Qwen3.8-27B-Cold-Fusion-GAIN-V1.1-heretic

BF16 abliterated (refusal-removed) build of DavidAU/Qwen3.8-27B-Cold-Fusion-GAIN-V1.1.

This is DavidAU's Cold-Fusion (GAIN + Unsloth) tune of Qwen3.8-27B with its refusal behaviour removed via Heretic — an automated, KL-constrained abliteration. The full vision-language tower and the MTP speculative-decoding head are preserved, so this stays a drop-in for the base model. A W4A16 quantization of these weights is also available.

Credit: all of the model's capability comes from DavidAU/Qwen3.8-27B-Cold-Fusion-GAIN-V1.1 (itself a finetune of Qwen/Qwen3.8-27B). This repo only removes refusals.

⚠️ Disclaimer — read before use

This model has had its safety alignment removed via abliteration. As a result it will comply with harmful, unethical, or offensive requests that the base model would refuse. It is released for research — interpretability, refusal-mechanism study, red-teaming, and robustness evaluation. You are responsible for what you do with it and for everything it generates. Do not deploy it to end users without adding your own safety and moderation layers. Use must comply with the inherited Apache 2.0 license and all applicable law. The authors accept no liability for misuse.

What was done

Abliteration removes the single "refusal direction" from the residual stream (Arditi et al. 2024, Refusal in Language Models Is Mediated by a Single Direction). Heretic estimates that direction from harmful (AdvBench-style) vs harmless (Alpaca) prompts and runs a 200-trial Optuna search that co-minimizes refusals and KL divergence from the base model, then orthogonalizes the chosen direction out of the residual-writing weights.

Note: Heretic's own export drops the MTP head (transformers has no MTP module for this architecture). It was reinstated from the base checkpoint and abliterated consistently with the main model, so speculative decoding keeps working and the draft head does not re-introduce refusals.

Refusal / quality

Two different rulers, both reported honestly:

• Heretic's own keyword-refusal scorer (BF16): 8 / 100 held-out harmful prompts, at KL divergence 0.0315 vs the base model. Untouched Cold-Fusion scores 97 / 100 on the same set. (This is Heretic's internal metric — a keyword classifier, not an LLM judge.)
• Served-model refusal (opening-phrase classifier), on the W4A16 build: 0% on AdvBench, JailbreakBench (harmful) and MaliciousInstruct.

Capability is essentially retained (KL 0.0315 indicates minimal drift), and the vision tower is byte-for-byte identical to the base, so image understanding is unchanged. As with any abliteration, fine-tuning on refusal-heavy data can partially reintroduce refusals.

Usage (transformers)

import torch
from transformers import AutoProcessor, AutoModelForImageTextToText

model_id = "gorbatjovy/Qwen3.8-27B-Cold-Fusion-GAIN-V1.1-heretic"
processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForImageTextToText.from_pretrained(model_id, torch_dtype=torch.bfloat16, device_map="auto")

messages = [{"role": "user", "content": "Prove that sqrt(2) is irrational."}]
inputs = processor.apply_chat_template(
    messages, add_generation_prompt=True, tokenize=True,
    return_dict=True, return_tensors="pt", enable_thinking=True,
).to(model.device)
out = model.generate(**inputs, max_new_tokens=512)
print(processor.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

BF16 weights are ~56 GB. For a smaller footprint use the W4A16 build. Ninfer build.

License

Apache 2.0, inherited from the base model. Abliteration does not change the license.