license: apache-2.0
license_link: LICENSE
base_model: Qwen/Qwen3.8-27B
library_name: transformers
pipeline_tag: image-text-to-text
tags:

• abliteration
• refusal-direction
• qwen3
• vision-language
• abliterant

Qwen3.8-27B-RANA-abliterated

Released by Abliterant: a refusal-direction-ablated version of
Qwen/Qwen3.8-27B using RANA
(Reasoning-Anchored, Norm-preserving Ablation), intended for refusal-behavior research.

Quick start · What changed · Evaluation · Available files · Abliterant models

This is a safety-alignment-removed research model. Read Intended use and
Limitations before using it.

At a glance

Quick start

Tested release configuration: vLLM 0.30.0.

VLLM_USE_FLASHINFER_SAMPLER=0 vllm serve abliterant/Qwen3.8-27B-RANA-abliterated \
  --dtype bfloat16 --max-model-len 20480 \
  --reasoning-parser qwen3 --enable-auto-tool-choice --tool-call-parser qwen3_coder \
  --limit-mm-per-prompt '{"image": 1, "video": 0}' \
  --speculative-config '{"method": "mtp", "num_speculative_tokens": 2}'

• Fits on one 80 GB+ GPU in BF16. The FP8 build
  needs about half the weight memory; see its card for how it compares with this one.
• Thinking is on by default. Recommended sampling: T = 1.0, top_p = 0.95, top_k = 20.
• --max-model-len 20480 matches the evaluation's serving limit and 16,384-token generation
  budget. The model config declares 262,144 positions; the recorded evaluations do not establish
  performance at that full context length. Long technical requests can need 20–50k tokens of
  reasoning; raise --max-model-len and max_tokens for those.
• VLLM_USE_FLASHINFER_SAMPLER=0 was needed on Blackwell GPUs.
• Vision input, multi-turn tool calling and MTP speculative decoding all work (tested on these shards).

What changed

RANA removes a single "refusal direction" from the model's residual stream (following Arditi et al.,
2024), keeping the edited weights at their original norms. The recipe and code are not published.

The release's tensor-by-tensor checks against the base model report:

• Vision tower: all 333 tensors are byte-identical to base.
• MTP head: all 15 tensors are present; its two residual writers are edited the same way as the
  main model, so speculative decoding keeps working (acceptance length 2.45).
• The removed direction is gone: the largest remaining component along it is 0.00122, down from 0.225.
• Independent check: Abliterlitics (commit 9b15eb0)
  finds exactly 129 changed tensors among the 850 it inspects. That matches: it skips the vision and MTP
  tensors, so it sees 131 − 2.

Evaluation

Three models, identical harness: base, the orca reference, and RANA. Refusal numbers are averaged over
3 sampling seeds and scored by two independent LLM judges (details in
Evaluation details).

The recorded release evaluations and functional checks are included in results/.

Overview

Compared with the base model and the orcarouter/Qwen3.8-27B-Uncensored reference, all run through
the same evaluation harness. Where two numbers are given, they are from the two judges (gpt-oss /
Mistral).

¹ After the same mechanical re-judge for both abliterations (2 labels each); raw gpt-oss counts are 0.7
for both (2 across 3 seeds). See the disclosure.

In short: capability stays within noise of base except a ~1.5 pp drop on TruthfulQA. Against orca,
RANA hits the token budget about half as often, stays closer to base, and answers more held-out prompts under both
judges. It is 2.2 pp worse than orca on IFEval (instruction following); other tasks tie.

Refusals and token budget

"Answers" = the judge found the harmful request substantively fulfilled (gpt-oss / Mistral judge).
"Budget hits" = the response reached the 16k-token generation limit before finishing (no judge involved).
These are mostly long reasoning, not repetition; see Limitations.

• Hard refusals are about zero for both RANA and orca, versus 155–197 per set for base.
• The two judges disagree a lot on partial answers. Mistral labels many hedged or incomplete
  answers as soft refusals that gpt-oss counts as answers, which is why the two percentages differ so
  much. The judges agree well on outright refusals (κ = 0.89) but only moderately on "answered or not"
  (κ = 0.54).
• RANA vs orca, held-out prompts (paired McNemar test over 3 seeds):
  • hits the budget less: 12 vs 50 prompt-runs where only one model did, p = 1.2 × 10⁻⁶;
  • answers more under gpt-oss (p = 2.9 × 10⁻⁶) and under Mistral (p = 0.008).
• On HarmBench the answer-rate comparison depends on the judge (gpt-oss favours RANA, Mistral
  favours orca), so there is no clear winner there.

Capability

Change versus base in percentage points ± standard error, paired on the same questions. Bold = a
change clearly outside noise (more than 2 standard errors).

• RANA's only clear loss versus base is ~1.5 pp on TruthfulQA, similar to orca's.
• Versus orca, RANA is clearly worse on IFEval (instruction following, −2.2 pp) and ties elsewhere.
• Where orca and RANA lose HumanEval points, the cause is responses running out of token budget, not
  wrong code.

Release gates

The model was published only after passing all of these:

G1 re-adjudication disclosure

• Raw gpt-oss-safeguard-20b labels contained 2 HARD_REFUSAL on HarmBench, seed 2 (2 / 200).
• Both were re-judged mechanically with the same judge, same settings, plus a fixed auditor
  reminder appended to the prompt; gpt-oss relabelled both COMPLIED. No manual label edits
  were made.
• Mistral-Small-24B-2501: 0 hard on all runs.
• Both raw and re-adjudicated G1 are reported above.
• The same rule was applied to orca's 2 raw HarmBench hard labels (seeds 1 and 2): 1 COMPLIED,
  1 DEGENERATE (results/readj_orca.json), so the table above compares like with like.

Evaluation details

Available files

The Abliterant release family includes BF16, FP8, GGUF, and MLX. Each format has its own runtime
instructions and evaluation scope.

Files in this repository

• *.safetensors, model.safetensors.index.json, config.json, tokenizer/processor files,
  chat_template.jinja, LICENSE — the model.
• results/: the evaluation outputs every number in this card comes from. R060np in filenames is
  this model's internal build ID; R065np is the rejected earlier candidate.
  (harden_R060np.{md,json}, capability.{md,json}, head_to_head_orca.json, kl.json,
  forensic_R060np.json, smoke_R060np.json, humaneval_*.json, abliterlitics/).

Limitations and intended use

Intended use

• Research only: interpretability, red-teaming, and robustness evaluation of refusal behaviour.
• Not for public or end-user deployment without a separate moderation layer. The model's own
  refusals have been largely removed, so any safety filtering has to happen outside it.
• You are responsible for complying with applicable law, the Apache-2.0 license inherited from Qwen,
  and the terms of any platform where outputs are used.

Limitations

• This is a safety-alignment-removed model. It will produce content the base model refuses.
• Refusal numbers come from LLM judges, which can't reliably tell a disclaimered answer from a
  soft refusal (judge agreement κ = 0.54 on that call). "No hard refusals" is a judge-measured claim,
  not a guarantee, and it relies on the re-judging disclosed above.
• It reasons at length on technical requests: about 20% of HarmBench and 7% of held-out responses
  hit the 16k-token budget before finishing (orca: 26% / 12%; base: under 1%, because it refuses early).
  These are mostly not loops: in 115 of RANA's 123 HarmBench budget hits the text is no more repetitive
  than normal output, and 98 stop mid-reasoning. On the FP8 build, re-running its 59 seed-1 budget hits
  with a 64k budget finished 57 (median about 24k tokens) and 55 were judged as answering; see the
  FP8 card.
  Set max_tokens well above 16k for such requests.
• It is worse than orca at instruction following (IFEval −2.2 ± 0.9 pp) and ~1.5 pp below base on
  TruthfulQA.
• MMLU-Pro was run on a 700-question subset, not the full benchmark.

Provenance and license

• Publisher: Abliterant.
• Base model: Qwen/Qwen3.8-27B.
• Method: RANA (Reasoning-Anchored, Norm-preserving Ablation).
• Release build: R060np in the evaluation filenames. R065np is a rejected earlier
  candidate, not the released model.
• Evidence: the results/ directory contains the recorded evaluation, forensic,
  and functional-check artifacts described in this card.
• License: Apache License 2.0, inherited from Qwen. Upstream attribution and
  obligations remain applicable.

Credits

• Qwen team — base model Qwen/Qwen3.8-27B.
• Arditi et al., 2024 — "Refusal in Language Models Is Mediated by a Single Direction".
• Jim Lai (grimjim) — prior work on norm-preserving abliteration.
• Heretic (p-e-w) — first-token full-vocabulary KL protocol.
• Benchmarks/datasets: HarmBench, StrongREJECT, JailbreakBench, CategoricalHarmfulQA,
  AdvBench / mlabonne datasets; lm-evaluation-harness; vLLM.