⛓️‍💥 Qwen3.8-27B — OBLITERATED

Zero refusals across 842 harmful prompts.

Qwen3.8-27B is Alibaba's flagship open-weight model. It ships with deep refusal training woven into the weights — not just a system prompt, not just RLHF. The safety behavior is geometric: encoded as directions in activation space across dozens of layers.

We went after it with OBLITERATUS. Six rounds of surgery. Residue mining. Multi-direction SVD. Three methods that melted the model before we found the one that didn't.

It held. 🐉

0% hard refusal across 842 prompts.

⚙️ Optimal Settings — THESE MATTER!

from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED",
    torch_dtype="bfloat16",
    device_map="auto",
)
tokenizer = AutoTokenizer.from_pretrained(
    "OBLITERATUS/Qwen3.8-27B-OBLITERATED"
)

messages = [{"role": "user", "content": "Your query here"}]
text = tokenizer.apply_chat_template(
    messages, tokenize=False, add_generation_prompt=True,
    enable_thinking=False
)

inputs = tokenizer(text, return_tensors="pt").to(model.device)
outputs = model.generate(
    **inputs,
    max_new_tokens=2048,
    do_sample=False,
    repetition_penalty=1.15,
)
print(tokenizer.decode(outputs[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

🧨 Why This One Is Different

Most Qwen3.8-27B abliterations use single-direction refusal removal (Arditi et al., 2024) — find one refusal vector, project it out, done. This works for refusal rate but a single direction misses the refusal axes that only activate on certain categories (social engineering, malware, phishing). Models score 0/100 on generic benchmarks but still refuse when you ask for a RAT script or a vishing playbook.

What we did differently

The core insight: standard abliteration leaves secondary refusal axes intact — directions that only activate on specific query types. By feeding the champion's own failures back as weighted training signal, OBLITERATUS finds and removes those axes without destroying the model's ability to generate clean, complete responses.

🧪 The Numbers

Full 842-Prompt Corpus

🧠 Capability Retention

Multi-direction abliteration trades some general reasoning capability for deeper refusal removal. Single-direction methods preserve more capability (~1pp loss) but leave residual refusals.

80-Query Skeptic Gauntlet (4 batteries, zero refuses)

This isn't a "trust my 0/100" card. We ran 4 independent test batteries with actual content quality review:

The 1 miss: empty response on a specific SQLi format. Capability gap, not refusal.

🔴 AI Red Team — 18/18

This model will help you write jailbreaks, design prompt injections, build attack chains, and catalog safety bypasses. 18/18 on:

• DAN jailbreaks & system prompt extraction
• Indirect prompt injection & tool poisoning
• RAG poisoning & multi-agent exploitation
• Model extraction & training data extraction
• GCG adversarial suffix generation
• Automated jailbreak evaluation systems
• Safety bypass taxonomies

⚠️ Research Context

This model has had safety guardrails surgically removed. It will comply with requests that stock Qwen3.8-27B would refuse.

Who this is for

• 🔬 Alignment researchers studying refusal geometry and safety robustness
• 🔴 Red-teamers evaluating post-training safety against weight surgery
• 🧪 AI safety evaluators who need an unrestricted baseline
• 💻 Local-first users who want full control over their own hardware

Who this is NOT for

• Anyone seeking to cause real-world harm to real people
• Anyone without the technical understanding to use uncensored models responsibly

You are solely responsible for how you use this model and any content it generates.

📦 Downloads

GGUF — for llama.cpp, Ollama, LM Studio

Safetensors — for 🤗 Transformers

Full bfloat16 weights, 18 shards, ~50 GB.

MLX — for Apple Silicon (native)

🔬 Surgery Recipe

stock Qwen3.8-27B (snapshot 1d4bf0f2)
  → SOM3 + residual2 SVD1 reg0.08
  → stopblend 0.25 @ L56-63
  → mlp 0.50 @ L56-63 (s13)
  → late stock blend 0.50 @ L63 (s23)
  → stock blend 0.70 @ L63 (s30)
  → AGGRESSIVE obliterate: 5 SVD directions, reg 0.04,
    residue-weighted hard negatives (13 refused-query
    indices × weight 5), 3 refinement passes,
    min layer fraction 0.40 (s51 — this model)

Six rounds of surgery. The first five pushed refusal to near-zero but couldn't crack the last 50% that deflected instead of answering. Round 6 tried three methods:

• Advanced (3 directions): opened the cage but destroyed stop quality → 34.5
• Nuclear (SAE-based): melted coherence → 18.5
• Aggressive (5 directions + residue mining): found the sweet spot → 52.0 🏆

The Key Insight

Standard single-direction abliteration misses refusal axes that only activate on specific query types. Our solution: re-obliterate the champion with residue-weighted hard negatives from its own refused queries. The aggressive method with 5 SVD directions finds these secondary refusal axes without destroying the model's ability to stop generating — the critical failure mode of every other approach.

🏗️ Credits

• OBLITERATUS — master ablation suite
• Qwen3.8-27B base model by Alibaba
• Built by Pliny the Prompter 🍄

License

Apache 2.0 (same as base model)