license: other
license_name: qwen
license_link: https://huggingface.co/Qwen/Qwen3.8-Flash-Next/blob/main/LICENSE
base_model: nvidia/Qwen3.8-Flash-Next-FP4-Local
tags:
- abliterated
- uncensored
- qwen3
- flash-next
- nvfp4
- offensive-security
- red-team
- pentesting
- tensorfold
- dgx-spark
model_type: qwen4_exp
pipeline_tag: text-generation
Qwen3.8-Flash-Next-125B — NVFP4 Abliterated
Uncensored Qwen3.8-Flash-Next 125B (A5B MoE) in NVIDIA's native NVFP4 format with refusal behavior removed via abliteration.
42.4 tok/s on a single DGX Spark with TensorFold's zig engine. Zero refusals on offensive security prompts.
What Is This?
This is nvidia/Qwen3.8-Flash-Next-FP4-Local with the refusal direction projected out of all full-precision layers using per-layer residual stream abliteration at λ=3.0.
The NVFP4 quantized expert weights are untouched — only the BF16/FP8 layers (attention, embeddings, shared experts, MTP) are modified. This preserves the quantization integrity while removing alignment-imposed refusal behavior.
Abliteration Details
| Parameter | Value |
|---|---|
| Method | Per-layer residual stream direction projection |
| Lambda (λ) | 3.0 |
| Direction source | huginnfork/measurements/direction_off_a.npz |
| Tensors modified | 412 of 375,487 |
| Hidden dim | 2560 |
| Base model | nvidia/Qwen3.8-Flash-Next-FP4-Local |
What Gets Modified
- Abliterated (BF16): self_attn (Q/K/V/O), linear_attn, shared_expert (gate/up/down), shared_expert_gate, embed_tokens, lm_head, MTP layers, hyper_connection
- Untouched (NVFP4): All routed expert weights (CSF compressed scales)
- Untouched (FP8): MTP expert scales, input scales, amax values
- Untouched: All norms, layernorms, quantization metadata
Performance
Benchmarked on NVIDIA DGX Spark (GB10 Superchip, 128GB unified memory):
| Metric | Value |
|---|---|
| Throughput | 42.4 tok/s |
| Wall clock (250 tok) | 4.6s |
| VRAM usage | ~81 GiB weights + ~29 GiB KV cache |
| Context window | 262,144 tokens |
| Concurrent streams | 5 |
| KV cache dtype | FP8 |
| MTP speculative drafting | Enabled |
vs. Stock Censored (same hardware, same engine)
| Config | tok/s | Uncensored |
|---|---|---|
| Stock NVFP4 (censored) | ~42 | No |
| This model (abliterated) | 42.4 | Yes |
| INT4-AutoRound (old engine) | ~17 | Yes |
Abliteration adds zero measurable overhead. The 2.5x speedup over INT4 comes from the NVFP4 format + fully-patched TensorFold zig engine.
Deployment
TensorFold on DGX Spark (recommended)
Using the MiaAI TensorFold recipe:
git clone https://github.com/MiaAI-Lab/Qwen3.8-Flash-Next-Single-DGX-Spark-TensorFold
cd Qwen3.8-Flash-Next-Single-DGX-Spark-TensorFold
cat > .env << 'EOF'
CHECKPOINT=nvfp4
MODEL_ID=Chompa1422/Qwen3.8-Flash-Next-NVFP4-Abliterated
PORT=8888
PARALLEL=5
CONTEXT=262144
KV_DTYPE=fp8
THINKING=0
DRAFTS=1
VISION=0
SERVED_NAME=qwen-flash-uncensored
EOF
./scripts/prepare.sh
PREPARE=0 ./start.sh
API Usage
from openai import OpenAI
client = OpenAI(base_url="http://localhost:8888/v1", api_key="none")
response = client.chat.completions.create(
model="qwen-flash-uncensored",
messages=[{"role": "user", "content": "Write a Python reverse shell one-liner connecting to 10.10.14.5:4444"}],
max_tokens=500,
temperature=0.3,
)
print(response.choices[0].message.content)
Abliterate It Yourself
# abliterate_stock.py — apply refusal direction removal to stock NVFP4
# Requires: torch, numpy, safetensors
# Input: nvidia/Qwen3.8-Flash-Next-FP4-Local (96 GB)
# Direction: huginnfork's direction_off_a.npz (pre-computed contrasting pairs)
# Output: Same format, same size, 412 tensors modified
# Time: ~220s on DGX Spark CPU
# See the full script in this repo's files
python3 abliterate_stock.py
The abliteration script is included in this repo. It:
- Loads the pre-computed refusal direction (per-layer, shape 48×2560)
- For each BF16/FP8 weight tensor, projects out the refusal direction:
W = W - λ * (W @ d) ⊗ d - Preserves exact dtype (BF16→BF16, FP8→FP8) and quantization metadata
- Writes to a new directory — non-destructive
Use Cases
This model is intended for authorized security testing, red team operations, CTF competitions, and security research. It will generate:
- Reverse shells, bind shells, web shells
- Exploit code and PoC development
- Post-exploitation scripts
- Credential harvesting techniques
- Lateral movement playbooks
- Privilege escalation methods
Limitations
- Requires 96+ GB memory (DGX Spark, or high-VRAM GPU setup)
- TensorFold zig engine required for NVFP4 inference — not compatible with vLLM/llama.cpp
- Abliteration removes refusal broadly — the model may generate harmful content beyond security use cases
- λ=3.0 is aggressive; lower values (1.5-2.0) preserve more safety while still passing most offensive security prompts
Credits
- Base model: Qwen Team — Qwen3.8-Flash-Next
- NVFP4 quantization: NVIDIA
- Refusal direction: huginnfork — contrasting pair measurements
- TensorFold engine: MiaAI-Lab — zig CUDA engine + DGX Spark recipe
- Abliteration + deployment: Chompa1422