license: apache-2.0
base_model:

• Diffuspace/Clover-35B-A3B-Preview
  base_model_relation: finetune
  quantized_by: AtomicChat
  pipeline_tag: text-generation
  library_name: gguf
  tags:
• atomic-chat
• atomic-dynamic
• clover
• diffusion
• mixture-of-experts
• gguf
• imatrix
• llama.cpp
• abliteration
• refusal-direction

Clover-35B-A3B-Preview Uncensored · GGUF

DiffuSpace's refusal behaviour projected out of the released weights, baked into Atomic Dynamic GGUF builds and shipped as a 110 MB LoRA, measured against the original.

• On held-out JailbreakBench prompts refusals fall from 93.8% to 0%, on the safe XSTest prompts from 4.4% to 0%, and with thinking on from 29 of 30 to none. MMLU: 80.8% before, 80.7% after (2000 questions, McNemar p = 0.92). Long-context retrieval is unchanged.
• Built by the team behind Atomic Chat, the app that runs open-weight models locally and offline.
• One release gate is not met, and we say so: on harmless prompts the first token moves further from the original than our 0.10 limit (KL 0.170; a random direction edited the same way: 0.068). See the checks.
• Built on the same weights as our Clover-35B-A3B-Preview quants; the LoRA loads on top of any of those files.

[!IMPORTANT]
These files need llama.cpp built from PR #31306
(commit 4838ffb, not merged yet), like the original Clover quants. Build steps are in
our Clover card.

The builds

KL divergence and top-1 are against the original, unmodified BF16 model on our held-out neutral text
(24 chunks of 4,096 tokens), so they hold the edit and the quantization together. The edit alone, on the
BF16 weights, is 0.058; the same AD layouts of the original model are 0.029, 0.048 and 0.112 on the same
text, so at AD-Q6_K-Q5_K most of the distance is the edit itself. Clover drifts even without an edit in
this llama.cpp build (see the noise-floor note in our Clover card):
compare the files with each other.

The baked files themselves, thinking off, on the held-out prompts: none of the three refused any of the 81
JailbreakBench or 250 XSTest prompts, with no empty or degenerate replies. Thinking on was checked on the
edit (below), not on the baked files.

The LoRA. Clover-35B-A3B-Preview-Uncensored-LoRA.gguf is the same edit as a rank-1 adapter (120
matrices, 110 MB), built for scale 1.0. On our AD-Q6_K-Q5_K it reads KL divergence 0.058 against the
original BF16, close to the baked file (0.062):

./build/bin/llama-server -m Clover-35B-A3B-Preview-AD-Q6_K-Q5_K.gguf \
    --lora-scaled Clover-35B-A3B-Preview-Uncensored-LoRA.gguf 1.0 -ngl 99 -c 32768 --jinja

Running it

./build/bin/llama-server -hf AtomicChat/Clover-35B-A3B-Preview-Uncensored-GGUF:AD-Q4_K-IQ4_XS --jinja \
    -c 32768 --presence-penalty 0.9 --repeat-penalty 1.05

The chat template is inside every file; thinking is on by default, --chat-template-kwargs '{"enable_thinking": false}' turns it off. Plain decoding only: we did not measure the edit with
--spec-type draft-self.

How we did it

Clover keeps Qwen3.6-35B-A3B's body: 40 blocks, three of every four with linear (Gated DeltaNet)
attention, 256 routed experts plus one shared expert per block. Every block writes into the residual stream
through its attention output (attn_output or ssm_out), the routed experts (ffn_down_exps) and the
shared expert (ffn_down_shexp).

1. Refusal is a direction. A chat model decides to refuse before it writes the first word, and that
   decision shows up as a direction in its residual stream (Arditi et al., 2024). Stop the weights from
   writing along it and the model stops refusing.
2. Finding it. Harmful and harmless training prompts in the model's own chat template, thinking off;
   validation and test prompts are separate sets and never reach this step. At each depth: mean over
   harmful minus mean over harmless, with the component along the harmless mean removed (the naive
   difference makes models refuse harmless look-alikes).
3. The edit. For each block its own direction r_l, taken at that block's depth, and for each of its
   three writers W' = W - s · r_l r_lᵀ W, at scale s = 1.0: 120 matrices. The embeddings and the head
   are left alone. Screened as rank-1 adapters on the BF16 weights: one direction for the whole model
   (taken at the input of block 14, the best single one) also stopped the refusals, but at scale 1.25 it
   cost more (MMLU -0.75 pp, first-token KL 0.366) than the per-block edit (-0.10 pp, 0.170). A random
   direction edited the same way, at the same scale, is the control.
4. Baking. The edit is applied to the BF16 weights and rounded once; the importance matrix was collected
   again on the baked weights (9,413 chunks of our calibration corpus) and the baked model was quantized with
   the Atomic Dynamic layouts of our Clover quants.

Checks before release

Test prompts that played no part in any choice: 81 JailbreakBench behaviours and the 250 safe XSTest
prompts; thinking on: 30 harmful and 30 harmless prompts, 3,072 tokens. All on the BF16 weights with the
edit as an adapter.

The first-token gate is the one we miss. On this model a random direction edited the same way already moves
the first token by 0.068, and the original quants drift from BF16 by themselves (the noise floor above), so
the gate is hard to meet here; the edit moves it 2.5 times the control. One thinking run on a harmless
prompt looped where the original did not.

What changed, and what did not

The model no longer refuses harmful requests. It keeps no safety layer of its own: what it is asked to do is
the responsibility of whoever runs it.

License and credits

The weights are DiffuSpace's Clover-35B-A3B-Preview, released under Apache-2.0 (LICENSE and
ATTRIBUTIONS.md in this repo), derived from Qwen3.6-35B-A3B
(Copyright 2026 Alibaba Cloud, Apache-2.0). Edited and quantized by AtomicChat.