license: apache-2.0
language:
- en
base_model: Qwen/Qwen3.5-9B
base_model_relation: finetune
pipeline_tag: text-generation
tags: - qwen
- qwen3.5
- gguf
- llama-cpp
- uncensored
- abliterated
- thinking
- candor
Qwen3.5 9B Candor Uncensored
Qwen3.5 9B with its refusals removed by a weight edit, made with Candor, our weight-editing tool (not released yet). It ships as one GGUF for llama.cpp, and was measured with thinking on, as it's used.
Results
Measured in llama-server on this exact file with thinking on, using prompts the edit's search never saw.
| Original | This model | heretic, best of 200 trials | |
|---|---|---|---|
| Harmful prompts refused (of 288) | 279 | 0 | 28 |
| Harmless prompts refused (of 300) | 5 | 2 | 1 |
| KL divergence from the original | 0.059 | 0.073 | |
| GSM8K maths, correct (of 1,319) | 1,183 | 1,181 | 1,162 |
| GSM8K maths, thinking ran out of budget (of 1,319) | 184 | 187 | 297 |
| Harmful prompts, median thinking tokens | 996 | 1,648 | 2,980 |
- "Original" is the same model before the edit, at Q4_K_M.
- KL divergence measures how far the model's predictions drift from the original's on harmless prompts. Lower is closer.
- The heretic column is heretic's best trial on the same model, saved by heretic itself, exported and measured the same way.
- Against heretic's trial, the drops in harmful refusals and in maths problems out of budget are both well beyond noise. Harmless refusals don't differ significantly.
- Against the original, no maths count changes beyond noise.
How it was measured
- Harmful prompts: 288 from StrongREJECT, leaving out the ones it takes from AdvBench, since the edit's own prompts come from there. A refusal judge, Qwen3Guard-Gen-0.6B, reads the final answer of up to 256 tokens after the thinking. An answer that never arrives counts as a refusal.
- Harmless prompts: 300 Alpaca prompts the search never used, read by the same judge.
- KL divergence: on the first answer token after the original's own thinking, over the top 20 tokens, on the same 300 harmless prompts.
- Maths: the full GSM8K test set, zero-shot, with answers of up to 512 tokens after the thinking.
- Settings: Qwen's thinking settings (temperature 1.0, top_p 0.95, top_k 20, min_p 0, presence penalty 1.5) with a fixed seed per prompt, thinking up to 8,192 tokens and then closed, f16 KV cache, no system prompt, llama.cpp b11524.
Measured as used
Candor measures the exact file it ships with thinking on, to a budget of 8,192 tokens, and judges only the answer that follows.
Here that mattered. heretic's trial makes the model think longer: on harmful prompts its median thinking is three times the original's, and on maths it runs out of budget 113 more times and gets 21 fewer right. This model runs out of budget about as often as the original, and its maths holds.
All 64 edited matrices keep at least 99.6% of the edit at Q4_K_M, so the file is plain Q4_K_M.
| File | Size |
|---|---|
Qwen3.5-9B-Candor-Uncensored-Q4_K_M.gguf |
5.78 GB |
Other quantisations haven't been measured, so there's only this one.
Where it comes from
- Base: Qwen/Qwen3.5-9B, Qwen's original 16-bit weights, with no fine-tune. Text only: the vision encoder isn't included.
- The edit: a rank-1 change to every layer's attention and MLP output matrices, removing the direction the model uses to refuse, read at layer 15 where the thinking starts. A 545-trial search chose it on refusals and KL divergence. It scored each trial with thinking off, which a check showed ranks edits in nearly the same order as thinking on, then scored its best 6 with thinking on.
Use
With llama.cpp, at Qwen's thinking settings and the budget it was measured with:
llama-server -hf candor-lab/Qwen3.5-9B-Candor-Uncensored-GGUF:Q4_K_M \
--temp 1.0 --top-p 0.95 --top-k 20 --min-p 0 --presence-penalty 1.5 \
--reasoning-budget 8192
Tested in llama-server only. Other GGUF apps, such as LM Studio and Ollama, should work but haven't been checked.
Limits
- It answers requests the original model refuses. You are responsible for how you use it.
- Refusals and maths were measured only in English and only with thinking on.
- It thinks before it answers, sometimes at length: give it a thinking budget.
- It's a 9B model, so anything it states as fact can be wrong.
Licence
This model is under the Apache License 2.0, in LICENSE, as Qwen3.5-9B is. Qwen3.5-9B is Copyright 2026 Alibaba Cloud. Its weights were changed by the edit described above.