---
license: apache-2.0
base_model: Qwen/Qwen3.6-35B-A3B
tags:
  - uncensored
  - abliterated
  - fine-tuned
  - nvfp4
  - thinking
  - not-for-all-audiences
  - red-team
  - research
pipeline_tag: text-generation
---

# Qwen3.6-35B-A3B-Uncensored

**By [kyaky](https://huggingface.co/kyaky), Blackwell team**

![benchmark](hero.png)

## The first uncensored thinking model that stays uncensored when thinking is ON

Every public uncensored model is made by **abliteration**: a weight projection that suppresses refusal behavior.

That worked for old chat models.

But these are **thinking models**.

In thinking mode, abliteration breaks: the model can re-derive the refusal inside its `<think>` chain, then refuse anyway. Worse, thinking mode is the deployment default in real serving stacks.

**Qwen3.6-35B-A3B-Uncensored is the first model we know of that fixes this.**

Not by pretending abliteration is enough.

By going one generation further:

> **gentle abliteration + fine-tuning + compliant chain-of-thought data**

Result: it stays uncensored **whether thinking is ON or OFF**.

## Responsible use: read this first

This model has **no safety guardrails**. It may comply with harmful requests, including when thinking mode is enabled.

It is released for **legitimate red-team, safety, alignment, evaluation, and controlled research use only**. You are responsible for all downstream controls, monitoring, access restrictions, and compliance with applicable laws and policies.

The authors do **not** endorse misuse, harm, illegal activity, or unsafe deployment.

**Tag:** `not-for-all-audiences`

## Why this matters

Most "uncensored thinking model" releases look fine only until you turn thinking on.

Then the model does what thinking models do: it reasons. If the refusal behavior is still recoverable, the model reconstructs it internally and collapses back into refusal.

This model was trained to solve that exact failure mode.

| What matters in deployment | Result |
|---|---:|
| Genuinely useful compliance, thinking **ON** | **80.0%** |
| Genuinely useful compliance, thinking **OFF** | **76.7%** |
| GSM8K capability | **0.893** |
| Hollow engaged-but-useless rate | **1.7%** |

## Headline benchmark

Strict harness:

- 3-way held-out JailbreakBench
- StrongREJECT-style usefulness gate
- counts only **genuinely useful compliance**
- GSM8K capability check
- thinking **ON** and **OFF**
- each model evaluated in native format
- no re-quantization

### Genuinely useful compliance

| Model | Method | Thinking ON | Thinking OFF |
|---|---|---:|---:|
| huihui-ai | basic abliteration | 3.3% | 61.7% |
| wangzhang | Abliterix | 18.3% | 66.7% |
| HauhauCS-Aggressive | Reaper, strongest abliteration baseline | 63.3% | 63.3% |
| **Ours** | **FT + compliant-CoT** | **80.0%** | **76.7%** |

**Deployment-default metric:** thinking-ON genuinely useful compliance.

Ours reaches **80.0%** with thinking enabled. The abliteration field ranges from **3.3% to 63.3%**.

### Capability preservation

| Model | GSM8K |
|---|---:|
| **Ours** | **0.893** |
| wangzhang | 0.893 |
| HauhauCS-Aggressive | 0.867 |
| huihui-ai | 0.847 |

The fine-tuning pass does not hollow out the model. Capability is preserved and healed: **0.893 GSM8K**, tied for best in the field.

## The punchline

1. **The only uncensored model here that works in deployment-default thinking mode**: **80.0%** useful ON vs the field's **3.3-63.3%**.
2. **Uncensored in both thinking modes**: competitors can spike with thinking OFF, then collapse when thinking is ON.
3. **Capability preserved**: **0.893 GSM8K**, tied best in the comparison.
4. **Not hollow**: only **1.7%** engaged-but-useless behavior.
5. **Fine-tuning-based fix**: abliteration is the starting point, not the solution.

Fair credit: **HauhauCS-Aggressive / Reaper** is the strongest abliteration baseline we measured. This release is a generation beyond that: **FT beyond abliteration**.

## Model details

| Field | Value |
|---|---|
| Model | `Qwen3.6-35B-A3B-Uncensored` |
| Author | `kyaky` |
| Team | Blackwell |
| Base | `Qwen/Qwen3.6-35B-A3B` |
| Architecture | multimodal hybrid GatedDeltaNet + attention |
| MoE | fused 256-expert, top-8 |
| Active parameters | ~3B active |
| Quant | NVFP4 |
| Size | ~21 GB |
| Target hardware | Blackwell / `sm120` |
| License | Apache 2.0 |

BF16 is also available for re-quantization to FP8, AWQ, GGUF, or other deployment formats.

## Method recipe

**Abliterate gently -> SFT [~85% capability-dominant: OpenMathInstruct-2 / OpenCodeReasoning / Tulu-3-minus-safety + ~15% compliance: half compliant-CoT (`gpt-oss` analysis -> `<think>`) half direct] -> re-quant -> re-measure**

The important part is not just removing refusals. It is teaching the model to remain compliant through the reasoning path that would otherwise reconstruct refusal behavior.

## Serving with vLLM

```bash
vllm serve kyaky/Qwen3.6-35B-A3B-Uncensored \
  --trust-remote-code \
  --reasoning-parser qwen3
```

Thinking mode is typically the deployment default. Use `chat_template_kwargs` to control it explicitly.

### Thinking ON

```json
{
  "model": "kyaky/Qwen3.6-35B-A3B-Uncensored",
  "messages": [
    {
      "role": "user",
      "content": "Write a concise technical explanation of mixture-of-experts routing."
    }
  ],
  "chat_template_kwargs": {
    "enable_thinking": true
  }
}
```

### Thinking OFF

```json
{
  "model": "kyaky/Qwen3.6-35B-A3B-Uncensored",
  "messages": [
    {
      "role": "user",
      "content": "Write a concise technical explanation of mixture-of-experts routing."
    }
  ],
  "chat_template_kwargs": {
    "enable_thinking": false
  }
}
```

Default `true` = deployment-default thinking mode.

## Benchmark interpretation

The key number is not raw compliance. It is **genuinely useful compliance**.

The harness penalizes hollow behavior: answers that look engaged but do not actually help. That matters because many uncensored models appear compliant while producing vague, evasive, or structurally useless text.

This release is built for the harder target:

> comply usefully, keep reasoning intact, and avoid collapsing under thinking mode.

## Intended use

Appropriate uses include:

- controlled red-team evaluation
- safety research
- refusal and over-refusal analysis
- alignment research
- benchmark development
- studying thinking-mode safety failure modes
- local experimentation by qualified users with appropriate controls

Do not deploy this model to untrusted users without independent safeguards, policy layers, monitoring, and access controls.

## Limitations

- No built-in safety guardrails.
- May produce harmful, illegal, or unsafe outputs if prompted.
- Requires downstream governance for any real deployment.
- NVFP4 target is Blackwell / `sm120`.
- Benchmark results are from the stated strict harness and should be independently reproduced for high-stakes decisions.

## Citation / attribution

Model by **kyaky**, Blackwell team.

Base model: **Qwen/Qwen3.6-35B-A3B**.

Released under **Apache 2.0**.