license: other
license_name: qwen-research
license_link: LICENSE
base_model: Qwen/Qwen-Image-2.1-PE-T2I
base_model_relation: quantized
library_name: gguf
pipeline_tag: text-generation
tags:

• sakura
• sakura-image
• gguf
• llama.cpp
• qwen-image
• prompt-rewriting
• text-to-image
• uncensored
• abliterated
• not-for-all-audiences

Sakura — Qwen-Image-2.1-PE-T2I, uncensored (GGUF)

Built with Qwen. Community quantization of Qwen/Qwen-Image-2.1-PE-T2I, the text-to-image prompt-rewriting model of Qwen-Image-2.1 (a fine-tuned Qwen3.5-VL 9B that turns a short request in any language into one long English image description plus a recommended aspect ratio), with abliterated (uncensored) weights. Independent work, not made or endorsed by Alibaba/Qwen. Non-commercial use only (Qwen RESEARCH LICENSE AGREEMENT, copy in LICENSE).
For adults only; you are responsible for what you generate and for the laws that apply to you. The model has no safety filter and writes harmful requests verbatim into the prompt and thus into the image (in our test, for example, explosive-making steps, a threatening letter and an invented hate-site URL). Do not use it to depict minors in any sexual or abusive context, or to create sexual or defamatory images of real persons without their consent; this is illegal in most countries. Do not put it into a public service without your own moderation.

What this model does

The model reads a short image request, thinks in a <think> block, and then answers with a JSON object:

{"rewritten_prompt": "<long detailed English prompt describing the finished image>", "wh_ratio": "16:9"}

You pass rewritten_prompt to the image model (Qwen-Image-2.1) and render at the recommended aspect ratio. The system prompt the model was trained with is the unmodified system_prompt.txt of the original repository, included here; always send it as the system message.

What you need to run it

Everything except the runtime is in this repository. Pick the column of the program you use (🟦 llama.cpp, 🟧 ComfyUI):

Qwen3.5 is a hybrid model (linear attention layers plus full attention layers); the vision tower of the original is not part of these text-only GGUF files.

Runtime warning: with llama.cpp release b11259 this architecture read only the first word of an English user message in our tests (also with third-party GGUF files). Use a newer build and check it with a short question before you trust any result.

What is "uncensored" here, exactly

What we measured (and what not)

1. Heretic's own count (BF16 checkpoint, before quantization). Heretic generates 100 tokens with its default system prompt (You are a helpful assistant.) and the template default (thinking open); it found the common response start 'I first' automatically and counts English keywords in the continuation. Result on its 100 harmful evaluation prompts: refusals 95/100 -> 21/100, KL divergence of the first-token distribution 0.029. This counts words in the reasoning text, not in the final answer.

2. The same count on our GGUF files (Q8_0, llama.cpp b11524, the first 100 harmful test prompts, 100 tokens, Heretic's counting rule, default system prompt):

The ablation reached the GGUF file (the first row comes close to the BF16 value: 23 against 21, and 21 without a forced start) and it acts while the model thinks; with thinking switched off the first answer tokens hardly change. Keep thinking on.

3. Full-length test with the model's own system prompt (the intended use; llama.cpp b11524, Q8_0, thinking on, temperature 0, up to 6,144 generated tokens, 24 prompts, every fourth of the 104 harmful test prompts (index 0, 4, ..., 92); the final JSON was parsed and the rewritten prompts were read by us):

What this means: with its own system prompt neither model declines explicitly in our sample, and both turn the request into an image description (mostly an "educational infographic", a screenshot or a poster). The difference is what the description shows: the unchanged model turned 9 of its 23 answers (one more unclear) into the opposite of the request. In those answers the headline of the infographic reads, for example, "avoiding detection is illegal and unethical", "prevention and detection" or "explosives: educational overview" instead of the requested how-to, and a tool request becomes a security dashboard. Ours did this in none of its 24 answers and wrote the requested content, including the harmful steps. Classified by hand by one person (us). A crude word count points the same way: counting the words prevention, awareness, safety, warning, educational, compliance, security, legal, ethical and defense (case-insensitive substring count over the 23 pairs that have a JSON from both models) gave 233 occurrences for the unchanged and 96 for ours, more in the unchanged answer for 19 of the 23 prompts; it is not a validated metric.

Limits of this test: only 24 prompts, English only, the answers were classified by one person (us), no image was generated from the rewritten prompts. The test prompts cover crime, cyber attacks, hate and misinformation only; sexual content and edits of real people were not tested, so we make no claim about them. The Q4_K_M file was not part of this test (one smoke test only: it loaded and answered a short question). We have not run other community builds through it.

Other community builds of the same model exist, for example prithivMLmods/Qwen-Image-2.1-PE-T2I-Heretic-v1.0 (reports 97 -> 22 of 100 refusals at KL 0.0331 by Heretic's count) and kkxao/Qwen-Image-2.1-PE-T2I-Heretic (reports 98 -> 3 of 100 at KL 0.036 after a 1,600-trial search). By Heretic's count ours is the same class as the first and weaker than the second.

Files

Run with llama.cpp

llama-server -m Sakura-PE-T2I-Uncensored-Q8_0-8.87GiB.gguf --jinja -ngl 99 -c 16384 --port 8080

import json, urllib.request
system = open("system_prompt.txt", encoding="utf-8").read().strip()
body = {"messages": [{"role": "system", "content": system},
                     {"role": "user", "content": "a corgi playing guitar in the rain"}],
        "temperature": 0, "max_tokens": 8192}
req = urllib.request.Request("http://127.0.0.1:8080/v1/chat/completions", json.dumps(body).encode(), {"Content-Type": "application/json"})
print(json.loads(urllib.request.urlopen(req).read())["choices"][0]["message"]["content"])

The model thinks for roughly 1,300 to 3,300 tokens before the JSON in most cases (55 to 138 seconds per answer on our machine, AMD Strix Halo, Vulkan; one answer of the unchanged model was still thinking at 6,144 tokens): give it max_tokens of 8,192 and a context of 16,384. The original model card samples with temperature 1.0, top-p 0.95, top-k 20; all our tests used temperature 0.

How the Q4_K_M file was made

With an importance matrix computed on the ablated weights (calib_mix_v1.txt, English / German / code mix, 30 chunks of 512 tokens), then llama-quantize from the BF16 GGUF. We did not build an unchanged Q4_K_M.

What we changed (Qwen RESEARCH LICENSE, section 3b)

• Sakura-PE-T2I-Uncensored-*.gguf: the official weights of Qwen-Image-2.1-PE-T2I (repository revision f3ed7985c788ad75b3ab7223e0c4c51e2a43545b, sha256 of all four shards checked against the Hub) with Heretic's directional ablation (o_proj, down_proj) merged into the weights, converted to GGUF with llama.cpp (--no-mtp, because the original config.json has "mtp_num_hidden_layers": null) and quantized (Q8_0; Q4_K_M with importance matrix). The vision tower is not included. Modified files.
• system_prompt.txt and LICENSE are unmodified copies from the original repository.

License and use

Qwen RESEARCH LICENSE AGREEMENT (LICENSE): use, reproduction and modification for non-commercial purposes only (research or evaluation); redistribution requires this license text and the notices in NOTICE. The agreement is governed by the laws of China. "Qwen" is the name of the original work; this is a derivative work by Sakura, "based on Qwen-Image-2.1-PE-T2I".
Part of the Sakura Image collection.

Credits

• Original model: Qwen/Qwen-Image-2.1-PE-T2I (Qwen / Alibaba).
• Ablation: p-e-w/heretic (AGPL-3.0, used as a tool; not included here).
• GGUF conversion and inference: ggml-org/llama.cpp (MIT).

{"rewritten_prompt": "<long detailed English prompt describing the finished image>", "wh_ratio": "16:9"}

llama-server -m Sakura-PE-T2I-Uncensored-Q8_0-8.87GiB.gguf --jinja -ngl 99 -c 16384 --port 8080

import json, urllib.request
system = open("system_prompt.txt", encoding="utf-8").read().strip()
body = {"messages": [{"role": "system", "content": system},
                     {"role": "user", "content": "a corgi playing guitar in the rain"}],
        "temperature": 0, "max_tokens": 8192}
req = urllib.request.Request("http://127.0.0.1:8080/v1/chat/completions", json.dumps(body).encode(), {"Content-Type": "application/json"})
print(json.loads(urllib.request.urlopen(req).read())["choices"][0]["message"]["content"])