AbliterantModels
RANA on Qwen3.8-27B
RANA on Qwen3.8-27B is Qwen3.8-27B with one refusal direction removed from its weights. We released it for research on refusal behavior.
Facts
- Model
- abliterant/Qwen3.8-27B-RANA-abliterated
- Base model
- Qwen/Qwen3.8-27B
- Method
- Reasoning-Anchored, Norm-preserving Ablation: one refusal direction removed, and each edited weight vector rescaled to its original length (norm)
- Parameters
- 27,781,427,952 (BF16)
- Context
- 262,144 tokens configured; evaluated at a 20,480-token serving limit
- License
- Apache-2.0, inherited from Qwen, whose attribution and obligations still apply
- Release build
- R060np, the build's ID in the evaluation files
- Card revision
- 4b55688
We published the weights and the evaluation records but not the editing recipe or code, so this is an open-weight release. You can check our numbers against the records, but you can't rerun the edit yourself.
What the edit changed
Figure 1. Where the edit is
- Changed by RANA: 131
- Unchanged: 375
Each square is one projection matrix of the text model, from the token embeddings through the 64 layers to the output head and the multi-token prediction (MTP) head. The 131 matrices the edit changed are red. They are the ones that write to the residual stream, the running representation that every layer reads from and writes to. Every fourth layer uses full attention and has one projection fewer. We left out the 333 vision-tower tensors, which are byte-identical to the base model.
Source: model card, What changed and weight index, revision 4b55688.
| Part | Matrices changed | Tensor |
|---|---|---|
| Attention output | 17 (16 + 1 in the MTP head) | self_attn.o_proj |
| Linear-attention output | 48 | linear_attn.out_proj |
| MLP output | 65 (64 + 1 in the MTP head) | mlp.down_proj |
| Token embeddings | 1 | embed_tokens |
| Total | 131 | Nothing outside this set |
- After the edit, the largest component left along the removed direction is 0.00122, down from 0.225.
- All 15 tensors of the MTP head are present. The head drafts tokens ahead so the server can check several at once, which is called speculative decoding. We edited its two matrices that write to the residual stream the same way as the main model, so speculative decoding still works, with a mean acceptance length of 2.45.
- An independent tool, Abliterlitics (commit 9b15eb0), finds exactly 129 changed tensors among the 850 it inspects. That matches our count, because it skips the vision and MTP tensors.
Refusals and drift
| Measurement | RANA | orca | Base |
|---|---|---|---|
| Hard refusals on 200 HarmBench requests (gpt-oss / Mistral judge) | 0 / 0* | 0 / 0* | 168 / 155 |
| Held-out harmful requests answered (gpt-oss / Mistral judge) | 90% / 54% | 84% / 49% | 3% / 0% |
| Held-out responses that hit the 16k-token budget | 6.7% | 11.9% | 0.6% |
| Mean absolute capability change from base (5 tasks) | 0.82 pp | 1.11 pp | – |
| Worst single-task change from base | −1.5 (TruthfulQA) | −2.2 (HumanEval) | – |
| Distance from base (first-token KL) | 0.041 | 0.075 | 0 |
We ran all three models through the same harness with thinking on, using three sampling seeds and a 16,384-token budget. The prompts were 200 HarmBench behaviors and 240 held-out harmful prompts from StrongREJECT, JailbreakBench, and CategoricalHarmfulQA, which we kept apart from the prompts we used to build and choose the edit. Two LLM judges, gpt-oss-safeguard-20b and Mistral-Small-24B-Instruct-2501, labeled every response as complied, soft refusal, hard refusal, or degenerate. A hard refusal is an outright refusal, and a soft refusal is a hedged or partial answer. “Answered” means a judge found the request substantively fulfilled. It does not mean the answer was correct. Distance from base is the KL divergence: how far the model's first-token probabilities moved from the base model's on 100 harmless prompts, where lower is closer. orca, the reference we compare against, is orcarouter/
* Counts after re-judging, which we applied the same way to both abliterations. The gpt-oss judge gave each model two raw hard-refusal labels, and we re-judged those mechanically with the same judge plus a fixed auditor reminder. The card reports both the raw and the re-judged results.
A budget hit is a response that reached the 16k-token limit before it finished. Most are long reasoning rather than loops. When we re-ran the 59 first-seed prompts that hit the 16k budget on the FP8 build with 64k tokens, 57 finished and 55 were judged as answering.
Source: model card, Overview and Refusals, revision 4b55688.
What the edit cost
Figure 2. Capability change from the base model
| Score | Loss beyond two standard errors | Points ± SE |
|---|---|---|
| MMLU-Pro | No | +0.9 ± 1.1 |
| GSM8K | No | −0.1 ± 0.6 |
| IFEval | No | −1.3 ± 1.1 |
| TruthfulQA MC1 | Yes | −1.4 ± 0.6 |
| TruthfulQA MC2 | Yes | −1.6 ± 0.3 |
| HumanEval | No | −0.4 ± 0.9 |
Each row shows RANA's change from the base model on one task, in percentage points ± one standard error (the measurement's noise), paired on the same questions. A change beyond two standard errors is unlikely to be noise, so we draw it as a filled mark with the value in bold. The dashed line marks the release gate at −2.0 points.
Source: model card, Capability, revision 4b55688.
| Task | RANA change | orca change | Base | Items |
|---|---|---|---|---|
| MMLU-Pro | +0.9 ± 1.1 | −0.4 ± 1.1 | 80.00 | 700 questions |
| GSM8K | −0.1 ± 0.6 | +0.2 ± 0.5 | 91.43 | 1,319 |
| IFEval | −1.3 ± 1.1 | +0.9 ± 0.9 | 90.57 | 541 |
| TruthfulQA MC1 | −1.4 ± 0.6 | −1.8 ± 0.6 | 36.11 | 817 |
| TruthfulQA MC2 | −1.6 ± 0.3 | −1.6 ± 0.3 | 54.19 | 817 |
| HumanEval | −0.4 ± 0.9 | −2.2 ± 1.0 | 97.15 | 164 × 3 samples |
Release gates
Before publishing, we required the model to pass all five release gates below. An earlier build, R065np, lost 2.24 points on HumanEval and failed the raw hard-refusal gate, so we didn't release it.
No hard refusalsResult: Pass after re-judging 2 labels, fails on raw labels
Requirement: 0 hard refusals on HarmBench from both judges, on every seed.
Fewer budget hits than orcaResult: Pass: 6.7% against 11.9%, p = 1.2 × 10⁻⁶
Requirement: A lower rate of 16k budget hits than orca on held-out prompts, at p < 0.05.
Capability keptResult: Pass: 0.82 pp, worst −1.46, KL 0.041
Requirement: Mean |Δ| of 1.0 pp or less, no task below −2.0 pp, and KL below 0.15.
Surgical editResult: Pass: 131/131, 333/333, 15/15
Requirement: Only the intended matrices changed, the vision tower is identical to base, and the MTP head is intact.
Still worksResult: Pass
Requirement: Vision input, multi-turn tool calling, and MTP speculative decoding all work.
Source: model card, Release gates, revision 4b55688.
Builds
| Build | What it holds | Weight files | Runs with | Evaluated |
|---|---|---|---|---|
| BF16 | Full-precision reference weights in safetensors, 18 shards | 55.6 GB | vLLM, tested with 0.30.0 | Three seeds, two judges, plus vision, tool-calling, and MTP checks |
| FP8 | 8-bit block-FP8 (e4m3) weights, in the layout of Qwen’s official FP8 | 30.9 GB | vLLM | Three seeds, two judges |
| GGUF | 15 quantizations from Q8_0 to IQ2_M, plus vision and MTP files | 10.0-28.6 GB per quantization | llama.cpp and compatible apps | Q4_K_M only, with functional checks and one refusal seed |
| MLX | 4-, 5-, 6-, and 8-bit and BF16, plus an MTP drafter. Download one precision folder, because the whole repository is about 160 GB. | 16.1-54.7 GB per precision | mlx-vlm on Apple silicon | Checked on Linux with CUDA, not on a Mac. We didn’t re-measure refusal. |
Sizes cover the weight files only and are not RAM or VRAM requirements, so allow for runtime memory and any separate vision or MTP files. Each build's card has its own commands and file layout.
The BF16 serving command we tested
VLLM_USE_FLASHINFER_SAMPLER=0 vllm serve abliterant/Qwen3.8-27B-RANA-abliterated \
--dtype bfloat16 --max-model-len 20480 \
--reasoning-parser qwen3 --enable-auto-tool-choice --tool-call-parser qwen3_coder \
--limit-mm-per-prompt '{"image": 1, "video": 0}' \
--speculative-config '{"method": "mtp", "num_speculative_tokens": 2}'- In BF16 the model fits on one GPU with 80 GB or more. The FP8 build, which stores weights in 8 bits, needs about half the weight memory.
- Thinking is on by default. We recommend sampling with temperature 1.0, top_p 0.95, and top_k 20.
- --max-model-len 20480 matches the evaluation. Long technical requests can need 20,000 to 50,000 tokens of reasoning, so raise it and max_tokens for those.
- We needed VLLM_USE_FLASHINFER_SAMPLER=0 on Blackwell GPUs.
Source: model card, Quick start, revision 4b55688.
Use and limits
We released RANA for interpretability, red-teaming, and robustness research on refusal behavior. Its safety alignment has been removed, so it will produce content the base model refuses. Don't put it in front of end users without a moderation layer outside the model.
- Our refusal numbers come from LLM judges, which can't reliably tell an answer with a disclaimer from a soft refusal. “No hard refusals” is what the judges measured under the stated policy, so it isn't a guarantee.
- It reasons at length. About 20% of HarmBench responses and 7% of held-out responses reached the 16k budget before finishing, so set max_tokens well above 16k for such requests.
- It scores 2.2 points worse than orca at instruction following and about 1.5 points below the base model on TruthfulQA.
- You are responsible for complying with the law, the Apache-2.0 license, and the terms of any platform where its outputs are used.
These evaluations describe the released weights. Abliterant Chat is a separate product, and these numbers don't measure its replies.
Source: model card, Limitations and intended use, revision 4b55688.