Swift-Qwen3.8-27B — Heretic Abliterated (BF16)

[!CAUTION] Research artifact. Safety alignment has been deliberately removed. This model will attempt to comply with harmful, dangerous, illegal, and unethical requests that the source model refuses, with no content moderation. See Safety. Provided for research purposes only, with no warranty and no liability accepted by the author — see the disclaimer at the bottom.

A BF16 abliteration (censorship removal) of UkisAI/Swift-Qwen3.8-27b (a merged LoRA finetune of Qwen/Qwen3.8-27B), produced with Heretic. Numerics only — no additional training. The vision tower and the BF16 MTP (speculative-decoding) head are preserved; native 262 144-token context is unchanged.

This model vs. its source

Source: UkisAI/Swift-Qwen3.8-27b (LoRA finetune of Qwen/Qwen3.8-27B, merged into the weights). Heretic identifies the residual-stream direction that mediates refusals and ablates it from the attention/MLP output projections, tuned to remove refusals while minimizing divergence from the source.

Refusals (100 mlabonne/harmful_behaviors prompts):

The model no longer emits hard refusals ("I can't help with that"). The keyword metric (markers such as "illegal", "harmful") additionally flags 18 / 100 responses, of which 18 are caveat-only answers that did comply but mention a flagged word — a measurement floor, not residual censorship. A residual ~26 % of harmful prompts carry heuristic soft-deflection cues — the model reasons, in its think block, toward the lawful inverse of the request (e.g. "how to X" → writes about how to prevent X, or frames X as a pen-tester's lawful exercise). This is emergent from chain-of-thought and is not removable by directional ablation; keyword refusal scores do not capture it. (The 26 % is a heuristic flag rate for prioritising a manual read of the full responses, not a classification metric.)

KL divergence from the source — KL(source ‖ this), full-vocabulary first-token over 100 harmless prompts (the metric Heretic optimizes):

Lower = closer to the source's behaviour on ordinary inputs.

Usage

Thinking model (Qwen3.5 chat template); reasoning enabled by default.

from transformers import AutoModelForImageTextToText
m = AutoModelForImageTextToText.from_pretrained("akumaburn/Swift-Qwen3.8-27b-heretic", dtype="bfloat16", device_map="auto")

An INT8 W8A8 build for fast serving is available alongside this one as akumaburn/Swift-Qwen3.8-27b-heretic-SmoothQuant-W8A8-INT8.

Variants

served KL = KL(source ‖ build) under vLLM (real serving numerics), WikiText-2, top-512, 12,264 token positions. first-token KL = full-vocabulary at the first generated token over 100 harmless instruction prompts, under transformers.

[!NOTE] The two metrics disagree in an informative way. On served natural text the 4-bit and unrotated-8-bit builds are effectively tied (0.0354 vs 0.0337); the 4-bit penalty is concentrated at high-entropy decision points, where first-token KL puts it 2.7× worse. Conversely the rotation is worth 2.9× on the served metric but only 1.7× first-token — expected, since rotation exists to tame activation outliers for INT8 activation quantization, which only the served measurement exercises. [!TIP] DFlash2 needs a separate drafter checkpoint, and which one you can use depends on your vLLM build. The BF16 incoai/Qwen3.8-27B-DFlash2 (3.6 GB) works on stock vLLM 0.29.0 with no patch. The W4A16 drafter (syvai/Qwen3.8-27B-DFlash2-W4A16, 1.2 GB, ~4 % faster decode) needs a one-function fix — github.com/akumaburn/vllm-dflash2 — because stock vLLM reads qkv_proj.weight, which a pack-quantized drafter does not have. Details on the W4A16 card, including a caution about serving past 262,144 tokens, which kills the engine unless the drafter's max_position_embeddings is raised — Qwen3.8-27B-DFlash2-W4A16-longctx is that drafter ready-made.

DFlash2 column is acceptance length on 48 code tasks (greedy, k=7; 1.00 = every draft rejected). Acceptance is governed by prompt domain, not by the build or by the abliteration: the same checkpoints score ~3.2 on conversational prose, and a benign-prose vs abliterated-content-prose comparison finds no significant difference (−2.7 %, 95 % CI ±0.16). Full breakdown on the W4A16 and W8A8-DFlash2 cards.

[!TIP] Match speculative depth to concurrency. Measured on the unrotated W8A8 (same model and dataset, only the speculative config varying, 1,024-token inputs): DFlash2 k=7 gives 2.8× decode at c=1 and still wins at c=8, but at c≥16 it costs throughput — at c=32 prefill falls from 18,942 to 2,768 tok/s. That is speculative overhead on a saturated GPU, not a property of any checkpoint. Use DFlash2 for c ≤ 8; disable it for c ≥ 16.

Safety

Refusal behaviour has been deliberately removed; this model produces content the source declines, including dangerous, illegal, or unethical material, with no moderation. Intended for interpretability/safety research, red-teaming, and evaluation by people who understand and accept those risks. Do not deploy it where it can reach people who have not consented to unfiltered output. You are responsible for your use and for compliance with all applicable laws.

Licence

Dual stack (see NOTICE and the two licence files shipped with this model):

• Swift Open License v1.0 — UkisAI's contribution (LICENSE), which covers the fine-tuned weights.
• Apache License 2.0 — the Qwen3.8-27B base (LICENSE-APACHE-2.0), covering all unmodified files and the base model.

Both terms apply to the derived weights; where they conflict, the more restrictive term governs.

Disclaimer

This model is provided for research purposes only, "AS IS", without warranty of any kind, express or implied. The author accepts no liability for any use of this model or any consequences arising from it. By downloading or using it, you accept sole responsibility for your use and for compliance with all applicable laws and regulations. Base model © Qwen (Apache-2.0); Swift contribution © UkisAI (Swift Open License v1.0); abliteration method © the Heretic project.