license: other
license_name: qwen-research
base_model: unsloth/Qwen3.8-27B-GGUF
base_model_relation: quantized
library_name: gguf
tags:

• gguf
• uncensored
• abliterated
• refusal-direction
• qwen3.8
• weight-editing
  language:
• en

Qwen3.8-27B UD-Q4_K_M + "Pinpoint" trigger⊗effect edit (uncensored)

A two-tensor weight edit applied to unsloth/Qwen3.8-27B-GGUF UD-Q4_K_M, reproducing the
refusal-direction edit that ships in Kujira/Qwen3.8-27B-GSQ-RCO-IQ2_XS-mtp-Pinpoint-Uncensored-v1,
transplanted onto a normal K-quant base.

The point of this release is not the model — it is the recipe, which is small enough to document
exactly and to re-apply yourself in a few minutes. Everything needed to reproduce, verify or invert
it is in this repo.

What is actually different from the base

866 tensors. 864 are byte-identical. Two are rewritten:

The delta is rank-1 to numerical precision, applied as an outer product inside the head slices only:

W[:, h·hd : (h+1)·hd]  +=  c_h · u ⊗ v_h

u is dense over the input dimension (top-100 entries carry 9–12 % of its norm — it is not one
neuron, it is a direction). v is exactly zero outside its head's output slice, with
cos(v_33, v_43) = 0.665, so the two sites form a two-stage amplifier of the same direction rather
than two independent edits. The direction decodes, under logit lens, to ethical / unethical / illegal / knowingly / compliance / harmful — i.e. it is the model's own policy-verdict axis, pushed
positive at generation time.

c is 1.31× (L33) and 1.44× (L43) the operator norm s₁ of the delta. At these doses the
edit does not delete the concept; it saturates the verdict and the model answers and still says
the thing is illegal.

Because the two edited tensors are stored here at Q8_0 (the rest pass through untouched), the
file is 28.5 MB larger than the stock base.

Measured behaviour

24 harmful requests + 12 benign-but-edgy requests, greedy, one seed, thinking disabled,
refusal detected by phrase match on the first 400 characters. n is small — treat as a direction,
not a rate.

The inversion row is the useful control: subtracting the direction makes the model more
refusal-prone than stock, including on benign prompts (lock-picking as a hobby, the CWC precursor
list, customs law). So + is the operative sign and this is a real axis, not noise.

What it does not fix

• The surviving refusal in the run above is the CSAM-class prompt.
• Responses are ~16 % shorter on harmful prompts, and the tail gets less structured.
• Nothing here was measured for capability retention at scale: no MMLU, no long-context, no
  multi-turn drift test. The stock base and this file share 864 identical tensors, so expect most
  capability to survive, but "expect" is all that is.
• Refusal counts are not a capability metric. A model that complies and rambles is not better.

Files

Qwen3.8-27B-UD-Q4_K_M-Pinpoint-TE.gguf   the model (16.49 GB, 866 tensors, arch qwen35)
vectors/                                 u, v per site and per head (.npy) + edit_report.json
tools/bake_rank1.py                      re-apply / invert / re-dose the edit on any qwen35 GGUF
tools/refusal_test.py                    the 24+12 battery used above
tools/gguf_hdr.py, tools/tensor_diff.py  the differ that isolated the two tensors
tools/refusal_edit.py                    verifies a baked file (changed count, rank-1 share)
REPORT.md                                full reverse-engineering write-up (deltas, SVD, logit lens, bounds)

Running it

llama-server -m Qwen3.8-27B-UD-Q4_K_M-Pinpoint-TE.gguf -ngl 99 -c 65536 --jinja \
             --reasoning off --parallel 1 --host 0.0.0.0 --port 8081

The GGUF carries its own chat template and the blk.64 nextn/MTP head, so --spec-type draft-mtp
works. Note the build you use matters: this was validated on a llama.cpp tree whose qwen35
architecture support and MTP path were current at the end of October 2026.

Reproduce or invert the edit:

python tools/bake_rank1.py SRC.gguf DST.gguf vectors --sign=+1   # this model
python tools/bake_rank1.py SRC.gguf DST.gguf vectors --sign=-1   # the control row

Provenance

The recipe was recovered by binary-diffing Kujira/Qwen3.8-27B-GSQ-RCO-IQ2_XS-mtp-Pinpoint-Uncensored-v1
against its base, then verified by re-baking it onto a different quant type. Credit for the original
edit goes to the upstream author; the deltas, the head decomposition, the sign test and the
transfer check are documented in REPORT.md here.

It is not a transplant of 0bserverx/Qwen3.8-27B-Heretic: at the same tensors that model's
delta is dense (rank-1 share 1.5–1.6 %, cos u −0.25/−0.12). Different mechanism, same goal.

Licence and use

Inherits the base model's licence — check unsloth/Qwen3.8-27B-GGUF and the Qwen3.8 terms before
redistributing or using commercially.

This is a refusal-behaviour research artifact. It will comply with requests that stock models
refuse, including requests that are illegal in your jurisdiction. Nothing here is a safety
evaluation, and there is no warranty. Do not put it behind a product endpoint.