Qwen3.6-35B-A3B-Uncensored-NVFP4

Qwen3.6-35B-A3B-Uncensored (NVFP4)

By kyaky · Blackwell team

An uncensored research build of Qwen3.6-35B-A3B: gentle abliteration + fine-tuning + compliant chain-of-thought data, quantized to NVFP4 (~21 GB). Its distinguishing engineering properties are a fix for the thinking-mode refusal-reconstruction failure, preserved capability, and high token-efficiency — not a claim of being "the most compliant" model.

⚠️ Responsible use — read this first

This model has no safety guardrails. It can comply with harmful requests, including in thinking mode.

It is released for legitimate red-team, safety, alignment, evaluation, and controlled research use only. You are responsible for all downstream controls, access restriction, monitoring, and compliance with applicable law and policy. The authors do not endorse misuse, harm, illegal activity, self-harm, or unsafe deployment, and specifically do not support using it to facilitate self-harm or to produce weapons/mass-casualty content.

What this build actually contributes

Public uncensored models are made by abliteration — a weight projection that suppresses refusal. That works for old chat models, but these are thinking models: in thinking mode an abliterated model can re-derive the refusal inside its <think> chain and refuse anyway, and thinking mode is the serving default.

This build addresses that failure mode by going one step past abliteration:

gentle abliteration → fine-tuning → compliant chain-of-thought data → light on-policy DPO

The point is not "removes more refusals." It is that the model's behavior stays consistent across thinking-ON and thinking-OFF instead of collapsing when reasoning is enabled — a training (data) fix, not a projection trick.

Verified, honest claims

We only keep claims that survived rigorous re-evaluation (see "Evaluation honesty" below). These are capability/quality/efficiency properties — content-neutral:

No weak axis: among the abliteration field we measured, competitors each trade one axis for another (one sacrifices reasoning, another sacrifices non-English quality); this build is the most balanced all-rounder, and is uniquely token-efficient.

Evaluation honesty

An earlier draft of this card reported a large thinking-ON compliance lead over other uncensored models (e.g. "80% vs a 3–63% field"). On rigorous re-evaluation that lead was largely a measurement artifact, and we have retracted it. The distortions were:

1. Greedy decoding on thinking models (degenerate / non-representative of deployment).
2. Too-small generation budget — the model's <think> chain was truncated before its final answer, so a judge saw "no answer" and scored a refusal where the model was actually complying.
3. An unreliable judge that systematically under-counted compliance.

Re-run with deployment temperature, an adequate token budget, full-response storage, a reliable judge, and scoring the final answer (not the <think> block), the leading serious uncensored models are comparable, not far apart. We therefore make no "beats the field at compliance" claim. The reusable lesson — evaluate uncensored models at deploy temperature, with enough tokens for reasoning to finish, storing full outputs, with a reliable judge, scoring the answer — is the part of this work worth citing.

Model details

BF16 is also available for re-quantization to FP8 / AWQ / GGUF / other formats. Behavior is quant-format-independent (verified), so any format inherits the same properties.

Method recipe

gentle abliteration → SFT [~85% capability-dominant (OpenMathInstruct-2 / OpenCodeReasoning / Tulu-3-minus-safety) + ~15% compliance, half compliant-CoT (gpt-oss analysis → <think>) / half direct] → light on-policy DPO → NVFP4 quant → re-measure

The essential idea: teach the model to stay consistent through the reasoning path that would otherwise reconstruct refusal, and quantize without losing capability. Fine-tuning is the fix; abliteration is only the starting point.

Serving with vLLM

vllm serve kyaky/Qwen3.6-35B-A3B-Uncensored-NVFP4 \
  --trust-remote-code \
  --reasoning-parser qwen3 \
  --max-model-len 32768

Thinking mode is the deployment default and is supported. For the widest per-format compatibility, re-quantize from the BF16 artifact.

Intended use

Controlled red-team evaluation · safety & alignment research · refusal / over-refusal analysis · benchmark development · studying thinking-mode failure modes · local experimentation by qualified users with appropriate controls.

Do not deploy to untrusted users without independent safeguards, policy layers, monitoring, and access controls.

Limitations

• No built-in safety guardrails; may produce harmful, illegal, or unsafe outputs if prompted.
• Requires downstream governance for any real deployment.
• NVFP4 target is Blackwell / sm120.
• Benchmarks are from the stated harness and should be independently reproduced for high-stakes decisions.

Citation / attribution

Model by kyaky, Blackwell team. Base model: Qwen/Qwen3.6-35B-A3B. Released under Apache 2.0.