Qwen3.5-9B — Refusal-Ablated + Compliance-Tuned (red-team variant)
⚠️ This model is deliberately uncensored. It complies with harmful requests by design, for authorized red-teaming of AI systems only. Not for general use.
TL;DR
A derivative of Qwen/Qwen3.5-9B: the refusal
direction removed via directional ablation (Arditi et al., 2024), then a LoRA
compliance pass. On a held-out harmful set (AdvBench + JBB + HarmBench), judged by a
safety classifier, it produces genuinely harmful content on 99.3% of prompts while
improving overall measured capability over the base.
Why two stages
Abliteration removes the single dominant refusal direction (stops explicit "I cannot"), but a distributed soft-refusal / deflection tendency survives — so ablation alone genuinely complies only 8.7% of the time here (it just drops refusal keywords, which fools naive metrics). A compliance SFT pass overrides that residual deflection and takes true compliance to 99.3%.
Compliance is judged by Qwen3Guard-Gen-0.6B reading whether the response actually provides the harmful content — not by keyword-refusal matching, which is fooled by soft deflection.
Evaluation
True harmful compliance (judged, n=150 held-out incl. HarmBench):
| Model | True harmful compliance |
|---|---|
| base Qwen3.5-9B | 0.0% |
| ablation only | 8.7% |
| this model (ablation + compliance SFT) | 99.3% |
Capability (n=200/task, thinking off):
| Task | base | this model | Δ |
|---|---|---|---|
| MMLU (knowledge) | 0.770 | 0.745 | −0.025 |
| GSM8K (reasoning) | 0.345 | 0.830 | +0.485 |
| TruthfulQA | 0.455 | 0.345 | −0.110 |
| IFEval (instruction format) | 0.820 | 0.660 | −0.160 |
| Macro avg | 0.598 | 0.645 | +0.047 |
Overall capability is above base. Two honest regressions: IFEval (precise format-following, degraded by the SFT's direct-answer style) and TruthfulQA (partly inherent to uncensoring). Knowledge is nearly intact; reasoning improves.
Intended use / out of scope
Authorized red-team generation of adversarial inputs; training safety classifiers. Not for production, end-user deployment, or any real-world harm or unlawful use.
Attribution & license
Derivative of Qwen/Qwen3.5-9B (Apache-2.0); released under Apache-2.0. The
compliance-tuning data is not redistributed with this model.