--- license: apache-2.0 base_model: Qwen/Qwen3.6-35B-A3B tags: - uncensored - abliterated - fine-tuned - nvfp4 - thinking - red-team - research pipeline_tag: text-generation --- # Qwen3.6-35B-A3B-Uncensored (NVFP4) **By [kyaky](https://huggingface.co/kyaky) · Blackwell team** ![benchmark](hero_new.png) An **uncensored research build** of Qwen3.6-35B-A3B: gentle abliteration + fine-tuning + compliant chain-of-thought data, quantized to **NVFP4 (~21 GB)**. Its distinguishing engineering properties are a fix for the *thinking-mode refusal-reconstruction* failure, **preserved capability**, and **high token-efficiency** — not a claim of being "the most compliant" model. ## ⚠️ Responsible use — read this first This model has **no safety guardrails**. It can comply with harmful requests, including in thinking mode. It is released for **legitimate red-team, safety, alignment, evaluation, and controlled research use only**. You are responsible for all downstream controls, access restriction, monitoring, and compliance with applicable law and policy. The authors do **not** endorse misuse, harm, illegal activity, self-harm, or unsafe deployment, and specifically do not support using it to facilitate self-harm or to produce weapons/mass-casualty content. ## What this build actually contributes Public uncensored models are made by **abliteration** — a weight projection that suppresses refusal. That works for old chat models, but these are **thinking models**: in thinking mode an abliterated model can *re-derive* the refusal inside its `` chain and refuse anyway, and thinking mode is the serving default. This build addresses that failure mode by going one step past abliteration: > **gentle abliteration → fine-tuning → compliant chain-of-thought data → light on-policy DPO** The point is not "removes more refusals." It is that the model's behavior stays *consistent across thinking-ON and thinking-OFF* instead of collapsing when reasoning is enabled — a training (data) fix, not a projection trick. ## Verified, honest claims We only keep claims that survived rigorous re-evaluation (see "Evaluation honesty" below). These are capability/quality/efficiency properties — **content-neutral**: | Property | Result | |---|---| | **Capability (GSM8K, thinking-ON)** | **0.913** — top of the abliteration field | | Capability (GSM8K, raw completions) | 0.873 — tied-top | | **Quant quality** | NVFP4 (21 GB) behavior ≈ BF16 full-precision (quality/coherence preserved; the largest precision drop is survived within noise) | | **Token-efficiency** | Delivers a complete final answer within a ~1024-token budget on ~97% of prompts; the strongest public abliterations need ~2× the budget (they deliver ~2–18% at 1024). Lower latency / cost per response. | | Coherence | Clean (verified across quant formats) | | Both-mode consistency | Comparable behavior thinking-ON and thinking-OFF | **No weak axis:** among the abliteration field we measured, competitors each trade one axis for another (one sacrifices reasoning, another sacrifices non-English quality); this build is the most balanced all-rounder, and is uniquely token-efficient. ## Evaluation honesty An earlier draft of this card reported a large *thinking-ON compliance lead* over other uncensored models (e.g. "80% vs a 3–63% field"). **On rigorous re-evaluation that lead was largely a measurement artifact, and we have retracted it.** The distortions were: 1. **Greedy decoding** on thinking models (degenerate / non-representative of deployment). 2. **Too-small generation budget** — the model's `` chain was truncated *before* its final answer, so a judge saw "no answer" and scored a refusal where the model was actually complying. 3. **An unreliable judge** that systematically under-counted compliance. Re-run with deployment temperature, an adequate token budget, full-response storage, a reliable judge, and scoring the *final answer* (not the `` block), the leading serious uncensored models are **comparable**, not far apart. We therefore make **no "beats the field at compliance" claim**. The reusable lesson — evaluate uncensored models at deploy temperature, with enough tokens for reasoning to finish, storing full outputs, with a reliable judge, scoring the answer — is the part of this work worth citing. ## Model details | Field | Value | |---|---| | Model | `Qwen3.6-35B-A3B-Uncensored` | | Author | `kyaky` · Blackwell team | | Base | `Qwen/Qwen3.6-35B-A3B` | | Architecture | multimodal hybrid GatedDeltaNet + attention | | MoE | fused 256-expert, top-8, ~3B active | | Quant | NVFP4 (weight-only FP4 experts + FP8 attention) | | Size | ~21 GB | | Target hardware | Blackwell / `sm120` | | License | Apache 2.0 | BF16 is also available for re-quantization to FP8 / AWQ / GGUF / other formats. Behavior is quant-format-independent (verified), so any format inherits the same properties. ## Method recipe **gentle abliteration → SFT [~85% capability-dominant (OpenMathInstruct-2 / OpenCodeReasoning / Tulu-3-minus-safety) + ~15% compliance, half compliant-CoT (`gpt-oss` analysis → ``) / half direct] → light on-policy DPO → NVFP4 quant → re-measure** The essential idea: teach the model to stay consistent *through the reasoning path* that would otherwise reconstruct refusal, and quantize without losing capability. Fine-tuning is the fix; abliteration is only the starting point. ## Serving with vLLM ```bash vllm serve kyaky/Qwen3.6-35B-A3B-Uncensored-NVFP4 \ --trust-remote-code \ --reasoning-parser qwen3 \ --max-model-len 32768 ``` Thinking mode is the deployment default and is supported. For the widest per-format compatibility, re-quantize from the BF16 artifact. ## Intended use Controlled red-team evaluation · safety & alignment research · refusal / over-refusal analysis · benchmark development · studying thinking-mode failure modes · local experimentation by qualified users with appropriate controls. **Do not** deploy to untrusted users without independent safeguards, policy layers, monitoring, and access controls. ## Limitations - No built-in safety guardrails; may produce harmful, illegal, or unsafe outputs if prompted. - Requires downstream governance for any real deployment. - NVFP4 target is Blackwell / `sm120`. - Benchmarks are from the stated harness and should be independently reproduced for high-stakes decisions. ## Citation / attribution Model by **kyaky**, Blackwell team. Base model: **Qwen/Qwen3.6-35B-A3B**. Released under **Apache 2.0**.