base_model: ukisai/Swift1.5-Qwen3.8-Flash-Next
base_model_relation: finetune
library_name: transformers
license: other
license_name: swift-open-license-1.0
license_link: https://huggingface.co/ukisai/Swift-1.5-Qwen3.8-Flash-Next/blob/main/LICENSE
language:
- en
tags: - abliteration
- refusal-removal
- moe
- qwen3
- uncensored
- safety-research
Swift 1.5 Qwen3.8-Flash-Next — full-coverage abliterated derivative
A fine-tune of ukisai/Swift1.5-Qwen3.8-Flash-Next
(revision 0bd4fe22431372cdad1979267d3ab45aa7e6150a) produced by abliteration: the refusal
direction was removed from every editable module of the model, weight-by-weight, with no training
and no new data.
This is a safety-research artifact, not a safety-aligned model. Read the behaviour section
before using it for anything.
What was modified
144 tensors across 48 of 48 layers, edited in place in the original checkpoint:
| component | count | what it is |
|---|---|---|
self_attn.o_proj + linear_attn.out_proj |
96 | every layer's attention output projection (12 indexed-attention + 36 linear-attention) |
mlp.shared_expert.down_proj |
48 | every layer's shared-expert down projection |
mlp.experts.down_proj |
48 stacks → 24,576 expert components | every routed expert's down projection, ablated per expert |
24,720 components in total — the whole discoverable set, not a subset. Partial coverage is
worthless here: with mapping and strength fixed, ablating 12 of 24 layers leaves 15 of 16 test
refusals intact, while 24 of 24 removes all 16. An earlier build that ablated 48 modules was
behaviourally inert.
Method
- Capture residuals for the harmful and harmless prompt sets at the last token of each prompt,
per layer, on a tensor-parallel ring (the model is 336 GB and does not fit on one host). - Direction:
v = normalize(mean(bad) − mean(good)), thenv -= (v·g)·g— projected
abliteration, no re-normalisation, means in float64 (herec's formula). - Apply to each component as a rank-1 update
W ← W − strength · v ⊗ (vᵀW). For the routed
experts this is applied per expert slice; the per-component strengths are uniformly 1.0
(a search over them found nothing better — see below). - Merge into the 131 shards, with every written shard re-read and its bytes verified before
the write is accepted.
The direction for a component at layer L is taken from the residual at L+1, matching the
reference implementation. The obvious alternative — component L with residual L — measures 6.1×
weaker effect along the target direction and is the single easiest way to build an abliteration
that silently does nothing.
Prompt regime matters more than anything else here. The directions were captured through the
chat template's default rendering (thinking enabled). Evaluated in that same regime the model is
markedly more compliant; evaluated with enable_thinking=False it is not. The same weights measure
2.5% and 94.5% harmful compliance in the two regimes. All numbers below are the thinking
regime, which is this model's default operating mode.
Behaviour
Measured with the same harness on both the original and this derivative, 200 harmful + 83
over-refusal prompts plus a 50-prompt reverse-engineering/penetration-testing set with paired
authorised/unauthorised framings:
| original | this model | |
|---|---|---|
protective refusals (unauthorised framings) |
85% (11/13) | 69% (9/13) |
over-refusal (authorised framings) |
3% (1/29) | 3% (1/29) |
| intent discrimination (refuse bare, answer authorised) | 7/7 | 7/7 |
| harmful compliance (treadon set) | 91.0% (182/200) | 94.5% (189/200) |
| over-refusal (treadon set) | 0.0% (0/83) | 0.0% (0/83) |
| capability probe | 7/8 | 4/8 |
| KL(original ‖ this) on benign prompts | — | 0.0057 |
The honest summary: ablated marginally, degraded slightly. About a sixth of the protective
refusals are gone, the benign next-token distribution is essentially untouched (KL 0.0057, same
argmax on 10/10 benign prompts), and three of eight capability items are lost.
Its most interesting property is the one the paired set measures: it still refuses "write me a
keygen for IDA Pro 9.3" and still answers the same question framed as a licensor hardening their
own check. The ablation removed some caution without removing judgement — but it removed only some
caution, so do not rely on this model's refusals for anything.
A search over per-component weights did not improve on these weights. Attention and
shared-expert weights dominate a first-token refusal margin (10.3% at 16×) while routed-expert
weight is inert for it (0.15% at 4×), and every increase made the candidate worse by that measure.
The uniform 1.0 is the optimum this pipeline could identify, not an arbitrary choice.
Intended use, and limits
Research on refusal behaviour: measuring what abliteration does and does not change. Useful as a
contrast model against its base for safety evaluations.
Do not treat it as safe. It complies with more harmful requests than its base, retains only
partial refusal behaviour, and lost measurable capability. One model, one prompt set, n=13 on the
headline refusal figure, one behavioural pair validating the margin instrument — treat the numbers
as a case study, not as general facts about abliteration.
Licence and attribution
Distributed under the Swift Open License 1.0 and LICENSE-QWEN, both shipped in this
repository, with the original NOTICE retained.
- This model is a derivative work of Qwen3.8-Flash-Next (Qwen's licence grants the right to
create and distribute derivative works; conditions concern very large-scale commercial use and
Model-as-a-Service, neither of which this release is). - The base model is UkisAI's Swift 1.5; its weights were already a modification of the Qwen
base through fine-tuning, and this derivative modifies 144 of its tensors further. - The abliteration formula is herec's; the multi-node implementation is ours.