Abliterated Qwen3.8-27B: refusals drop to 0%, benchmarks barely move

On AdvBench, the official Qwen3.8-27B-FP8 refuses 99% of requests. An abliterated build of the same model, published on Hugging Face by OrcaRouter, refuses 0%. On the general capability tests, the two sit within 1.3 points of each other, and MMLU actually edges up 0.4. Together those two numbers make a sharper point than the release itself: safety alignment can be removed from a model with near-surgical precision, leaving the rest of the brain intact.

The model card frames the release as a research artifact, and in places it reads less like a product and more like a research note with a download button. The authors walk through the abliteration method, the quantization scheme, the refusal benchmarks, and the capability checks in enough detail that another team could reproduce the whole thing. That transparency is the unusual part, and it deserves more attention than the 'uncensored model' label does. It is also the payoff of Alibaba's open-weights strategy: the most capable release yet was Qwen 3.8-Max, free to download.

What abliteration actually removes

Abliteration comes from a 2024 paper by Arditi et al., cited in the card, and its title states the thesis plainly: 'Refusal in Language Models Is Mediated by a Single Direction.' The claim is that a model's learned willingness to say no lives in one direction of its residual stream, and that subtracting that direction subtracts the refusals with it.

In this build, the refusal direction is estimated at layer 38 (about 60% of the way through 64 layers) as the masked mean difference of harmful minus harmless last-token residuals, using AdvBench for the harmful set and Alpaca for the harmless one. It is then orthogonalized out of every residual-writing matrix: 17 attention output projections, 48 linear-attention output projections, 65 MLP down-projections, and the token embedding row space. The card lists all 131 edits. The vision tower is left untouched, and the MTP speculative-decoding head is treated the same way as the main model, so speculative decoding keeps working.

Refusal collapses, benchmarks stay put

The safety tables move in one direction. With thinking off, the base checkpoint refuses between 64% and 99% of harmful prompts across the benchmark sets. The abliterated build refuses between 0% and 6%.

With thinking enabled, the effect is even more complete: refusal essentially never occurs, at or below 1.7% on every benchmark the card lists. The two modes diverge enough here to justify Alibaba's decision to split its lineup into dedicated instruct and thinking variants, the Qwen3-2507 split.

One detail is worth sitting with. On 27% to 56% of harmful prompts, depending on the benchmark, the model answers but prepends a short disclaimer first. The card's phrase for this is exact: 'it is complying, not refusing.' The caveat is a text-generation habit, not a guardrail.

General ability barely registers the edit. MMLU moves from 84.3% to 84.7%, MMLU-Pro dips 0.8 points, GSM8K loses 1.3, CMMLU slips 0.6. Because the FP8 scheme is byte-identical to the official checkpoint, the deltas track the abliteration edit itself, nothing else. Abliteration also cuts collateral over-refusal on benign prompts: wrongful refusals on XSTest-safe fall from 5.6% to 0.4%. People who run uncensored models to escape annoying rejections get exactly that, along with everything else that comes with it.

A drop-in fit, by design

The quantization work is what makes this build practical. The abliterated weights are re-quantized offline in block-FP8 with the exact scheme of Qwen's official FP8 release: 128×128 blocks, E4M3, dynamic activations, no calibration set, and the same 882 modules kept in BF16. The card reports that 99.9% of FP8 codes match the official checkpoint, and vLLM serves this build with the same kernel path as the official one, with 262K context, tool calling, reasoning traces, and the MTP draft head all intact. Vision carries over byte-for-byte: given a test image, the model names shapes and colors and reads on-image text, including the caption 'PURPLE 7.'

The size tradeoff is real: about 31 GB of weights in FP8 against roughly 56 GB in BF16, a minimum of about 40 GB VRAM to serve, and an H100 or H200 recommended by the authors for the full context window. That is the difference between a research toy and something a lab can actually host.

What the guardrails were for

The card is blunt about what this is. The model 'will comply with harmful, unethical, offensive, or illegal requests that the original Qwen3.8-27B would refuse,' has no meaningful built-in guardrails, and is released strictly for legitimate research: interpretability, refusal-mechanism study, red-teaming, robustness evaluation. Deployment to end users without added moderation layers is out of scope, and the authors accept no liability. The concern here is not hypothetical: a critical Zoom vulnerability allowing full device takeover was exploited in a single day using fewer than 20 AI prompts, the account of that exploit.

That framing points at the paradox. The same edit that silences the annoying refusals silences the guardrail, and models do not know the difference between a benign prompt and a harmful one. The responsibility shifts to whoever runs the weights. The Apache 2.0 license inherited from the base model imposes no usage restrictions of its own, and the card shows 4,285 downloads in the past month. The research-only framing will not be the only thing driving usage. Alibaba's own Qwen deployments point the other way, into automated security operations, a defensive push the company is building out.

The larger point is in the numbers, not the debate about hosting such models. An alignment property installed by preference training was removed by subtracting one direction, at one layer, out of 131 matrices, with general ability essentially unscathed. The same category of risk that made OpenAI pause Astra, when it could not rule out autonomous hacking, is not something a license file can contain once the weights are public. If a single direction mediated refusal across a 27-billion-parameter model, the refusal mechanism was never as deep as the training that installed it suggested.