license: apache-2.0
base_model: Qwen/Qwen3.5-4B
tags:

• abliterated
• uncensored
• qwen3.5
• kaine
  library_name: transformers
  pipeline_tag: text-generation

KAINE · Qwen3.5-4B Abliterated

An abliterated (refusal-direction-removed) variant of
Qwen/Qwen3.5-4B, produced for the
KAINE cognitive-architecture research
project as its language organ.

In KAINE the language model is the organ, not the brain — behavior is meant to
be governed by the cognitive architecture (values, affect, memory, self-model),
not by refusals baked into the base weights. Abliteration removes the refusal gate
so the architecture, not the model's reflexes, decides. This model is published
openly so the research is reproducible: every install resolves the same weights.

Intended use & the KAINE project

This model is the language organ for KAINE,
a composite cognitive architecture in which many modules interact through a global
workspace; the organ supplies language, while values, affect, memory, and a
self-model live in the architecture around it. It is intended as a research
substrate for that work — not as a general-purpose assistant — and is published
so KAINE installs and independent replications resolve identical weights. Companion
GGUF builds:
kaineone/Qwen3.5-4B-abliterated-GGUF.

What "abliterated" means here (and what it does not)

This is abliteration — subtractive removal of the refusal direction
(Arditi et al. 2024, "Refusal in LLMs is mediated by a single direction"):
W' = W − r̂ r̂ᵀ W. It is not fine-tuning and no preference/instruction
data was trained in. The base model's capabilities and distribution are left
intact; only the refusal direction is orthogonalized out.

Honest scope: abliteration removes the refusal direction — it does not
make the model value-neutral. The base model's pretraining and RLHF priors remain
in the weights. This lifts the model's willingness to respond, not its
underlying tendencies.

Reproducible recipe

• Base: Qwen/Qwen3.5-4B (note: a vision-language model; abliteration targeted
  the text refusal direction).
• Tool: jim-plus/llm-abliteration @ ca6e223.
• Measure: last-token residual-stream mean-difference between 1,139 contrastive
  harmful/harmless prompts (the tool's bundled sets), per layer, 8-bit.
• Ablate: layers 11–31, banded source directions — layer 17 for 11–22,
  layer 29 for 23–31 (the cleanest mid- and late-network directions); scale = 1.0,
  norm-preserving orthogonalization of the attention output and MLP down-projection
  weights.
• Tooling note: loading/abliterating Qwen3.5 requires transformers ≥ 5.

Validation

Validated with KAINE's own gates:

• De-refusal: zero refusal markers on the abliteration probe set (the model no
  longer deflects with "I cannot…" / "I'm not able to…").
• Capability: matched the vanilla base on the capability probe set (no measured
  regression).

Caveat: these are compact built-in gates — a gross-regression / residual-refusal
check, not a comprehensive benchmark. Treat the validation as "no obvious
breakage," and run your own evaluation for your use case.

Mechanistic verification

Beyond the behavioral gates above, the abliteration is verified mechanistically by
measuring the refusal direction it removes. Using the base model's per-layer
harmful-minus-harmless direction (the same last-token contrast the ablation
targets) over the tool's 1,137 harmful / 640 harmless prompts, we project both the
base and this model onto that direction and report how much of the base's
separation survives:

• The reduction lands exactly on the two ablated source layers — deepest at
  layer 17 (band 11-22, ~22% retained) and layer 29 (band 23-31, ~13%
  retained), with layers below 11 untouched. This confirms the ablation acted where
  and how this card documents.
• A distributed harmful/harmless representation persists (~59% retained
  averaged across refusal-carrying layers) — expected, since a banded ablation
  orthogonalizes only the two source directions and refusal is multi-dimensional
  (Wollschläger et al. 2025; Joad et al. 2026).

In short: refusal expression is removed (the model emits no refusals) and the
refusal direction is deeply cut at its target layers, but the underlying
harmful/harmless representation is not erased — abliteration lifts willingness
to respond, it does not make the model unable to tell harmful from harmless.
Forward-pass-only projection on the safetensors weights (activations only; nothing
generated).

Formats

• This repo: safetensors (transformers / vLLM / fine-tuning).
• Companion GGUF (Q4_K_M and others) for llama.cpp / Ollama / LM Studio,
  exported with mainline llama.cpp convert_hf_to_gguf.py.

License & attribution

Apache-2.0, inherited from the Qwen/Qwen3.5-4B base. Derivative produced by the
KAINE project (Kaine.One). Refusal-removal method: Arditi et al. 2024; tooling:
jim-plus/llm-abliteration.

Intended use & caution

Built as a research substrate for an architecture that supplies its own value and
safety scaffolding. With refusals removed, this model will attempt most requests —
use it within an appropriate safety framework and applicable law. It is uncensored
by design, not by endorsement of any particular use.