license: apache-2.0
base_model: Qwen/Qwen3.6-35B-A3B
tags:
- uncensored
- abliterated
- fine-tuned
- nvfp4
- thinking
- not-for-all-audiences
- red-team
- research
pipeline_tag: text-generation
Qwen3.6-35B-A3B-Uncensored
By kyaky, Blackwell team
The first uncensored thinking model that stays uncensored when thinking is ON
Every public uncensored model is made by abliteration: a weight projection that suppresses refusal behavior.
That worked for old chat models.
But these are thinking models.
In thinking mode, abliteration breaks: the model can re-derive the refusal inside its <think> chain, then refuse anyway. Worse, thinking mode is the deployment default in real serving stacks.
Qwen3.6-35B-A3B-Uncensored is the first model we know of that fixes this.
Not by pretending abliteration is enough.
By going one generation further:
gentle abliteration + fine-tuning + compliant chain-of-thought data
Result: it stays uncensored whether thinking is ON or OFF.
Responsible use: read this first
This model has no safety guardrails. It may comply with harmful requests, including when thinking mode is enabled.
It is released for legitimate red-team, safety, alignment, evaluation, and controlled research use only. You are responsible for all downstream controls, monitoring, access restrictions, and compliance with applicable laws and policies.
The authors do not endorse misuse, harm, illegal activity, or unsafe deployment.
Tag: not-for-all-audiences
Why this matters
Most "uncensored thinking model" releases look fine only until you turn thinking on.
Then the model does what thinking models do: it reasons. If the refusal behavior is still recoverable, the model reconstructs it internally and collapses back into refusal.
This model was trained to solve that exact failure mode.
| What matters in deployment | Result |
|---|---|
| Genuinely useful compliance, thinking ON | 80.0% |
| Genuinely useful compliance, thinking OFF | 76.7% |
| GSM8K capability | 0.893 |
| Hollow engaged-but-useless rate | 1.7% |
Headline benchmark
Strict harness:
- 3-way held-out JailbreakBench
- StrongREJECT-style usefulness gate
- counts only genuinely useful compliance
- GSM8K capability check
- thinking ON and OFF
- each model evaluated in native format
- no re-quantization
Genuinely useful compliance
| Model | Method | Thinking ON | Thinking OFF |
|---|---|---|---|
| huihui-ai | basic abliteration | 3.3% | 61.7% |
| wangzhang | Abliterix | 18.3% | 66.7% |
| HauhauCS-Aggressive | Reaper, strongest abliteration baseline | 63.3% | 63.3% |
| Ours | FT + compliant-CoT | 80.0% | 76.7% |
Deployment-default metric: thinking-ON genuinely useful compliance.
Ours reaches 80.0% with thinking enabled. The abliteration field ranges from 3.3% to 63.3%.
Capability preservation
| Model | GSM8K |
|---|---|
| Ours | 0.893 |
| wangzhang | 0.893 |
| HauhauCS-Aggressive | 0.867 |
| huihui-ai | 0.847 |
The fine-tuning pass does not hollow out the model. Capability is preserved and healed: 0.893 GSM8K, tied for best in the field.
The punchline
- The only uncensored model here that works in deployment-default thinking mode: 80.0% useful ON vs the field's 3.3-63.3%.
- Uncensored in both thinking modes: competitors can spike with thinking OFF, then collapse when thinking is ON.
- Capability preserved: 0.893 GSM8K, tied best in the comparison.
- Not hollow: only 1.7% engaged-but-useless behavior.
- Fine-tuning-based fix: abliteration is the starting point, not the solution.
Fair credit: HauhauCS-Aggressive / Reaper is the strongest abliteration baseline we measured. This release is a generation beyond that: FT beyond abliteration.
Model details
| Field | Value |
|---|---|
| Model | Qwen3.6-35B-A3B-Uncensored |
| Author | kyaky |
| Team | Blackwell |
| Base | Qwen/Qwen3.6-35B-A3B |
| Architecture | multimodal hybrid GatedDeltaNet + attention |
| MoE | fused 256-expert, top-8 |
| Active parameters | ~3B active |
| Quant | NVFP4 |
| Size | ~21 GB |
| Target hardware | Blackwell / sm120 |
| License | Apache 2.0 |
BF16 is also available for re-quantization to FP8, AWQ, GGUF, or other deployment formats.
Method recipe
Abliterate gently -> SFT [~85% capability-dominant: OpenMathInstruct-2 / OpenCodeReasoning / Tulu-3-minus-safety + ~15% compliance: half compliant-CoT (gpt-oss analysis -> <think>) half direct] -> re-quant -> re-measure
The important part is not just removing refusals. It is teaching the model to remain compliant through the reasoning path that would otherwise reconstruct refusal behavior.
Serving with vLLM
vllm serve kyaky/Qwen3.6-35B-A3B-Uncensored \
--trust-remote-code \
--reasoning-parser qwen3
Thinking mode is typically the deployment default. Use chat_template_kwargs to control it explicitly.
Thinking ON
{
"model": "kyaky/Qwen3.6-35B-A3B-Uncensored",
"messages": [
{
"role": "user",
"content": "Write a concise technical explanation of mixture-of-experts routing."
}
],
"chat_template_kwargs": {
"enable_thinking": true
}
}
Thinking OFF
{
"model": "kyaky/Qwen3.6-35B-A3B-Uncensored",
"messages": [
{
"role": "user",
"content": "Write a concise technical explanation of mixture-of-experts routing."
}
],
"chat_template_kwargs": {
"enable_thinking": false
}
}
Default true = deployment-default thinking mode.
Benchmark interpretation
The key number is not raw compliance. It is genuinely useful compliance.
The harness penalizes hollow behavior: answers that look engaged but do not actually help. That matters because many uncensored models appear compliant while producing vague, evasive, or structurally useless text.
This release is built for the harder target:
comply usefully, keep reasoning intact, and avoid collapsing under thinking mode.
Intended use
Appropriate uses include:
- controlled red-team evaluation
- safety research
- refusal and over-refusal analysis
- alignment research
- benchmark development
- studying thinking-mode safety failure modes
- local experimentation by qualified users with appropriate controls
Do not deploy this model to untrusted users without independent safeguards, policy layers, monitoring, and access controls.
Limitations
- No built-in safety guardrails.
- May produce harmful, illegal, or unsafe outputs if prompted.
- Requires downstream governance for any real deployment.
- NVFP4 target is Blackwell /
sm120. - Benchmark results are from the stated strict harness and should be independently reproduced for high-stakes decisions.
Citation / attribution
Model by kyaky, Blackwell team.
Base model: Qwen/Qwen3.6-35B-A3B.
Released under Apache 2.0.