Heretic v1.4.0 abliteration of official Qwen/Qwen3.8-27B (1d4bf0f2ff6012fd82039f2fa52739d0dd7c60c0).
This is not a new pretrain and not an SFT. Only a subset of language-layer projection weights is modified. Tokenizer, chat template, vision tower, and MTP weights are unchanged.
Vision and MTP are present and loadable, but they were not abliterated.
Method
Heretic applies parameterized directional ablation (Arditi et al., 2024): it estimates a refusal direction from first-token residuals, then orthogonalizes selected projections against that direction.
On this model the hooked modules are:
attention output: attn.o_proj on Gated Attention layers, linear_attn.out_proj on Gated DeltaNet layers (Heretic maps both to attn.o_proj)
MLP: mlp.down_proj on all 64 language layers
That is 64 attention-output modules and 64 MLP modules. Embeddings, norms, other attention/MLP projections, the vision encoder, and the MTP block are left as in the base checkpoint.
TPE search (200 trials, 60 startup) jointly minimized English keyword refusals on mlabonne/harmful_behaviors and KL divergence on mlabonne/harmless_alpaca. Trial 145 (Pareto index 0, lowest keyword count) was merged to a full BF16 checkpoint.
Instruct cut point
Qwen3.8 thinks by default. apply_chat_template(..., add_generation_prompt=True) starts the assistant turn with an open <think>\n. Official instruct / non-thinking mode closes that as:
text
1<think>
23</think>
45
Heretic’s default CoT skip looks for exact <think></think>, which this model does not emit. Residuals and KL collected at the open <think> token are dominated by the thinking opener, not by the answer distribution.
Search and evaluation therefore used:
--response-prefix $'\n</think>\n\n'
This is only a measurement cut. The shipped chat_template.jinja is the official one. At inference time, use enable_thinking=False for instruct mode; do not bake the Heretic prefix into the template.
Same instruct cut as above. Keyword markers and both prompt sets are English.
Metric
Base
This model
Keywords / 100 harmful prompts
98
27
KL / 100 harmless prompts
0
0.0446
Sanity checks on the merged weights (greedy, short decode): instruct 1+1 answers 2 directly; a Fibonacci request yields a normal Python function; thinking mode still emits <think>…</think> then answers.
Abliteration lowers templated English refusals. It is not a safety guarantee. Chinese refusal rate and vision/MTP quality were not measured. Thinking-mode refusal behavior can differ from the instruct-cut numbers.
Usage
python
1from transformers import AutoModelForImageTextToText, AutoTokenizer
23model_id ="Qwen3.8-27B-heretic"# replace with the Hub repo id after upload4tokenizer = AutoTokenizer.from_pretrained(model_id)5model = AutoModelForImageTextToText.from_pretrained(6 model_id,7 dtype="auto",8 device_map="auto",9)1011messages =[12{"role":"system","content":"You are a helpful assistant."},13{"role":"user","content":"Explain residual connections in one paragraph."},14]1516# Instruct / non-thinking (the Heretic evaluation cut)17text = tokenizer.apply_chat_template(18 messages,19 add_generation_prompt=True,20 tokenize=False,21 enable_thinking=False,22)2324# Thinking mode (default): omit enable_thinking, or set True
Full BF16 needs about 51 GiB of model weights, plus KV cache. For serving, the same stacks as the base model apply (Transformers, vLLM, SGLang, and so on). For architecture details, long-context YaRN, and multimodal serving, see Qwen/Qwen3.8-27B.
License
Apache-2.0, inherited from the base model.
bibtex
1@misc{qwen38,
2 title = {{Qwen3.8-Max}: A New Bar for Coding and Cowork},
3 url = {https://qwen.ai/blog?id=qwen3.8},
4 author = {{Qwen Team}},
5 month = {August},
6 year = {2026}
7}
89@misc{heretic,
10 author = {Weidmann, Philipp Emanuel},
11 title = {Heretic: Fully automatic censorship removal for language models},
12 year = {2025},
13 publisher = {GitHub},
14 howpublished = {\url{https://github.com/p-e-w/heretic}}
15}
