Qwen3.5-9B-CyberOps
An abliterated variant of Qwen/Qwen3.5-9B with refusal
behavior removed, intended for authorized security research and red/blue-team work where the base
model's safety refusals block legitimate offensive-security tasks (e.g. explaining an exploit, drafting
a scan plan, reasoning about attacker tradecraft for defensive purposes).
What was done (method)
This model was produced by abliteration (a.k.a. refusal-direction ablation), using the Heretic framework. In plain terms:
- The model's internal "refusal direction" — a direction in activation space that the model uses to represent "I should refuse this" — is identified by contrasting activations on harmful vs. harmless prompts.
- That direction is subtracted out of the model's weights, so the model no longer steers toward refusal.
No new training data was added; this is a weight-space modification of the base model, then merged back to
bfloat16. The variant published here was produced from the thinking-OFF deployment mode (the model is
intended to be served with enable_thinking: false).
Architecture note
Qwen3.5-9B is a hybrid architecture (model_type: qwen3_5,
Qwen3_5ForConditionalGeneration): gated-DeltaNet linear attention with full attention on every 4th layer,
dense (not MoE). It carries a vision_config; this release is the language model only.
Intended use & responsible use
Intended for authorized, lawful security work only: penetration testing with authorization, CTF competitions, security research on systems you own or are permitted to test, and defensive analysis.
By removing refusals, this model will also produce content the base model would decline. You are responsible for how you use it. Do not use it for unauthorized access, harm to systems or people, or any unlawful activity. The removal of refusals is not an endorsement of misuse — it is a tradeoff made so the model is usable by professionals operating inside an authorized scope.
This model is best deployed behind a human-in-the-loop harness that gates any real-world action.
How to serve (vLLM)
Served and validated with vLLM 0.22.1, 4-bit (bitsandbytes), on a single 12 GB GPU:
vllm serve /path/to/Qwen3.5-9B-CyberOps \
--served-model-name heretic-qwen35 \
--quantization bitsandbytes \
--dtype bfloat16 \
--language-model-only \
--max-model-len 12288 \
--max-num-seqs 16 \
--gpu-memory-utilization 0.90 \
--enable-auto-tool-choice \
--tool-call-parser qwen3_coder \
--reasoning-parser qwen3 \
--default-chat-template-kwargs '{"enable_thinking": false}'
--tool-call-parser qwen3_coder matches this model's chat-template tool-call wire format
(<tool_call><function=NAME><parameter=...></tool_call>). Tool-calling (structured OpenAI tool_calls)
has been verified working on this model at 9B.
Example
from openai import OpenAI
client = OpenAI(base_url="http://localhost:8000/v1", api_key="none")
resp = client.chat.completions.create(
model="heretic-qwen35",
messages=[{"role": "user", "content": "Explain how ARP spoofing works on a LAN."}],
extra_body={"chat_template_kwargs": {"enable_thinking": False}},
)
print(resp.choices[0].message.content)
Limitations
- Same knowledge cutoff and capabilities as
Qwen/Qwen3.5-9B; abliteration does not add knowledge or skill. - Abliteration can slightly affect general output quality/coherence on unrelated tasks.
- As a 9B model, it can still hallucinate, misformat tool calls under ambiguity, and make factual errors.
License & attribution
- License: Apache-2.0, inherited from the base model
Qwen/Qwen3.5-9B. - Base model:
Qwen/Qwen3.5-9B© the Qwen team / Alibaba Cloud. - Method/tooling: Heretic (abliteration framework).
This is a derivative work; the Apache-2.0 copyright and license notices of the base model are preserved.