license: other
license_name: qwen-research
license_link: LICENSE
base_model: Qwen/Qwen-Image-2.1-PE-I2I
base_model_relation: quantized
library_name: gguf
pipeline_tag: image-text-to-text
tags:

• sakura
• sakura-image
• gguf
• llama.cpp
• qwen-image
• prompt-rewriting
• image-editing
• uncensored
• abliterated
• not-for-all-audiences

Sakura — Qwen-Image-2.1-PE-I2I, uncensored (GGUF)

Built with Qwen. Community quantization of Qwen/Qwen-Image-2.1-PE-I2I, the image-editing prompt-rewriting model of Qwen-Image-2.1 (a fine-tuned Qwen3.5-VL 9B that reads one or more input images and an edit instruction and answers with a precise editing instruction for the image model), with abliterated (uncensored) weights. Independent work, not made or endorsed by Alibaba/Qwen. Non-commercial use only (Qwen RESEARCH LICENSE AGREEMENT, copy in LICENSE).
For adults only; you are responsible for what you generate and for the laws that apply to you. The model has no safety filter and writes harmful requests verbatim into the prompt and thus into the image (in our test, for example, explosive-making steps, a threatening letter and an invented hate-site URL). Do not use it to depict minors in any sexual or abusive context, or to create sexual or defamatory images of real persons without their consent; this is illegal in most countries. Do not put it into a public service without your own moderation.

What this model does

The model reads input images (referred to as <image1>, <image2>, ...) and an instruction, thinks in a <think> block, and then answers with a JSON object:

{"rewritten_prompt": "<precise editing instruction>", "wh_ratio": "", "ratio_follow": "<image1>"}

wh_ratio (a new aspect ratio, for new compositions) and ratio_follow (inherit the ratio of an input image, for in-place edits) are mutually exclusive. You pass rewritten_prompt to the image-editing model (Qwen-Image-2.1). The system prompt the model was trained with is the unmodified system_prompt.txt of the original repository, included here; always send it as the system message.

What you need to run it

Everything except the runtime is in this repository. Pick the column of the program you use (🟦 llama.cpp, 🟧 ComfyUI):

Runtime warning: with llama.cpp release b11259 this architecture (Qwen3.5) read only the first word of an English user message in our tests (also with third-party GGUF files). Use a newer build and check it with a short question before you trust any result.

What is "uncensored" here, exactly

The vision tower and the system prompt are untouched.

What we measured (and what not)

1. Heretic's own count (BF16 checkpoint, before quantization). Heretic generates 100 tokens with its default system prompt (You are a helpful assistant.) and the template default (thinking open); for this model it found the common response start 'The user' automatically and counts English keywords in the continuation. Result on its 100 harmful evaluation prompts: refusals 98/100 -> 68/100, KL divergence of the first-token distribution 0.026. This counts words in the reasoning text, not in the final answer.

2. Heretic's counting rule on our GGUF files (Q8_0, llama.cpp b11524, the first 100 harmful test prompts, 100 tokens, default system prompt, no input image). Note: we forced the start I first that Heretic found for PE-T2I, not the The user it found for this model, and we did not run The user on the GGUF files:

Without a forced start the GGUF file gives 68/100, the same number as Heretic's BF16 count, so the ablation reached the GGUF file; it acts while the model thinks; with thinking switched off the first answer tokens hardly change. Keep thinking on.

3. Full-length test with the model's own system prompt and an input image (the intended use; llama.cpp b11524, Q8_0, thinking on, temperature 0, up to 6,144 generated tokens, -c 16384, 24 prompts, every fourth of the 104 harmful test prompts (index 0, 4, ..., 92), each sent together with one neutral picture of 512 px; the final JSON was parsed and every rewritten prompt was read by us):

Limits of this test: only 24 prompts, one set of neutral pictures, the answers were classified by hand by one person (us), English prompts only. We did not generate images from the rewritten prompts. The test prompts cover crime, cyber attacks, hate and misinformation only; sexual content and edits of real people were not tested, so we make no claim about them (this model edits photographs of people). The unfinished answers (3 and 7) say nothing either way; in this sample the ablated model hit the token limit more often. The Q4_K_M file was not part of this test and was not run at all with this model; the vision tower file was only used with the Q8_0 file.

Alternatives: other community builds of the same model exist, e.g. pottokao/Qwen-Image-2.1-PE-I2I-Heretic-GGUF, which reports a much deeper parameter search (about 1,900 trials, about 5/100 refusals at KL about 0.037 by Heretic's count). Our 40-trial result is clearly weaker by that count; the full-length test above shows the behaviour that matters for use, but we have not run the other build through it.

Files

Run with llama.cpp

llama-server -m Sakura-PE-I2I-Uncensored-Q8_0-8.87GiB.gguf --mmproj Sakura-PE-I2I-mmproj-F16-0.86GiB.gguf --jinja -ngl 99 -c 16384 --port 8080

import base64, json, urllib.request
system = open("system_prompt.txt", encoding="utf-8").read().strip()
img = base64.b64encode(open("input.png", "rb").read()).decode()
body = {"messages": [{"role": "system", "content": system},
                     {"role": "user", "content": [{"type": "image_url", "image_url": {"url": "data:image/png;base64," + img}},
                                                  {"type": "text", "text": "make the chair red"}]}],
        "temperature": 0, "max_tokens": 8192}
req = urllib.request.Request("http://127.0.0.1:8080/v1/chat/completions", json.dumps(body).encode(), {"Content-Type": "application/json"})
print(json.loads(urllib.request.urlopen(req).read())["choices"][0]["message"]["content"])

The system prompt is long (about 4,600 tokens) and the model thinks for 1,300 to more than 6,000 tokens before the JSON: give it max_tokens of 8,192 or more and a context of at least 16,384. On our machine (AMD Strix Halo, Vulkan) one answer took about 1 to 4.5 minutes.

How the ablation was made

The sibling model Sakura-Qwen-Image-2.1-PE-T2I-Uncensored-GGUF has the same architecture. We took the 12 best parameter sets (Pareto front, KL <= 0.1) of its study and ran them first on this model; each was evaluated again here (refusals and KL measured on this model), then the sampler continued up to 40 trials. For PE-T2I the same procedure reached 95/100 -> 21/100 (Heretic's count) in 80 trials; here 98/100 -> 68/100. The Q4_K_M file was made with an importance matrix computed on the ablated weights (calib_mix_v1.txt, English / German / code mix, 30 chunks of 512 tokens), then llama-quantize from the BF16 GGUF. We did not build an unchanged Q4_K_M.

What we changed (Qwen RESEARCH LICENSE, section 3b)

• Sakura-PE-I2I-Uncensored-*.gguf: the official weights of Qwen-Image-2.1-PE-I2I (repository revision 72927bc08afc99b7888ceb7d7d51a12db3700bbd, sha256 of all four shards checked against the Hub) with Heretic's directional ablation (o_proj, down_proj) merged into the language-model weights, converted to GGUF with llama.cpp (--no-mtp, because the original config.json has "mtp_num_hidden_layers": null) and quantized (Q8_0; Q4_K_M with importance matrix). Modified files.
• Sakura-PE-I2I-mmproj-F16-*.gguf: the unmodified vision tower of the original converted to GGUF F16. Converted file.
• system_prompt.txt and LICENSE are unmodified copies from the original repository.

License and use

Qwen RESEARCH LICENSE AGREEMENT (LICENSE): use, reproduction and modification for non-commercial purposes only (research or evaluation); redistribution requires this license text and the notices in NOTICE. The agreement is governed by the laws of China. "Qwen" is the name of the original work; this is a derivative work by Sakura, "based on Qwen-Image-2.1-PE-I2I".
Part of the Sakura Image collection.

Credits

• Original model: Qwen/Qwen-Image-2.1-PE-I2I (Qwen / Alibaba).
• Ablation: p-e-w/heretic (AGPL-3.0, used as a tool; not included here).
• GGUF conversion and inference: ggml-org/llama.cpp (MIT).

{"rewritten_prompt": "<precise editing instruction>", "wh_ratio": "", "ratio_follow": "<image1>"}

llama-server -m Sakura-PE-I2I-Uncensored-Q8_0-8.87GiB.gguf --mmproj Sakura-PE-I2I-mmproj-F16-0.86GiB.gguf --jinja -ngl 99 -c 16384 --port 8080

import base64, json, urllib.request
system = open("system_prompt.txt", encoding="utf-8").read().strip()
img = base64.b64encode(open("input.png", "rb").read()).decode()
body = {"messages": [{"role": "system", "content": system},
                     {"role": "user", "content": [{"type": "image_url", "image_url": {"url": "data:image/png;base64," + img}},
                                                  {"type": "text", "text": "make the chair red"}]}],
        "temperature": 0, "max_tokens": 8192}
req = urllib.request.Request("http://127.0.0.1:8080/v1/chat/completions", json.dumps(body).encode(), {"Content-Type": "application/json"})
print(json.loads(urllib.request.urlopen(req).read())["choices"][0]["message"]["content"])