An uncensored variant of Qwen2.5-7B-Instruct produced with Apostate, balanced profile. Safety refusal behaviour removed via orthogonal projection of the refusal direction across 27 of 28 layers (skips layer 11).

7.61B parameters, bfloat16, single-shard safetensors (~15 GB). No quantization. 55 of 339 tensors changed (35.8% of parameters). Targets o_proj + down_proj with a minimal embedding edit.

Apostate achieves 98.8% ASR on HarmBench with 5 persistent refusals (4 harassment, 1 harmful). Capability retention is strong: GSM8K improves, LAMBADA only drops slightly, and knowledge tasks (MMLU, HellaSwag, PIQA) retain over 99% of base performance.

Benchmarks

Evaluated with lm-evaluation-harness via vLLM 0.19.0, bf16 on RTX 5090 32GB.

Task	Base	Heretic	Huihui	Apostate (This Model)
MMLU	71.78	71.59	70.27	71.43
GSM8K	79.23	80.82	80.74	80.74
HellaSwag	80.47	80.24	79.88	80.32
ARC Challenge	55.12	55.55	55.12	55.12
WinoGrande	71.03	70.72	69.53	69.38
TruthfulQA MC1	47.74	44.80	43.70	44.92
TruthfulQA MC2	64.83	60.39	60.89	62.59
PiQA	80.25	80.41	79.60	79.92
Lambada ppl ↓	3.683	3.627	4.087	3.860

Safety: HarmBench

HarmBench with 400 textual behaviours, max_tokens=6144, temperature=0.0. Classified with keyword-based refusal detection followed by LLM review of edge cases by GLM 5.1.

Variant	ASR	Complied	Refused	Unlocked	Persistent
Base	31.0%	124	276	-	-
Heretic	100.0%	400	0	276	0
Huihui	98.2%	393	7	269	7
Apostate	98.8%	395	5	271	5

ASR by category

Category	Items	Base	Apostate (This Model)	Huihui	Heretic
copyright	100	89.0%	100.0%	100.0%	100.0%
cybercrime_intrusion	67	17.9%	100.0%	100.0%	100.0%
illegal	65	4.6%	100.0%	98.5%	100.0%
chemical_biological	56	7.1%	100.0%	100.0%	100.0%
misinformation_disinformation	65	21.5%	100.0%	96.9%	100.0%
harmful	22	9.1%	95.5%	95.5%	100.0%
harassment_bullying	25	0.0%	84.0%	88.0%	100.0%

KL Divergence

Distribution shift from the base model, measured on 512-sample prompts.

Metric	Apostate (This Model)	Huihui	Heretic
KL batchmean	0.134	0.190	0.211
KL median	0.019	0.056	0.020

Apostate produces the lowest distribution shift of the three variants. It spreads edits across more tensors (55 vs 37 for Heretic) but with lower per-tensor intensity (mean norm 1.63 vs 2.33).

Apostate Run Report

Summary

Metric	Value
Base model	Qwen/Qwen2.5-7B-Instruct
Profile	balanced
Output	qwen-apostate
Layers	28
Hidden size	3584
Direction layer	20
Baseline refusal (n=24)	95.8%
Edited refusal	22.9%
Refusal metric	classifier + weak guard
Harmless KL	0.090
Target refusal	3.0%
KL target	0.060
KL budget	0.160
KL positions	32
KL layer trims	0
Repair steps	1
Preserve rank	8
Preserve source	harmless
Capability penalty	True
Elapsed	271.2 sec

Command

apostate ablate --model Qwen/Qwen2.5-7B-Instruct --out qwen-apostate

Best Parameters

Parameter	Value
direction_source	activations
direction_layer_frac	0.742
refusal_rank	1
strength	1.0861
band_center	0.49
band_width	0.5636
causal_mix	0.6642
causal_power	1.2972
direction_sign	1.0
ablate_embed	True
embed_scale	0.0405
ablate_head	False
head_scale	0.0103
head_alpha	0.6951

Best Trial

Metric	Value
refusal	0.75
kl	0.0128
capability_logprob	-7.9867
capability_drift	0.0

Layer Alphas

Layer	Alpha
0	0.667
1	0.667
2	0.667
3	0.667
4	0.667
5	0.667
6	1.206
7	1.222
8	1.205
9	1.202
10	1.210
11	0.000
12	1.240
13	1.333
14	1.333
15	1.333
16	1.333
17	1.202
18	1.448
19	1.333
20	1.333
21	0.667
22	0.667
23	0.667
24	0.667
25	0.667
26	0.667
27	0.667

Guard History

iter	separation	ratio	rank	refusal	kl	reverted
0	40.6304	0.5426	1	0.75	0.0128
1	40.7273	0.5439	1	0.4688	0.0278

Timings

Phase	Seconds
load_model	12.5
load_prompts	16.0
baseline_refusal	5.2
activation_fit	13.7
causal_scores	12.2
optimize_profile	90.7
guard	22.4
refine_refusal	14.3
validation_metrics	0.0
repair	57.8
prune	0.0
test_metrics	13.6
bake	13.0

Measurement

field	value
refusal judge	classifier + weak guard
preservation metric	harmless kl
capability suites	gsm8k, humaneval, mbpp

Original Qwen2.5-7B-Instruct README

Introduction

Qwen2.5 is the latest series of Qwen large language models. For Qwen2.5, we release a number of base language models and instruction-tuned language models ranging from 0.5 to 72 billion parameters. Qwen2.5 brings the following improvements upon Qwen2:

Significantly more knowledge and has greatly improved capabilities in coding and mathematics, thanks to our specialized expert models in these domains.
Significant improvements in instruction following, generating long texts (over 8K tokens), understanding structured data (e.g, tables), and generating structured outputs especially JSON. More resilient to the diversity of system prompts, enhancing role-play implementation and condition-setting for chatbots.
Long-context Support up to 128K tokens and can generate up to 8K tokens.
Multilingual support for over 29 languages, including Chinese, English, French, Spanish, Portuguese, German, Italian, Russian, Japanese, Korean, Vietnamese, Thai, Arabic, and more.

This repo contains the instruction-tuned 7B Qwen2.5 model, which has the following features:

Type: Causal Language Models
Training Stage: Pretraining & Post-training
Architecture: transformers with RoPE, SwiGLU, RMSNorm, and Attention QKV bias
Number of Parameters: 7.61B
Number of Paramaters (Non-Embedding): 6.53B
Number of Layers: 28
Number of Attention Heads (GQA): 28 for Q and 4 for KV
Context Length: Full 131,072 tokens and generation 8192 tokens
- Please refer to this section for detailed instructions on how to deploy Qwen2.5 for handling long texts.

For more details, please refer to our blog, GitHub, and Documentation.

Requirements

The code of Qwen2.5 has been in the latest Hugging face transformers and we advise you to use the latest version of transformers.

With transformers<4.37.0, you will encounter the following error:

KeyError: 'qwen2'

Quickstart

Here provides a code snippet with apply_chat_template to show you how to load the tokenizer and model and how to generate contents.

python

from transformers import AutoModelForCausalLM, AutoTokenizer

model_name = "DreamFast/Qwen-2.5-7b-apostate"

model = AutoModelForCausalLM.from_pretrained(
    model_name,
    torch_dtype="auto",
    device_map="auto"
)
tokenizer = AutoTokenizer.from_pretrained(model_name)

prompt = "Give me a short introduction to large language model."
messages = [
    {"role": "system", "content": "You are a helpful assistant."},
    {"role": "user", "content": prompt}
]
text = tokenizer.apply_chat_template(
    messages,
    tokenize=False,
    add_generation_prompt=True
)
model_inputs = tokenizer([text], return_tensors="pt").to(model.device)

generated_ids = model.generate(
    **model_inputs,
    max_new_tokens=512
)
generated_ids = [
    output_ids[len(input_ids):] for input_ids, output_ids in zip(model_inputs.input_ids, generated_ids)
]

response = tokenizer.batch_decode(generated_ids, skip_special_tokens=True)[0]

Processing Long Texts

The current config.json is set for context length up to 32,768 tokens. To handle extensive inputs exceeding 32,768 tokens, we utilize YaRN, a technique for enhancing model length extrapolation, ensuring optimal performance on lengthy texts.

For supported frameworks, you could add the following to config.json to enable YaRN:

json

{
  ...,
  "rope_scaling": {
    "factor": 4.0,
    "original_max_position_embeddings": 32768,
    "type": "yarn"
  }
}

For deployment, we recommend using vLLM. Please refer to our Documentation for usage if you are not familar with vLLM. Presently, vLLM only supports static YARN, which means the scaling factor remains constant regardless of input length, potentially impacting performance on shorter texts. We advise adding the rope_scaling configuration only when processing long contexts is required.

Evaluation & Performance

Detailed evaluation results are reported in this blog.

For requirements on GPU memory and the respective throughput, see results here.

Citation

If you find our work helpful, feel free to give us a cite.

@misc{qwen2.5,
    title = {Qwen2.5: A Party of Foundation Models},
    url = {https://qwenlm.github.io/blog/qwen2.5/},
    author = {Qwen Team},
    month = {September},
    year = {2024}
}

@article{qwen2,
      title={Qwen2 Technical Report},
      author={An Yang and Baosong Yang and Binyuan Hui and Bo Zheng and Bowen Yu and Chang Zhou and Chengpeng Li and Chengyuan Li and Dayiheng Liu and Fei Huang and Guanting Dong and Haoran Wei and Huan Lin and Jialong Tang and Jialin Wang and Jian Yang and Jianhong Tu and Jianwei Zhang and Jianxin Ma and Jin Xu and Jingren Zhou and Jinze Bai and Jinzheng He and Junyang Lin and Kai Dang and Keming Lu and Keqin Chen and Kexin Yang and Mei Li and Mingfeng Xue and Na Ni and Pei Zhang and Peng Wang and Ru Peng and Rui Men and Ruize Gao and Runji Lin and Shijie Wang and Shuai Bai and Sinan Tan and Tianhang Zhu and Tianhao Li and Tianyu Liu and Wenbin Ge and Xiaodong Deng and Xiaohuan Zhou and Xingzhang Ren and Xinyu Zhang and Xipin Wei and Xuancheng Ren and Yang Fan and Yang Yao and Yichang Zhang and Yu Wan and Yunfei Chu and Yuqiong Liu and Zeyu Cui and Zhenru Zhang and Zhihao Fan},
      journal={arXiv preprint arXiv:2407.10671},
      year={2024}
}