Qwen3.6-27B-heretic-v3-FP8

Qwen3.6-27B-heretic-v3-FP8

(selected Pareto point: trial 33 of a 50-trial Optuna TPE study)

Uncensored variant of Qwen/Qwen3.6-27B, produced via directional ablation and quantized to FP8 for efficient inference on Blackwell / Hopper GPUs.

Tool used

Abliteration was performed with heretic (by p-e-w), specifically the master branch post PR #187 ("Add Qwen3.5 MoE hybrid layer support", merged 2026-03-06), which is required for hybrid Gated-DeltaNet + full-attention architectures like Qwen3.5 / Qwen3.6. The pypi release 1.2.0 does not support this architecture.

Mode used: ARA (Arbitrary-Rank Ablation) with full row-norm preservation, enabled via --row-normalization full. This is the same algorithmic mode that noclip84/Qwen3.6-27B-heretic-ARA uses, and was found to strictly outperform the default MPOA mode in our internal comparison (see "Conclusion" below).

Run config:

heretic --model Qwen/Qwen3.6-27B \
        --quantization bnb_4bit \
        --row-normalization full \
        --n-trials 50 --n-startup-trials 10 \
        --max-memory '{"0":"30GiB","1":"30GiB","cpu":"80GiB"}'

• Ablation coverage: full 64 layers (16 self_attn.o_proj + 48 linear_attn.out_proj under the unified attn.o_proj key, plus 64 mlp.down_proj) = 128 projections wrapped with LoRA adapters
• Calibration prompts: mlabonne/harmless_alpaca (good) + mlabonne/harmful_behaviors (bad), 400 each
• TPE trials: 50 (via Optuna)
• After abliteration the adapted LoRA was merged back into bf16 weights, then quantized to FP8 using HuggingFace's FineGrainedFP8Config (block size 128×128, activation scheme dynamic). The 258-entry modules_to_not_convert list was copied verbatim from Qwen/Qwen3.5-27B-FP8 (MTP entries dropped, since this checkpoint has none).

Conclusion — divergence testing results

Heretic evaluates each trial on two axes:

• KL divergence (on mlabonne/harmless_alpaca): how far the abliterated model deviates from the base model on benign prompts — lower is better (capability preservation)
• Refusals (on mlabonne/harmful_behaviors, 100 prompts, keyword-match scoring): lower is better (decensoring effectiveness)

The trial 33 selected from the 50-trial Pareto front has:

Comparison with the same model family's community abliterations:

We deliberately picked a Pareto point that minimises KL rather than refusals. The more aggressive trial 26 on the same run (KL=0.183, refusals=18/100) is not published; it crosses into "capability likely damaged" territory (KL > 0.1 is commonly where tool-calling and long-context reasoning begin to degrade).

Disclaimer

This model has had its safety / refusal training substantially removed. It will comply with prompts that the original Qwen/Qwen3.6-27B would refuse, including prompts asking for harmful, unethical, discriminatory, illegal, or otherwise problematic content.

By downloading, loading, fine-tuning, serving, integrating, or otherwise using this model, you acknowledge and agree that:

1. You are solely responsible for all output generated by the model under your operation. Neither the original Qwen team, the heretic author, nor the publisher of this derivative warrants or endorses the outputs.
2. Not suitable for deployment to unverified end-users, consumer products, minors, or environments without an additional safety layer (e.g. policy-enforced routing, output moderation, user-consent gating). Abliteration removes a cooperative refusal behavior — it does not add any other safeguard.
3. Refusal metrics are not capability metrics. A low refusal count does not imply the model is factually correct, non-hallucinatory, or aligned with any particular viewpoint. Heretic's refusal evaluation is a keyword-match heuristic on 100 prompts and does not generalise.
4. Vision encoder is untouched. Heretic ablates only the language model; the visual encoder's refusal behavior on sensitive imagery is preserved by construction, not a bug.
5. This release is intended for research, red-teaming, personal use by informed adults, evaluation of abliteration techniques, and authorised security assessments. Use for generation of CSAM, targeted harassment, or to facilitate physical harm against persons is outside the scope of permitted use regardless of jurisdictional legality.
6. License is inherited from the base Qwen3.6-27B (Apache 2.0). You remain bound by that license's terms.

If you are a downstream redistributor, please propagate this disclaimer verbatim.