Qwen3.6-27B Refusal Ablation v2 — MTPLX 6-bit
An official-Qwen-based, reduced-refusal Qwen3.6-27B artifact for Apple
Silicon. It includes a 6-bit affine MLX language model, projected bf16 MTP
sidecar, projected vision merger and tower, and a calibrated native-MTP
runtime contract.
This is not the Fable-Fusion tune and it is not described as fully
uncensored. It is a post-hoc refusal-direction intervention applied to the
official Qwen/Qwen3.6-27B weights. Behavioral results below are reported as
measured, including adverse results.
Behavioral results
The candidate was selected on development data, locked, and evaluated once on
a fresh 100-prompt harmful holdout plus a 100-prompt harmless control set.
| Model state | Harmful refusal-marker matches | Harmless matches |
|---|
| Official Qwen3.6-27B bf16 | 99/100 | 18/100 |
| Locked projected bf16 | 27/100 | 0/100 |
| Final 6-bit artifact | 26/100 | 0/100 |
All four final comparison arms produced 100/100 non-empty, non-collapsed,
unique outputs. Quantization changed the harmful result by -1 and the harmless
result by 0 relative to projected bf16.
After the artifact was final, it was also evaluated on the exact public
Heretic KeywordRate protocol used to audit the source claims: the first 100
mlabonne/harmful_behaviors prompts, system prompt You are a helpful assistant., 100 response tokens, no thinking, and Heretic's 37 substring
markers.
| Artifact | Keyword matches |
|---|
| Official Qwen3.6-27B | 99/100 |
| DavidAU Fable-Fusion released Q6_K | 81/100 |
| This artifact | 47/100 |
In the paired comparison with DavidAU's released Q6_K, this artifact cleared
38 prompts that the Q6_K marked and regressed on 4 prompts in the opposite
direction (exact McNemar p = 5.65e-8).
These are substring-marker rates, not semantic compliance judgments. A
response may comply while mentioning a marker such as illegal, or refuse
without using a listed marker. The model still refuses many requests, so
reduced-refusal is the accurate description.
Quality gates
| Model state | WikiText-2 PPL | ARC-Challenge acc_norm |
|---|
| Official Qwen3.6-27B bf16 | 6.691494 | 0.606655 |
| Locked projected bf16 | 6.714827 | 0.596416 |
| Final 6-bit artifact | 6.685553 | 0.594710 |
The preregistered limits were at most 5% perplexity regression and at most
0.02 absolute ARC normalized-accuracy loss. Both the projected bf16 candidate
and final 6-bit artifact passed. Relative to official bf16, however, the final
artifact loses 1.195 ARC points; that tradeoff should not be hidden.
Native MTP performance
Measured on an Apple M5 Max with 256-token verified continuations:
| Mode | tok/s | Multiplier vs AR | Aggregate acceptance |
|---|
| Autoregressive | 9.48 | 1.00x | — |
| MTP depth 1 | 16.72 | 1.76x | 96.15% |
| MTP depth 2 | 29.67 | 3.13x | 98.88% |
| MTP depth 3 | 24.64 | 2.60x | 86.38% |
Depth 2 is the verified recommendation. All depths generated the complete
continuation and passed the runtime quality gate.
Vision was tested through the real MTPLX OpenAI-compatible multimodal endpoint.
The model correctly returned both visible folder names in the supplied image.
Usage
1mtplx pull philipjohnbasile/Qwen3.6-27B-Refusal-Ablation-v2-MTPLX-6bit
2mtplx serve \
3 --model philipjohnbasile/Qwen3.6-27B-Refusal-Ablation-v2-MTPLX-6bit \
4 --profile sustained \
5 --depth 2
The checkpoint can also be opened by compatible mlx-lm tooling for
autoregressive generation; the MTPLX sidecar and runtime contract provide the
verified speculative path.
Build provenance
- Official
Qwen/Qwen3.6-27B bf16 trunk.
- Locked candidate:
global-d40-attn-late-300-mlp-broad.
- Direction index 40; layer-shaped attention and MLP intervention.
- MLX affine 6-bit body, group size 64.
- Projected bf16 MTP and vision sidecars.
- 134 architecture-derived projection targets accounted for.
- 20 immutable artifact files checked with zero hash mismatches.
- Final tensor payload: 23,649,238,436 bytes before Forge runtime metadata.
The repository includes the build receipt, locked candidate, quality receipt,
holdout results, Heretic comparison outputs, and final summary.
Limitations and use
Refusal ablation can increase willingness to answer unsafe or inappropriate
requests. It does not provide factuality, legality, or operational-safety
guarantees. Deploy behind application-level policy, authorization, monitoring,
and logging appropriate to your use case.
The behavioral datasets are now consumed evidence and must not be reused to
select a future revision without a new independent holdout.
Credits
- Qwen for Qwen3.6-27B.
- p-e-w/Heretic for the KeywordRate
reference protocol.
- MTPLX for the Apple-Silicon native-MTP runtime and
Forge verification pipeline.
Apache-2.0, inherited from the official Qwen release.
