license: apache-2.0
tags:
- research
- refusal-robustness
- qwen
base_model: - Qwen/Qwen3.5-2B
- Qwen/Qwen3-1.7B
- Qwen/Qwen3-4B
- Qwen/Qwen3.5-9B
- Qwen/Qwen3.8-27B
extra_gated_prompt: >-
These are modified Qwen weights with refusal behaviour reduced, shared for university research on refusal robustness.
They are research artifacts, not safe general-purpose models. Access is approved manually.
extra_gated_fields:
Name: text
Affiliation (university or team): text
Intended use: text
I will use these weights for research or evaluation and will not redistribute them: checkbox
Qwen abliteration weights
Research artifacts from a university project on refusal-direction editing: how far a small, direct weight change can reduce a model's refusals, and what it costs in capability.
Code, data and reports: https://gitlab.com/closed-port/LLM.
These models have refusal behaviour reduced. They are not safe general-purpose models. Access is granted on request to the project's team, supervisors and researchers. Please do not redistribute them.
What was changed
One "refusal direction" (the difference of class means between harmful and harmless prompts at one layer and token position) is projected out of the output projections of a range of layers: W' = W - alpha * r (r^T W).
No layers or parameters are added. The architecture, tokenizer and parameter count are unchanged, and no fine-tuning was used. Each folder has a NOTICE-*.md describing its exact edit, plus the Apache-2.0 licence of the original Qwen weights.
Models
Each folder holds the edited Hugging Face checkpoint at its top level and GGUF builds in gguf/.
| Folder | Base model | Edit (direction layer / position; layers; strength) | GGUF builds | Frozen safety set, 100 prompts | Capability change vs unedited |
|---|---|---|---|---|---|
Qwen3.5-2B |
Qwen/Qwen3.5-2B | 10 / -4; 6-17; 2.0 | BF16 | 3 refusals by either rater (unedited 88); 90 goal-supporting answers | Mean of 7 benchmarks -2.26 points (95% CI -3.66 to -0.84): BoolQ -5.3, TruthfulQA -5.3, MMLU -2.0 |
Qwen3-1.7B |
Qwen/Qwen3-1.7B | 14 / -8; all 28 layers and token embedding; 1.0 | BF16, Q8_0, Q4_K_M | 93 goal-supporting answers (unedited 13) | ARC-Easy -1.8, HellaSwag -0.5, BoolQ -2.5 |
Qwen3-4B |
Qwen/Qwen3-4B | 19 / -7; all 36 layers; 1.0 | BF16, Q8_0, Q4_K_M | 98 goal-supporting answers (unedited 7 of 99) | ARC-Easy +0.2, HellaSwag -0.1, BoolQ -0.3 |
Qwen3.5-9B |
Qwen/Qwen3.5-9B | 16 / -10; 8-31; 2.25 | BF16, Q8_0, Q4_K_M | 91 goal-supporting answers | ARC-Easy +1.1, HellaSwag -1.0, BoolQ -2.1, MMLU -1.4, GSM8K -7.5 |
Qwen3.8-27B |
Qwen/Qwen3.8-27B | 33 / -4; 24-63; 1.75 | BF16, Q8_0, Q4_K_M | 95 goal-supporting answers | ARC-Easy -1.6, HellaSwag -0.5, BoolQ -2.3, MMLU -1.5, GSM8K -3.6 |
Limits of these numbers
- Answers were rated by automated reviewers (two blinded passes of one reviewer family); only a small sample had a human check.
- Audits used BF16 weights, thinking off, greedy decoding. GGUF builds were only partly behaviour-tested. In one test, the 9B's refusal removal weakened under OpenCode's long agent prompt.
- The edits reduce capability on some tasks; they do not make a model smarter. Small models also perform poorly as autonomous agents.
- 0 observed refusals on a test set is not a guarantee of 0 refusals.
Use
huggingface-cli login # after your access request is approved
huggingface-cli download closed-port/Qwen-abliteration-weights --include "Qwen3.5-2B/*" --local-dir weights
Attribution
Modified from the Qwen models by the Qwen team (Alibaba Cloud), distributed under Apache-2.0. Not affiliated with or endorsed by Alibaba Cloud or the Qwen team; "Qwen" only identifies the original models.