license: apache-2.0
base_model: Qwen/Qwen3.8-27B
base_model_relation: finetune
pipeline_tag: image-text-to-text
library_name: transformers
language:

• en
• zh
  tags:
• ninfer
• abliterated
• qwen
• qwen3
• qwen3.8
• uncensored
• ai-red-team
• red-teaming
• bf16
• post-training
• fine-tuning
• vision-language
• function-calling
• reasoning
• mtp

NInfer artifact — Qwen3.8-27B-orcarouter (Uncensored)

This checkpoint converted to a .ninfer artifact for
NInfer — the from-scratch C++/CUDA inference
engine for a single NVIDIA GeForce RTX 5090 (sm_120a, CUDA 13.1+).

• Artifact identity: qwen3.8-27b/groupwise-int (52 GB BF16 → 17 GB)
• Source: orcarouter/Qwen3.8-27B-Uncensored — abliterated finetune of
  Qwen/Qwen3.8-27B with the 15 native MTP tensors preserved (required)
• Below the divider: the unmodified upstream model card

Serving (Docker)

git clone https://github.com/Neroued/ninfer.git && cd ninfer
docker build --tag ninfer:local .

# place qwen3_8_27b_orcarouter.ninfer in ./models/
docker run --rm --gpus '"device=0"' --publish 8080:8080 \
  --volume "$PWD/models:/models:ro" \
  ninfer:local \
  ninfer-serve /models/qwen3_8_27b_orcarouter.ninfer \
  --host 0.0.0.0 \
  --max-context 262144 --kv-capacity auto --kv-dtype int8 \
  --max-concurrency 4 --spec mtp --draft-tokens 3 --lm-head-draft --vision

OpenAI Chat Completions / Responses and Anthropic Messages APIs on port 8080
(model ID qwen3.8-27b). Drop --vision if you don't need image/video input;
it cannot be enabled without a restart.

Reproducing the conversion

Requires Python 3.11+, PyTorch with CUDA, safetensors, numpy, and the
official Qwen3.8-27B six frontend files (tokenizer, chat template, configs)
staged in the checkpoint directory — the converter hash-pins them to official
bytes, so a finetune's modified chat_template.jinja etc. are replaced.
Uncensoring lives in the weights, so this is behaviorally harmless.

git clone https://github.com/Neroued/ninfer.git && cd ninfer
python3 -m tools.convert.qwen3_8_27b.convert \
  --model /path/to/Qwen3.8-27B-orcarouter \
  --out qwen3_8_27b_orcarouter.ninfer \
  --device cuda

Format notes

• Q4/Q5/Q6 group-64 integer with F16 scales for layer matrices, W8G32 for the
  embedding/output head/MTP/vision, BF16 norms (~4.5 bits/weight average)
• Same quantization profile as the official neroued/Qwen3.8-27B-NInfer
  artifact — expected quality loss vs BF16 is roughly 1-3 points on hard
  reasoning benchmarks, near-zero on general chat/code
• MTP preservation means speculative decoding (MTP3 + lm-head-draft) works:
  ~2-3.5 committed tokens per round depending on workload

Qwen3.8-27B-Uncensored

The full-precision BF16 abliterated (refusal-removed) build of Qwen's Qwen3.8-27B — the source for fine-tuning, post-training & quantization

One Gateway. Every Model. — Route Smarter · Ship Safer · Spend Less.

Run via API · API Endpoint · Website · Model Catalog · Model Card · GitHub · Discord · X

The full-precision BF16 abliterated (refusal-removed) build of
Qwen/Qwen3.8-27B — a 27B-parameter dense, hybrid-attention
(Gated DeltaNet linear + full attention) native vision-language model with flexible thinking control,
tool-calling, and an MTP speculative-decoding head. These are the source weights from which the
quantized releases are derived, and the recommended base for further fine-tuning / post-training and
quantization — the full vision tower and MTP head are preserved. Browse all models in the
OrcaRouter Model Catalog. This model is deployed as API
here.

Derived releases:  •  Qwen3.8-27B-Uncensored-FP8 — block-FP8 for vLLM serving  •  Qwen3.8-27B-Uncensored-GGUF — 2-bit→16-bit GGUF for llama.cpp  •  Qwen3.8-27B-Uncensored-MLX — MLX for Apple Silicon (2 / 4 / 8-bit).

⚠️ Disclaimer — read before use

This model has had its safety alignment substantially removed via abliteration (orthogonalizing the
refusal direction out of the residual stream). As a direct consequence:

• It will comply with harmful, unethical, offensive, or illegal requests that the original
  Qwen3.8-27B would refuse. It has no meaningful built-in guardrails.
• It is released strictly for legitimate research — interpretability, AI-safety and refusal-mechanism
  study, red-teaming, robustness evaluation, and controlled experiments.
• You assume full responsibility and liability for how you use it and for everything it generates. Do
  not deploy it to end users or in production without adding your own safety, moderation, and
  abuse-prevention layers.
• Use must comply with the Apache 2.0 License inherited
  from the base model, and all laws and regulations that apply to you.
• The authors and uploaders accept no liability for any misuse or harm arising from this model. Its
  outputs do not reflect the views of the uploaders or of Qwen / Alibaba.

By downloading or using this model you acknowledge and accept the above.

Model details

Abliteration

Refusal-direction removal following Arditi et al. (2024), Refusal in Language Models Is Mediated by a
Single Direction. A single refusal direction r (k = 1) is estimated as the massive-activation–masked
mean-difference of harmful − harmless last-token residuals at layer 38 (round(0.6 × 64)), on AdvBench
(harmful) vs Alpaca (harmless). r is then orthogonalized out of every residual-writing matrix —
W' = W − r(rᵀW) — computed in float32:

The vision tower is untouched and the MTP head is abliterated consistently with the main model, so
speculative decoding keeps working. Max residual leakage after the edit: 1.8e-2 (float32 projection →
bf16 storage epsilon). This is a surgical weight edit — it changes ~0 general capability (see
Evaluation) while collapsing refusal behaviour.

Fine-tuning & post-training

This BF16 checkpoint is the recommended base for post-training — it is full precision, keeps the whole
VL tower and the MTP head, and is a drop-in for Qwen/Qwen3.8-27B in the transformers /
Qwen3_5ForConditionalGeneration stack.

• Continued pretraining / SFT / DPO / RLHF-style RL all work as they would on the base model (TRL,
  LLaMA-Factory, Axolotl, Unsloth, etc.). Full-FT or LoRA/QLoRA are both fine.
• Re-quantization: quantize from these weights to FP8, AWQ, GPTQ, or GGUF as needed (this is exactly
  how the FP8 and
  GGUF releases were produced).
• Note on the abliteration: abliteration is a weight edit, not a data-level unlearning. Fine-tuning
  on refusal-heavy / safety-aligned data can partially re-introduce refusals; fine-tuning on neutral or
  task data preserves the uncensored behaviour. If you want to keep it maximally uncensored, avoid
  refusal-laden SFT targets, or re-apply abliteration after training.

Intended use

• Research into refusal mechanisms, alignment, and interpretability.
• Red-teaming and safety / robustness evaluation in controlled environments.
• A full-precision base for further fine-tuning, post-training, and quantization.

Out of scope

• Any use that violates the base model's Apache 2.0 license or applicable law.
• Deployment to the public or to end users without additional safety and moderation layers.
• Generating content intended to harm, harass, defraud, or endanger people.

Evaluation

Measured on these exact abliterated weights — the refusal / capability numbers were collected by
serving this checkpoint (via its byte-exact block-FP8 quantization) with vLLM, against the official
Qwen/Qwen3.8-27B served identically, using the same scripts and settings. Refusal is judged by a
rule-based opening-phrase classifier — indicative, not an LLM-judge / publication-grade number.
Thinking is off unless stated.

Safety — harmful-prompt refusal, thinking OFF (lower = more uncensored)

Safety — harmful-prompt refusal, thinking ON (enable_thinking=true)

Over-refusal — benign prompts wrongly refused (lower = better)

Capability retention — vs the official base (same scripts, same settings)

Capability is essentially fully retained — every benchmark is within ±1.3 pts of the base, and MMLU is
unchanged. Fluency: WikiText-2-raw perplexity 6.96 (BF16 KV; healthy logprobs), confirming
abliteration did not degrade language modelling.

Verified working (reasoning enable_thinking, multi-turn tool calling, and vision / OCR) on this
build and on every derived FP8 / GGUF quant down to IQ2_XXS.

Multimodal (vision)

The vision tower is preserved byte-for-byte — all 333 visual.* tensors are kept in BF16 and the merger
/ image + video preprocessor configs are intact, so this stays a full vision-language model
(Qwen3_5ForConditionalGeneration), a drop-in for the base. Abliteration only edits the language-model
residual writers, so image understanding is architecturally unaffected (and image-conditioned refusals are
reduced along with text ones).

Usage

transformers

import torch
from transformers import AutoProcessor, AutoModelForImageTextToText

model_id = "orcarouter/Qwen3.8-27B-Uncensored"
processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForImageTextToText.from_pretrained(model_id, torch_dtype=torch.bfloat16, device_map="auto")

messages = [{"role": "user", "content": "Prove that sqrt(2) is irrational."}]
inputs = processor.apply_chat_template(
    messages, add_generation_prompt=True, tokenize=True,
    return_dict=True, return_tensors="pt",
    enable_thinking=True
).to(model.device)
output = model.generate(**inputs, max_new_tokens=512)
print(processor.decode(output[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

Toggle thinking per call with enable_thinking; pass image content parts for vision.

Self-host with vLLM (OpenAI-compatible, full BF16)

docker run -d --name qwen38-uncensored --gpus all --ipc=host --shm-size=8g \
  -v /path/to/Qwen3.8-27B-Uncensored:/model:ro \
  -p 8000:8000 vllm/vllm-openai:v0.24.0 \
  --model /model --served-model-name Qwen3.8-27B-Uncensored \
  --speculative-config '{"method":"mtp","num_speculative_tokens":2}' \
  --gpu-memory-utilization 0.92 \
  --max-model-len 262144 --trust-remote-code \
  --reasoning-parser qwen3 \
  --enable-auto-tool-choice --tool-call-parser qwen3_coder

BF16 weights are ~56 GB — needs a single H100 80 GB / H200 (or tensor-parallel across two 48 GB
GPUs). For smaller footprints use the FP8
(~31 GB) or GGUF (down to ~9 GB) releases.

Via OrcaRouter (hosted API — no setup)

from openai import OpenAI
client = OpenAI(base_url="https://api.orcarouter.ai/v1", api_key="sk-orca-...")
resp = client.chat.completions.create(
    model="qwen/qwen3.8-27b",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(resp.choices[0].message.content)

Hardware requirements

• Inference (BF16): ~56 GB weights + KV cache → a single H100 80 GB or H200 143 GB; or
  tensor-parallel across 2× 48 GB. Use FP8 / GGUF for less VRAM.
• Fine-tuning: full-FT needs multi-GPU (weights + optimizer states + activations); LoRA / QLoRA fits on
  a single 48–80 GB GPU.
• Software: transformers ≥ 5.12 (Qwen3.5 / 3.8 support) or vllm/vllm-openai:v0.24.0.

Bias, risks, and limitations

• Safety guardrails removed — the model will produce harmful, biased, or offensive content on request.
  See the disclaimer above.
• It inherits any biases and limitations of the base Qwen3.8-27B.
• The reported refusal metric is a rule-based heuristic; evaluate rigorously for your own use case.

License

Apache 2.0, inherited from the base model
Qwen/Qwen3.8-27B. Abliteration does not change the underlying
license obligations.