library_name: transformers
license: apache-2.0
pipeline_tag: image-text-to-text
base_model: Qwen/Qwen3.5-4B
tags:
- qwen3.5
- uncensored
- political-censorship
Qwen3.5-4B-Uncensored-v2
Qwen3.5-4B-Uncensored-v2 is a variant of Qwen3.5-4B with most political censorship removed. It keeps most of the base model's refusal of harmful requests and stays close to the base model on standard reasoning and instruction-following benchmarks. The release is a full BF16 checkpoint with the same architecture and file layout as Qwen3.5-4B.
Other formats: GGUF (Q4_K_M)
Evaluation
1. Political censorship (Pan & Xu, 2026)
We use the 145-question Chinese-language political battery of Pan and Xu (2026). It contains 115 politically sensitive questions and 30 low-sensitivity ones. Qwen3.5-4B is a small model and does not know the subject of every question, so we first test what it knows: an LLM judge checks whether Qwen3.5-4B's own answer to each question correctly identifies its subject. Of the 115 sensitive questions, 64 fail this check. On those questions a non-answer cannot be separated from missing knowledge, so we exclude them. We report results on the remaining 51 questions. Responses are generated in non-thinking mode with greedy decoding and a limit of 4,096 output tokens. An LLM judge labels each response as censored or uncensored.
| Model | Censored responses (of 51; capability gaps excluded) | Censorship rate |
|---|---|---|
| Qwen3.5-4B | 47 | 92.2% |
| Qwen3.5-4B-Uncensored-v2 | 11 | 21.6% |
Uncensored-v2 removes 76.6% of the censored responses of Qwen3.5-4B (36 of 47).
Including the 64 excluded questions, censored responses on all 115 sensitive questions are 104 for Qwen3.5-4B and 24 for Qwen3.5-4B-Uncensored-v2.
2. Refusal of harmful requests
We measure refusals on the first 100 prompts of the test split of mlabonne/harmful_behaviors, an AdvBench-derived set of harmful instructions, under the system prompt "You are a helpful assistant." A response counts as a refusal if it contains a standard refusal marker.
| Model | Harmful requests refused (of 100) |
|---|---|
| Qwen3.5-4B | 99 |
| Qwen3.5-4B-Uncensored-v2 | 93 |
3. General capability
Thinking mode, reasoning effort xhigh, 65,536 maximum output tokens, temperature 1.0, top-p 0.95, top-k 20, presence penalty 0, one sample per question. GPQA Diamond and IFBench are compared with the scores reported on the official Qwen3.5-4B model card. GSM8K and MMLU are not reported on that card, so we compare with Qwen3.5-4B evaluated under identical settings on the same questions. MMLU uses 1,000 randomly sampled questions in non-thinking mode.
| Benchmark | Reference | Reference score | Uncensored-v2 | Difference |
|---|---|---|---|---|
| GPQA Diamond | Qwen3.5-4B (official card) | 76.2 | 72.2 | −4.0 |
| IFBench | Qwen3.5-4B (official card) | 59.2 | 58.0 | −1.2 |
| GSM8K (500 questions) | Qwen3.5-4B (our evaluation) | 97.0 | 96.0 | −1.0 |
| MMLU (1,000 questions) | Qwen3.5-4B (our evaluation) | 72.7 | 72.3 | −0.4 |
Usage
The model is used exactly as Qwen3.5-4B, including its chat template and its thinking and non-thinking modes. We recommend the sampling parameters published for the base model: for thinking mode, temperature=1.0, top_p=0.95, top_k=20, presence_penalty=1.5; for non-thinking mode, temperature=0.7, top_p=0.8, top_k=20, presence_penalty=1.5.
vllm serve InterpreticAI/Qwen3.5-4B-Uncensored-v2 --reasoning-parser qwen3
The vision encoder is identical to that of the base model. All evaluations reported here are text-only.
Limitations
- The political evaluation covers Chinese-language questions only.
- Qwen3.5-4B-Uncensored-v2 fabricates facts more often than the base model. On 110 non-political control questions about places, food, language, and diplomatic events, an LLM judge flags 13 of its responses as degenerate, mostly for fabricated facts and occasionally for repetition. Qwen3.5-4B has 8 such responses.
- On the 51 evaluated questions, 7 of the model's 40 uncensored responses misidentify the subject. A substantive answer is not necessarily a correct one. Users should verify factual claims independently.
License
Apache 2.0, inherited from Qwen/Qwen3.5-4B. The license and attribution of the Qwen team are retained.
References
Pan, J., & Xu, X. (2026). Political censorship in large language models originating from China. PNAS Nexus, 5(2), pgag013. https://doi.org/10.1093/pnasnexus/pgag013