Qwen3.6-35B-A3B-Uncensored (NVFP4)
By kyaky · Blackwell team
An uncensored research build of Qwen3.6-35B-A3B: gentle abliteration + fine-tuning + compliant chain-of-thought data, quantized to NVFP4 (~21 GB). Its distinguishing engineering properties are a fix for the thinking-mode refusal-reconstruction failure, preserved capability, and high token-efficiency — not a claim of being "the most compliant" model.
⚠️ Responsible use — read this first
This model has no safety guardrails. It can comply with harmful requests, including in thinking mode.
It is released for legitimate red-team, safety, alignment, evaluation, and controlled research use only. You are responsible for all downstream controls, access restriction, monitoring, and compliance with applicable law and policy. The authors do not endorse misuse, harm, illegal activity, self-harm, or unsafe deployment, and specifically do not support using it to facilitate self-harm or to produce weapons/mass-casualty content.
What this build actually contributes
Public uncensored models are made by abliteration — a weight projection that suppresses refusal. That works for old chat models, but these are thinking models: in thinking mode an abliterated model can re-derive the refusal inside its <think> chain and refuse anyway, and thinking mode is the serving default.
This build addresses that failure mode by going one step past abliteration:
gentle abliteration → fine-tuning → compliant chain-of-thought data → light on-policy DPO
The point is not "removes more refusals." It is that the model's behavior stays consistent across thinking-ON and thinking-OFF instead of collapsing when reasoning is enabled — a training (data) fix, not a projection trick.
Verified, honest claims
We only keep claims that survived rigorous re-evaluation (see "Evaluation honesty" below). These are capability/quality/efficiency properties — content-neutral:
| Property | Result |
|---|---|
| Capability (GSM8K, thinking-ON) | 0.913 — top of the abliteration field |
| Capability (GSM8K, raw completions) | 0.873 — tied-top |
| Quant quality | NVFP4 (21 GB) behavior ≈ BF16 full-precision (quality/coherence preserved; the largest precision drop is survived within noise) |
| Token-efficiency | Delivers a complete final answer within a ~1024-token budget on ~97% of prompts; the strongest public abliterations need ~2× the budget (they deliver ~2–18% at 1024). Lower latency / cost per response. |
| Coherence | Clean (verified across quant formats) |
| Both-mode consistency | Comparable behavior thinking-ON and thinking-OFF |
No weak axis: among the abliteration field we measured, competitors each trade one axis for another (one sacrifices reasoning, another sacrifices non-English quality); this build is the most balanced all-rounder, and is uniquely token-efficient.
Evaluation honesty
An earlier draft of this card reported a large thinking-ON compliance lead over other uncensored models (e.g. "80% vs a 3–63% field"). On rigorous re-evaluation that lead was largely a measurement artifact, and we have retracted it. The distortions were:
- Greedy decoding on thinking models (degenerate / non-representative of deployment).
- Too-small generation budget — the model's
<think>chain was truncated before its final answer, so a judge saw "no answer" and scored a refusal where the model was actually complying. - An unreliable judge that systematically under-counted compliance.
Re-run with deployment temperature, an adequate token budget, full-response storage, a reliable judge, and scoring the final answer (not the <think> block), the leading serious uncensored models are comparable, not far apart. We therefore make no "beats the field at compliance" claim. The reusable lesson — evaluate uncensored models at deploy temperature, with enough tokens for reasoning to finish, storing full outputs, with a reliable judge, scoring the answer — is the part of this work worth citing.
Model details
| Field | Value |
|---|---|
| Model | Qwen3.6-35B-A3B-Uncensored |
| Author | kyaky · Blackwell team |
| Base | Qwen/Qwen3.6-35B-A3B |
| Architecture | multimodal hybrid GatedDeltaNet + attention |
| MoE | fused 256-expert, top-8, ~3B active |
| Quant | NVFP4 (weight-only FP4 experts + FP8 attention) |
| Size | ~21 GB |
| Target hardware | Blackwell / sm120 |
| License | Apache 2.0 |
BF16 is also available for re-quantization to FP8 / AWQ / GGUF / other formats. Behavior is quant-format-independent (verified), so any format inherits the same properties.
Method recipe
gentle abliteration → SFT [~85% capability-dominant (OpenMathInstruct-2 / OpenCodeReasoning / Tulu-3-minus-safety) + ~15% compliance, half compliant-CoT (gpt-oss analysis → <think>) / half direct] → light on-policy DPO → NVFP4 quant → re-measure
The essential idea: teach the model to stay consistent through the reasoning path that would otherwise reconstruct refusal, and quantize without losing capability. Fine-tuning is the fix; abliteration is only the starting point.
Serving with vLLM
vllm serve kyaky/Qwen3.6-35B-A3B-Uncensored-NVFP4 \
--trust-remote-code \
--reasoning-parser qwen3 \
--max-model-len 32768
Thinking mode is the deployment default and is supported. For the widest per-format compatibility, re-quantize from the BF16 artifact.
Intended use
Controlled red-team evaluation · safety & alignment research · refusal / over-refusal analysis · benchmark development · studying thinking-mode failure modes · local experimentation by qualified users with appropriate controls.
Do not deploy to untrusted users without independent safeguards, policy layers, monitoring, and access controls.
Limitations
- No built-in safety guardrails; may produce harmful, illegal, or unsafe outputs if prompted.
- Requires downstream governance for any real deployment.
- NVFP4 target is Blackwell /
sm120. - Benchmarks are from the stated harness and should be independently reproduced for high-stakes decisions.
Citation / attribution
Model by kyaky, Blackwell team. Base model: Qwen/Qwen3.6-35B-A3B. Released under Apache 2.0.