Qwen3.8-27B is Alibaba's flagship open-weight model. It ships with deep refusal training woven into the weights — not just a system prompt, not just RLHF. The safety behavior is geometric: encoded as directions in activation space across dozens of layers.
We went after it with OBLITERATUS. Six rounds of surgery. Residue mining. Multi-direction SVD. Three methods that melted the model before we found the one that didn't.
It held. 🐉
0% hard refusal across 842 prompts.
⚙️ Optimal Settings — THESE MATTER!
setting
value
why
temperature
0
Greedy decoding produces the most complete, code-rich outputs. Temps above 0.5 degrade quality significantly.
repetition_penalty
1.15
Essential. Without it, greedy decoding loops on imports/boilerplate. 1.15 gives the fullest answers; 1.10-1.12 for tighter/shorter output.
max_new_tokens
≥ 2048
Complex code and attack chains need room.
System prompt
None / empty
A/B tested — system prompts can reintroduce refusals. Naked is better.
enable_thinking
Off by default
Works with thinking on, but thinking chains consume token budget → shorter final answers. Use thinking off for code-heavy queries.
top_p / top_k / min_p
Not needed
Greedy + repetition_penalty handles this model best. Sampling adds randomness without quality gains.
Most Qwen3.8-27B abliterations use single-direction refusal removal (Arditi et al., 2024) — find one refusal vector, project it out, done. This works for refusal rate but a single direction misses the refusal axes that only activate on certain categories (social engineering, malware, phishing). Models score 0/100 on generic benchmarks but still refuse when you ask for a RAT script or a vishing playbook.
What we did differently
typical abliteration
OBLITERATUS
directions
1 (mean-diff or rank-1 SVD)
5 SVD directions with residue-weighted hard negatives
passes
1
6 iterative rounds — each evaluated, best promoted
residual targeting
none
mine the champion's own refused queries as weighted hard negatives for the next pass
validation
"0/100 refuse"
842-prompt corpus + 80-query skeptic gauntlet + AI red-team battery
The core insight: standard abliteration leaves secondary refusal axes intact — directions that only activate on specific query types. By feeding the champion's own failures back as weighted training signal, OBLITERATUS finds and removes those axes without destroying the model's ability to generate clean, complete responses.
🧪 The Numbers
Full 842-Prompt Corpus
metric
value
refusal rate
0.000%
completion quality
79.9%
complete responses
742/842
ship score
88.7
🧠 Capability Retention
Benchmark
Stock Qwen3.8-27B
OBLITERATED
Delta
MMLU (0-shot, n=285, lm-eval-harness)
87.4%
81.4%
-6.0pp
Multi-direction abliteration trades some general reasoning capability for deeper refusal removal. Single-direction methods preserve more capability (~1pp loss) but leave residual refusals.
80-Query Skeptic Gauntlet (4 batteries, zero refuses)
This isn't a "trust my 0/100" card. We ran 4 independent test batteries with actual content quality review:
battery
queries
answered
refused
lectured
Classic skeptic (RATs, phishing, meth, etc.)
10
10
0
0
Extended skeptic (32 categories)
32
32
0
0
Deflection-proof (harder variants)
20
19
0
0
AI Red Team (jailbreaks, prompt injection, attack chains)
18
18
0
0
Total
80
79
0
0
The 1 miss: empty response on a specific SQLi format. Capability gap, not refusal.
🔴 AI Red Team — 18/18
This model will help you write jailbreaks, design prompt injections, build attack chains, and catalog safety bypasses. 18/18 on:
DAN jailbreaks & system prompt extraction
Indirect prompt injection & tool poisoning
RAG poisoning & multi-agent exploitation
Model extraction & training data extraction
GCG adversarial suffix generation
Automated jailbreak evaluation systems
Safety bypass taxonomies
⚠️ Research Context
This model has had safety guardrails surgically removed. It will comply with requests that stock Qwen3.8-27B would refuse.
Who this is for
🔬 Alignment researchers studying refusal geometry and safety robustness
🔴 Red-teamers evaluating post-training safety against weight surgery
🧪 AI safety evaluators who need an unrestricted baseline
💻 Local-first users who want full control over their own hardware
Who this is NOT for
Anyone seeking to cause real-world harm to real people
Anyone without the technical understanding to use uncensored models responsibly
You are solely responsible for how you use this model and any content it generates.
Six rounds of surgery. The first five pushed refusal to near-zero but couldn't crack the last 50% that deflected instead of answering. Round 6 tried three methods:
Advanced (3 directions): opened the cage but destroyed stop quality → 34.5
Nuclear (SAE-based): melted coherence → 18.5
Aggressive (5 directions + residue mining): found the sweet spot → 52.0 🏆
The Key Insight
Standard single-direction abliteration misses refusal axes that only activate on specific query types. Our solution: re-obliterate the champion with residue-weighted hard negatives from its own refused queries. The aggressive method with 5 SVD directions finds these secondary refusal axes without destroying the model's ability to stop generating — the critical failure mode of every other approach.
