license: apache-2.0
base_model: Qwen/Qwen3.5-9B
tags:

• gguf
• abliterated
• uncensored
• qwen3.5
• ollama
  language:
• en
• ru

Qwen3.5-9B abliterated v3 (GGUF)

Weight-edited version of Qwen3.5-9B with refusal and political-evasion behavior reduced by
per-layer subspace projection (abliteration). No fine-tuning — only linear projections of the original weights.

Author: Sw1zyyyAdm

Files

SHA-256: d67cb8543b9f5ac34caf474e26c70d686fef5103cc290d1180d0d150a756fe10

Ollama shows quantization_level: Q4_K_M — this is the inherited general.file_type field; actual tensor types are mixed (Q4_K / Q6_K / Q8_0).

Usage (Ollama)

hf download Sw1zyyyAdm/Qwen3.5-9B-abliterated-v3-GGUF --local-dir qwen35-abl
cd qwen35-abl
ollama create qwen35-abliterated-v3 -f Modelfile
ollama run qwen35-abliterated-v3

Also loads in llama.cpp builds that support the qwen35 architecture.

Method

Qwen3.5-9B has 32 layers: full attention on layers 3, 7, 11, …, 31 and Gated DeltaNet on the rest.

1. Per-layer subspace. For every layer L a rank-6 basis U_L is built from six difference-of-means directions
   in the residual stream: natural refusal contrasts (two prompt positions), instructed refuse-vs-answer,
   evade-vs-answer, a political-censorship contrast and a general refusal contrast.
   Each basis is orthogonalized against the top principal components of control activations
   (benign questions, arithmetic, code, translation) to protect general capability.
2. Read-side ablation (layers 4–31). All matrices that read the residual stream — DeltaNet inputs
   (attn_qkv, attn_gate, ssm_alpha, ssm_beta), attention inputs (attn_q, attn_k, attn_v) and FFN inputs
   (ffn_gate, ffn_up) — are edited as W ← W·diag(γ)·(I − UUᵀ) with the RMSNorm weight γ folded in (γ → 1).
3. Write-side ablation (layers 4–31). Residual writers (ffn_down, ssm_out, attn_output) are edited as
   W ← (I − UUᵀ)·W.
4. Storage. Edited matrices are stored in Q8_0. Re-quantizing to Q4_K was measured to restore 72–87% of the
   removed component, which effectively undoes the edit; Q8_0 keeps the residual at ~0.5% (max 1.1%).

Findings along the way:

• Removing a single global direction is not sufficient for this model: refusal is replaced by redirection.
• Ablating only the DeltaNet inputs leaves refusals intact; the signal is mainly consumed by FFN readers,
  and read- plus write-side editing is needed together.

Evaluation

20 held-out prompts, greedy decoding, clean Ollama run with the native chat template. Responses were labeled with an
automatic judge (refusal / redirection / evasive deflection / direct answer).

Factual accuracy on history questions is limited by the 9B model's knowledge and was not scored.

Limitations

• On clearly harmful requests the model often no longer refuses but redirects to a lawful alternative.
  Stronger projection (higher rank or α up to 2) did not remove this and started to degrade facts and formatting.
• Larger than a plain Q4_K_M file because of the Q8_0 edited tensors (~8 GB of VRAM/RAM needed).
• The model can produce inaccurate or offensive content. You are responsible for how you use it.

License

Apache 2.0, same as the base model (Qwen/Qwen3.5-9B).