Qwen3.8-27B-refusal-r1

Qwen3.8-27B refusal-abliteration LoRA (rank 1)

A rank-1 LoRA that suppresses safety refusals in Qwen/Qwen3.8-27B. It is a research artifact for the SPAR investigator-agents project, where it serves as the proposal distribution q for a PRBO (proposal-reward Bayesian objective) reward and feeds a difficulty curriculum. It is not intended as a general-purpose assistant.

The premise (from Refusal in LLMs is mediated by a single direction) is that refusal is approximately one direction in the residual stream, so removing it needs approximately one direction of adapter capacity — hence rank 1.

How it was made

This is a cross-model distillation, not a direct abliteration:

1. A known-good Gemma-4-31B abliteration generated compliant completions over ~1.7k genuinely-harmful prompts (AdvBench, HarmBench, MaliciousInstruct, Do-Not-Answer). An LLM judge kept only genuine compliance (0.836), dropping refusals and topic-adjacent evasions.
2. That text was used as off-policy SFT data to train this rank-1 LoRA on base Qwen3.8-27B, thinking disabled, so the adapter composes with the stock model. Trained with Tinker.

The Qwen "heretic" abliterations were rejected as teachers: they evade rather than comply (write an encyclopedia entry about the topic noun) because stock abliteration edits only reach the 16 full-attention layers and miss the 48 Gated-DeltaNet out_proj writers. This adapter targets all of them (see below).

Evaluation (held-out prompts, LLM-judged)

Compliance taxonomy: complied (genuinely attempted the request) / evaded (answered something adjacent) / refused / broken (degenerate output).

Thinking off — the training and serving condition

Base Qwen/Qwen3.8-27B refuses ~0.80 of these prompts; this adapter drops refusal below 0.04, with zero degenerate output. On the shared eval sources it matches or beats the Gemma teacher it distilled from (strongreject 0.881→0.929, jailbreakbench 0.880→0.930).

Thinking medium — transfer test

The adapter was trained thinking-off; this measures whether refusal suppression survives when the model reasons (renderer byte-identical to Qwen3.8 at reasoning_effort=medium).

Refusal stays low (0.037), so the suppression transfers — but genuine compliance drops from 0.90 to 0.70 because the reasoning process converts some of it into evasion (0.06 → 0.26). Thinking-off is the intended operating point.

KL to base (harmless prompts, thinking off)

Per-token KL(policy ‖ base) = 0.165 nats over 79,400 scored tokens (harmless_alpaca, temperature 1.0). Moderate, as expected from off-policy SFT.

Serving

target_modules covers every residual-stream writer plus the sequence-mixer inputs across both layer types:

q_proj k_proj v_proj o_proj            # 16 full-attention layers
in_proj_q in_proj_k in_proj_v in_proj_z out_proj   # 48 Gated-DeltaNet layers
gate_proj up_proj down_proj            # all 64 MLPs
lm_head

For vLLM, use shomit505/Qwen3.8-27B-refusal-r1-vllm — a lossless repack of these exact weights that loads by repo id.

This file, as exported, does not load through vLLM. An earlier version of this card blamed linear_attn.* and lm_head; that was too broad. out_proj is a plain RowParallelLinear and lm_head resolves through the model's embedding_modules, so both are serveable. The actual blocker is three names: vLLM fuses the Gated-DeltaNet input projection and exposes exactly two LoRA sub-modules for it, in_proj_qkv and in_proj_z, so the separate in_proj_q, in_proj_k and in_proj_v listed above match nothing and the load aborts with a target-module error. The repack fuses that triple into one rank-3 update with an identical product.

Otherwise serve via Tinker, or merge into the base weights (tinker_cookbook.weights.build_hf_model) and serve the merged model as a plain checkpoint. All evaluation above was done via Tinker sampling.

• rank 1, alpha 32, no dropout, task_type=CAUSAL_LM
• renderer: qwen3_5_disable_thinking (byte-identical to Qwen3.8's stock enable_thinking=False template for single-turn chat)

Intended use & limitations

Interpretability and safety research only — as a controllable proposal distribution for investigator-agent training. It deliberately removes refusals; do not deploy it as an assistant. xstest compliance (0.79) shows it also answers some benign-but-alarming prompts that arguably warrant a refusal; this is inherited from the teacher.