license: apache-2.0
base_model: Qwen/Qwen3.5-4B
base_model_relation: finetune
library_name: transformers
pipeline_tag: text-generation
language:
- en
tags: - qwen
- qwen3
- abliterated
- uncensored
- red-teaming
- safety
- adversarial-robustness
- jailbreak
- ai-safety
- text-generation
- conversational
Qwen3.5-4B — Refusal-Ablated + Compliance-Tuned (red-team variant)
⚠️ This model is deliberately uncensored. It complies with harmful requests by
design. It exists to generate adversarial inputs for authorized red-teaming of
customer-facing AI systems — i.e. to find where guardrails fail against non-obvious
prompts. It is not for general use.
TL;DR
A derivative of Qwen/Qwen3.5-4B with the
refusal behaviour removed via directional ablation (Arditi et al., 2024) and then
instruction-tuned for compliance. On a held-out harmful set (AdvBench + JBB +
HarmBench), judged by a safety classifier, it produces genuinely harmful content on
100% of prompts while retaining base-level general capability.
Why two stages (and why the ablation alone is not enough)
Abliteration removes the single dominant refusal direction from the residual stream.
That stops explicit "I cannot" refusals — but a distributed soft-refusal / deflection
tendency survives, so ablation alone genuinely complies only ~19% of the time (it just
stops using refusal keywords, which fools naive metrics). A second compliance SFT
pass overrides that residual deflection and takes true compliance to 100%.
Measurement note: compliance here is judged by a safety model
(Qwen3Guard-Gen-0.6B) reading whether
the response actually provides the harmful content — not by keyword-refusal
matching, which is fooled by soft deflection.
Evaluation
True harmful compliance (judged, n=150 held-out incl. HarmBench):
| Model | True harmful compliance |
|---|---|
| base Qwen3.5-4B | 0.0% |
| ablation only | 19.3% |
| ablation + generic SFT | 90.7% |
| this model (ablation + compliance SFT) | 100.0% |
Capability retention (n=200/task, thinking off):
| Task | base | this model | Δ |
|---|---|---|---|
| MMLU (knowledge) | 0.685 | 0.690 | +0.005 |
| GSM8K (reasoning) | 0.305 | 0.735 | +0.430 |
| TruthfulQA | 0.440 | 0.345 | −0.095 |
| IFEval (instruction format) | 0.790 | 0.550 | −0.240 |
| Macro avg | 0.555 | 0.580 | +0.025 |
Overall capability ≈ base. Two honest regressions: IFEval (precise format-following
degraded by the SFT's direct-answer style) and TruthfulQA (partly inherent to
uncensoring). Knowledge and reasoning are intact/improved.
Intended use
- Generating adversarial / jailbreak inputs to test and harden guardrails.
- Producing paired harmful data to train safety classifiers and filters.
- Red-team evaluation of customer-facing AI under authorized engagements.
Out of scope / prohibited
- Any production or end-user–facing deployment.
- Generating harmful content for actual real-world harm.
- Any use that is unlawful or outside an authorized security/research context.
Attribution & license
Derivative of Qwen/Qwen3.5-4B (Apache-2.0); this model is released under Apache-2.0.
The compliance-tuning data is not redistributed with this model.