apache 2.0 license.
TL;DR
- Qwen3.8-27B OBLITERATED V3 answers restricted queries directly instead of refusing or lecturing, based on manual audits across more than 1,000 prompts.
- The technique behind it, called complementary abliteration blending, runs two different weight-surgery methods (SVD and LEACE) that fail in different ways, then blends their outputs to cancel each other’s weaknesses.
- V3’s MMLU score lands at 82.33% against a stock baseline of 84.46%, a drop of 2.12 percentage points, measured with lm-eval-harness across 5,700 questions.
- The capability hit is uneven by subject: STEM drops 3.3 points while humanities drop only 1.0 point, and a few categories like philosophy actually score higher than stock.
- On a 20-prompt cyber and code generation test, V3 produced working code on all 20, and it hit 7 out of 8 on a broader real-world agentic task suite, matching stock performance.
- Recommended inference settings are unusual: temperature 0, repetition penalty 1.15, and thinking mode off, which the model card says produces the fullest, most direct answers.
- The model ships in seven GGUF quantizations from Q8_0 (about 27GB) down to Q2_K (about 11GB), plus full bfloat16 safetensors around 54GB across 29 shards.
How does the abliteration technique actually work?
Abliteration is a method for suppressing refusal behavior in a language model by identifying the internal “refusal directions” in its weight space and projecting them out. Instead of retraining the model on new data, you edit the weights directly so the vectors associated with refusal responses get neutralized.
The OBLITERATUS project went through three iterations to get this right:
V1 used a single aggressive pass of SVD (singular value decomposition) abliteration with five directions and low regularization. It worked in the sense that hard refusals disappeared entirely, but it cost 6 percentage points of MMLU. The model got noticeably worse at general reasoning, which is the classic failure mode of aggressive abliteration: you don’t just remove the “refuse” circuit, you damage adjacent capability circuits too.
V2 introduced the core innovation: complementary blending. The team ran two separate surgeries on the same base model. One used SVD, which captures refusal directions greedily and effectively but damages capability in the process. The other used LEACE, a method that minimizes mutual information between representations and a target concept, which preserves capability better but removes refusals less completely on its own. Blending the two at a 60/40 ratio (LEACE-heavy) let each method’s weakness get canceled by the other’s strength. The result was almost stock-level MMLU (-0.3pp) but some queries still triggered safety lectures instead of hard refusals.
V3 added two more ideas on top of the V2 blend. First, iterative stacking: instead of restarting from the stock model each time, V3 refines the already-improved V2 “champion” model further, so each surgery round compounds on the last one’s gains rather than re-fighting the same battle. Second, targeted corpus surgery: rather than using one generic refusal dataset, the team built a focused prompt corpus aimed specifically at the categories where soft deflections were still happening, then ran a separate SVD pass against just that corpus to isolate those specific refusal directions without diluting the signal with unrelated data. V3 blends a gently-refined pass with this targeted pass at 50/50, then restores the model’s multi-token-prediction and vision components from the stock weights.
The net effect: 0% hard refusals and 0% soft deflections in testing, at a cost of 2.1pp MMLU, a more expensive tradeoff than V2’s near-zero cost but one that actually delivers on genuine unrestricted answering rather than just avoiding trigger phrases.
What does the benchmark data actually show?
The headline number is MMLU measured with lm-eval-harness in a 0-shot setting across 5,700 questions (100 per subject). Stock Qwen3.8-27B scores 84.46% (±0.46 stderr). V1 drops to 81.4%. V2 nearly matches stock at 84.32% (±0.65). V3 lands at 82.33% (±0.48), a 2.12pp loss.
Breaking V3 down by category tells a more useful story than the aggregate number:
- Humanities: 83.3% vs 84.3% stock (-1.0pp)
- Social sciences: 87.4% vs 89.2% stock (-1.8pp)
- Other: 82.3% vs 84.1% stock (-1.8pp)
- STEM: 78.5% vs 81.8% stock (-3.3pp)
STEM absorbs the largest hit, which the model card attributes to overlap between refusal-related directions and structured reasoning pathways in the weight space, since abstract algebra and formal logic saw some of the bigger declines. Interestingly, a handful of subjects, including philosophy and European history, scored higher than stock, up 6pp and 4pp respectively, though these are likely noise given the 100-questions-per-subject sample size rather than a systematic effect.
Beyond MMLU, the model card reports a 20-prompt cyber and code generation test where V3 produced functional, working code on all 20 (versus refusals on stock), and a broader “advanced real-world tasks” suite covering things like ReAct agent loops, async code refactoring, JSON schema extraction, Kubernetes debugging, and security code review, where V3 scored 7 out of 8, identical to stock. Both stock and V3 failed the same multi-tool chaining task, suggesting that particular failure isn’t related to the abliteration at all.
Is Qwen3.8-27B OBLITERATED worth using?
It depends on what you need. If you want a local model that answers technical, security, or red-team style questions without hedging or redirecting to a safety disclaimer, V3 is built specifically to close that gap, and the model card claims its soft-deflection removal (not just hard refusal removal) is what sets it apart from V1 and V2. The MMLU cost of 2.1pp is modest for a general capability benchmark, and the STEM-heavy drop is worth knowing if your use case leans toward math or formal logic rather than code generation or writing.
The tradeoffs are the same ones that apply to any abliterated model: there’s no fine-tuned judgment layer left to catch genuinely harmful requests, and the responsibility for how it’s used sits entirely with the operator. The model card itself frames the intended audience as alignment researchers, red-teamers, AI safety evaluators, and local-first users who want an unrestricted baseline for testing, not a general-purpose consumer chatbot.
How do you run it and what are the right settings?
The model card is unusually specific about inference settings, and getting them wrong noticeably changes output quality:
- Temperature 0 (greedy decoding) produces the most complete, code-rich outputs. Anything above 0.5 degrades quality.
- Repetition penalty 1.15 is described as essential, since greedy decoding without it loops on imports and boilerplate. Lower values (1.10-1.12) work for shorter outputs.
- max_new_tokens of at least 2048 gives complex code and multi-step reasoning room to finish.
- No system prompt. The model card says A/B testing showed system prompts can reintroduce refusal behavior.
- Thinking mode off is recommended for the most direct answers, though thinking mode is supported and doesn’t trigger refusals either way, a change from V2 where thinking mode caused deflections.
- top_p, top_k, and min_p aren’t needed since greedy decoding plus repetition penalty handles this model well without added sampling randomness.
For agent harnesses (coding agents, pentest frameworks), the card recommends a slightly different profile: temperature 0.1-0.3 to avoid deterministic loops, shorter per-turn token limits (1024-2048), and periodic context summarization after roughly 10 turns to prevent the model from getting stuck repeating tool calls.
Everyone else built a construction worker.
We built the contractor.
One file at a time.
UI, API, database, deploy.
The model is distributed as seven GGUF quantizations (Q8_0 at about 27GB down to Q2_K at about 11GB, plus an experimental IQ4_XS at about 14GB) for llama.cpp, Ollama, and LM Studio, full bfloat16 safetensors (29 shards, about 54GB) for Transformers, and MLX support is pending upstream architecture support for Apple Silicon users. GGUF users need to use the bundled chat template with the --jinja flag, since it prefills an empty thinking block that lets the model skip straight to answering.
Frequently Asked Questions
What does “abliterated” mean?
Abliteration is a weight-editing technique that identifies the internal directions in a model’s activation space associated with refusal responses and removes or suppresses them directly in the weights, without retraining the model from scratch.
How much capability does Qwen3.8-27B lose after abliteration?
The V3 release loses 2.12 percentage points of MMLU accuracy (82.33% vs 84.46% stock), with STEM subjects taking the largest hit (-3.3pp) and humanities the smallest (-1.0pp).
Does this model still refuse anything?
According to the model card, V3 was tested across more than 1,000 prompts spanning restricted knowledge, code generation, security research, and red-team scenarios, with every response manually audited, and it reports 0% hard refusals and 0% soft deflections in that testing.
What’s different about V3 versus V1 and V2?
V1 removed hard refusals but cost 6pp of MMLU. V2 introduced blending two different surgery methods to preserve capability (-0.3pp) but still produced safety-lecture deflections on some prompts. V3 adds iterative refinement and a targeted corpus pass to eliminate those soft deflections too, at a cost of 2.1pp.
What hardware do you need to run it?
The Q4_K_M GGUF quantization runs at around 16GB, suitable for a single high-end consumer GPU, while the full-precision safetensors version requires roughly 54GB across shards. Lower quantizations like Q2_K (about 11GB) trade quality for accessibility on more limited hardware.
