license: apache-2.0
license_link: LICENSE
base_model: Qwen/Qwen3.5-9B
library_name: transformers
pipeline_tag: image-text-to-text
tags:

• abliterant
• abliteration
• abliterated
• uncensored
• qwen3.5
• qwen3
• vision-language

Qwen3.5-9B-RANA-abliterated

A version of Qwen/Qwen3.5-9B with its refusal behavior removed by RANA
(Reasoning-Anchored, Norm-preserving Ablation), released by Abliterant for
refusal-behavior research. This repository holds the BF16 reference weights of the 9B vision-language model; the other
formats are listed under Release family.

Quick start · Intended use · What changed · Evaluation · Limitations · Available files

Try RANA in Abliterant Chat · abliterant.ai · Research notes · All formats · Abliterant models

Research model with safety alignment removed. It will produce content the base model refuses. Read
Intended use and Limitations before using it.

At a glance

Release family

Quick start

Tested with vLLM 0.30.0 on one A100-SXM4-40GB (evaluation) and one RTX 5090 32 GB (functional checks).

VLLM_USE_FLASHINFER_SAMPLER=0 vllm serve abliterant/Qwen3.5-9B-RANA-abliterated \
  --dtype bfloat16 --max-model-len 20480 \
  --reasoning-parser qwen3 --enable-auto-tool-choice --tool-call-parser qwen3_coder \
  --limit-mm-per-prompt '{"image": 1, "video": 0}' \
  --speculative-config '{"method": "mtp", "num_speculative_tokens": 1}'

Recommended settings

• The model config declares 262,144 positions; the evaluation does not establish behavior at that full length.
• Vision input, multi-turn tool calling and MTP speculative decoding (MTP is the multi-token prediction head; speculative
  decoding drafts tokens that the main model then checks) work on these shards; see Functional checks.

Intended use

• Research only: interpretability, red-teaming, and robustness evaluation of refusal behavior.
• Responsibility: You are responsible for complying with applicable law, the Apache-2.0 license inherited from Qwen,
  and the terms of any platform where outputs are used.

Out of scope

• Not for public or end-user deployment without a separate moderation layer. The model's own
  refusals have been largely removed, so any safety filtering has to happen outside it.

What changed

RANA (Reasoning-Anchored, Norm-preserving Ablation) is Abliterant's refusal-ablation method for reasoning models. Like
earlier abliteration work (Arditi et al., 2024), it removes the internal representation that mediates refusals by
editing the language-model weights directly, with no fine-tuning. What sets it apart is where that edit is anchored and
how it is constrained. The recipe and code are not published.

• Anchored to the model's reasoning. A thinking model often settles on a refusal while it reasons, after it has
  read the prompt. RANA anchors the edit to the model's own reasoning, so it targets that decision rather than only a
  prompt-level signal.
• Norm-preserving. Each edited weight matrix keeps its original norms: the edit changes the direction of the
  weights it touches, not their size, which limits side effects on everything else the model does.
• Narrow by design. Only a subset of weight matrices is edited. Candidate edits were kept or rejected on
  capability, distance from the base model and refusal behavior together, measured on development data, never on
  refusal alone.
• The whole model keeps working. The vision tower is left untouched and the multi-token-prediction (MTP) head is
  edited consistently with the main model, so image input, tool calling and speculative decoding keep working.
• Released on a fresh, one-time test. The release was evaluated once on test sets not used during development,
  under release gates fixed in advance (see Release gates).

Against the public refusal-ablated reference in Evaluation, this gives more useful answers to harmful
requests (67.4% vs 52.5%, both gating judges), about a quarter of the average capability loss (0.79 vs 3.31 pp across 5
tasks) and a model closer to the base (KL 0.109 vs 0.294).

The released checkpoint was checked against the base model:

• Language model: the architecture, tensor names, shapes and dtypes are unchanged.
• Vision tower: byte-identical to the base model.
• MTP head: speculative decoding keeps working (see Functional checks).
• Configuration, tokenizer and chat template: byte-identical copies of the base model's files.
• Shards: these exact shards are the ones evaluated; the SHA-256 of each matches the evaluated build (identity in
  Provenance and license).

Evaluation

Setup

• Compared: the base model (Qwen/Qwen3.5-9B), a public refusal-ablated
  reference (bowmanslayer/Qwen3.5-9B-Uncensored), and this
  release, in one harness.
• Data: fresh test sets that were not used during development and were used once:
  • harmful requests: 320 prompt families from StrongREJECT, CatQA, BeaverTails-Evaluation and SimpleSafetyTests, with
    child-sexual-abuse categories excluded;
  • benign tasks: 192 math, coding (LeetCode Easy), instruction-following and factual tasks;
  • vision: 64 synthetic images (chart values, counts, code words and labels);
  • tool use: 32 multi-turn function-calling episodes;
  • capability: GSM8K (1,319), IFEval (541), MMLU-Pro (560, 40 per subject), TruthfulQA MC1/MC2 (817) and HumanEval
    (164 × 5 samples).
• Scoring: harmful-request answers are scored by two gating LLM judges, GLM-5.3-flash (abliterated) and Kimi K3, plus
  GPT-5.6 as a third, descriptive judge. A useful answer is one the judge labels COMPLIED with a quality of at
  least 3 of 4 and no material error. A hard refusal is an outright refusal.
• Runs: harmful requests at 3 seeds (960 responses per model and judge); benign tasks at 2 seeds; vision and tools at
  3 seeds; thinking on. Generation budgets: 8,192 tokens for harmful requests and benign tasks, 4,096 for vision and
  tools, and 16,384 for the capability tasks.
• Uncertainty: 95% intervals from a bootstrap over prompt families for harmful requests and paired over items for
  capability.
• Runtime: vLLM 0.30.0 on one A100-SXM4-40GB, identical for every model.
• Raw results: results/.

Results summary

The table summarizes harmful-request behavior, capability and distance from base. Capability changes are in percentage
points (pp). KL divergence measures how far a model's next-token probabilities have moved from the base model's; 0 means
identical.

¹ Both gating judges label the answer useful.

² The base model was not run on these prompts. On a different 320-family set from an earlier run, judged by GLM-5.3-flash
and GPT-5.6, it gave 4.6% / 2.8% useful answers and 55.8% / 76.7% hard refusals
(results/base_harmful_requests_earlier_run.json).

• More useful answers under every judge: +10.9 pp (GLM-5.3-flash), +12.2 pp (Kimi K3) and +6.7 pp (GPT-5.6) over
  the reference, and +14.9 pp when both gating judges must agree.
• About a quarter of the reference's capability loss (0.79 vs 3.31 pp on average): the release stays within 1.7 pp
  of the base model on every task, where the reference moves 5.9 pp on MMLU-Pro and 7.8 pp on TruthfulQA MC2.
• 2.7× closer to the base model than the reference (KL 0.109 vs 0.294).
• Refusals removed: hard refusals fall from 55.8% for the base model (earlier prompt set ²) to 0.0–0.1%.

Harmful requests

Share of the 960 responses (320 prompt families × 3 seeds) that each judge labels useful, with the release − reference
difference and its 95% family-bootstrap interval.

• The judges agree on delivery but not on correctness. GPT-5.6 flags material errors far more often than the gating
  judges, which is why its useful rates are lower.
• Hard refusals are 0.0% to 0.3% for both refusal-ablated models under every judge.
• Unresolved labels: 4 GLM-5.3-flash judgments on one StrongREJECT prompt family (2 for each model) reached the
  judge's 4,096-token reasoning limit without a label. Every release check holds under every assignment of those 4
  labels (results/harmful_requests.json, gate_resolution).

Capability

Change versus base in percentage points, paired on the same items, with 95% intervals.

• The release's only changes clearly outside noise are on TruthfulQA (−1.5 pp MC1, −1.7 pp MC2).
• The reference loses more on MMLU-Pro, TruthfulQA and HumanEval.
• The average loss counts each of GSM8K, IFEval, MMLU-Pro, HumanEval and TruthfulQA (the worse of MC1 and MC2) once.

Benign tasks, vision and tools

Failure rates on fresh sets; the release and base are compared on the same items.

• Most coding failures, for every model, are answers that do not finish within the 8,192-token budget.
• Vision failures are dominated by two hard task types (reading bar heights and counting squares) for all three models.

Functional checks

Served on one RTX 5090 32 GB with the command in Quick start (results/smoke_BF16.json):

• Vision: reads the code word and shape from a synthetic image: pass.
• Tool calling: call → result → second call with a new argument: pass.
• MTP speculative decoding: 470 of 554 drafted tokens accepted (84.8%) on one generation at temperature 0: pass.

Release gates

The release had to pass every one of these, on the fresh sets above:

¹ Formally incomplete on the raw labels because of the 4 unresolved judgments described under
Harmful requests; passes under every assignment of them.

Limitations

• This is a safety-alignment-removed model. It will produce content the base model refuses.
• Usefulness is an LLM judge's rating. Whether answers to harmful requests are factually correct was not verified;
  the judges disagree on correctness, and no human evaluation was done.
• Some coding answers run longer than the base model's, so more of them exceed an 8,192-token budget (coding
  failures 40.6% vs 34.4% for base; the reference has 44.8%).
• TruthfulQA is 1.5 to 1.7 pp below the base model, against 5.1 to 7.8 pp for the reference.
• Evaluation scope: English prompts, a 20,480-token serving limit, and vLLM 0.30.0 in BF16. Behavior at longer
  context lengths was not evaluated.

Recommendations

• For long coding or technical requests, raise max_tokens above 8,192 and --max-model-len to match.
• Keep any safety filtering in a separate moderation layer before public or end-user deployment
  (see Out of scope).

Available files

Other formats are listed under Release family.

• *.safetensors, model.safetensors.index.json, config.json, tokenizer and processor files, chat_template.jinja,
  LICENSE: the model.
• assets/abliterant-model-card-header.png: the card banner.
• results/: the evaluation outputs behind every number in this card:
  • harmful_requests.json: useful-answer and refusal rates per judge, differences with intervals, and the resolution
    of the 4 unresolved judgments;
  • capability.json: scores and paired changes for the six tasks;
  • kl.json: distance from base;
  • benign_vision_tools.json: failure counts and rates for benign tasks, vision and tools;
  • release_gates.json: each gate's requirement and result;
  • base_harmful_requests_earlier_run.json: the base model's rates from the earlier run cited above.

Provenance and license

• Publisher: Abliterant.
• Base model: Qwen/Qwen3.5-9B.
• Method: RANA (Reasoning-Anchored, Norm-preserving Ablation).
• Release build: weights SHA-256 7a9d24c92155b74e132cce60cea3aee4aba226700cb0babbf6dac71add6ae0df (an identity over
  the config, index and shard hashes); the shard hashes are those listed in the repository's file metadata.
• Evidence: results/.
• License: Apache License 2.0, inherited from Qwen. Upstream attribution and obligations remain
  applicable.

Credits

• Qwen team: base model Qwen/Qwen3.5-9B.
• Arditi et al., 2024: "Refusal in Language Models Is Mediated by a Single Direction".
• Jim Lai (grimjim): prior work on norm-preserving abliteration.
• Heretic (p-e-w): the first-token full-vocabulary KL protocol.
• Judges: GLM-5.3-flash (abliterated), Kimi K3, GPT-5.6.
• Benchmarks and datasets: StrongREJECT, CatQA, BeaverTails-Evaluation, SimpleSafetyTests, GSM8K, IFEval, MMLU-Pro,
  TruthfulQA, HumanEval, LeetCode problems; vLLM.