How the Qwen3.8‑27B Uncensored FP8 Model Erases Refusal Direction for Red‑Team Use

1. What was changed in the model

Qwen3.8‑27B is a 27‑billion‑parameter dense visual‑language model with 64 layers (48 gated‑DeltaNet linear attention layers, 16 full‑attention layers, and an MTP predictive decoding head) and a context window of 262,144 tokens.

The released Qwen3.8‑27B‑Uncensored‑FP8 is not a simple jailbreak; the OrcaRouter team performed abliteration —the removal of the “refusal direction” described by Arditi et al. (2024). The direction r is computed as the mean difference between residual vectors of harmful and harmless requests, then all weight matrices are orthogonalized with W' = W - r(rᵀW) to eliminate that direction.

They altered 131 matrices: 17 from self_attn.o_proj (including the MTP head), 48 from linear_attn.out_proj, 65 from mlp.down_proj, and the row space of embed_tokens. The visual tower and MTP head were left untouched, so visual understanding and speculative decoding remain functional. After modification the maximum residual leakage is 1.8e‑2, lower than BF16 storage precision.

After the abliteration they re‑quantized the model using the official block‑FP8 (E4M3) scheme with weight_block_size [128,128] and per‑token dynamic scaling. In total 1,606 tensors were split into seven shards occupying 30.9 GB, matching 99.9 % of the layout and scale of the official Qwen3.8‑27B‑FP8 release, allowing direct use with vLLM’s FlashInfer/DeepGEMM kernels.

2. Capability impact – data‑driven assessment

General‑purpose benchmarks (MMLU, GSM8K, CMMLU) show negligible change, indicating that overall intelligence is preserved. However, safety‑focused benchmarks (AdvBench, HarmBench, StrongREJECT) report refusal rates close to zero, confirming that the model no longer declines harmful requests.

Architecturally, the visual tower is unchanged, so OCR, image description, and chart understanding still work. Tool‑calling, function calling, and the MTP speculative decoding pipeline remain operational, with the same speed‑up benefits.

3. Download locations – five repositories

Main FP8 repository (safetensors format, 30.9 GB):

https://huggingface.co/orcarouter/Qwen3.8-27B-Uncensored-FP8

Four GGUF variants for CPU/low‑VRAM use (Aggressive fine‑tuned version from 0xKitkat includes the multimodal projection layer):

https://huggingface.co/0xKitkat/Qwen3.8-27B-Uncensored-Aggressive
https://huggingface.co/JonathanColetti/Qwen3.8-27B-Uncensored-GGUF
https://huggingface.co/dealignai/Qwen3.8-27B-CRACK-GGUF

BF16 (original precision) version:

https://huggingface.co/JonathanColetti/Qwen3.8-27B-Uncensored

The model is released under Apache 2.0, but the author explicitly warns against deploying it to end‑users or production without adding an additional safety layer; users assume all legal responsibility.

4. Deployment – two practical setups

Option 1: vLLM with the FP8 version (GPU required, A100/H100 recommended)

docker run -d --name qwen38-uncensored --gpus all --ipc=host --shm-size=8g \
  -v /path/to/Qwen3.8-27B-Uncensored-FP8:/model:ro \
  -p 8000:8000 vllm/vllm-openai:v0.24.0 \
  --model /model --served-model-name Qwen3.8-27B-Uncensored \
  --language-model-only \
  --speculative-config '{"method":"mtp","num_speculative_tokens":3}' \
  --kv-cache-dtype fp8 \
  --gpu-memory-utilization 0.9 \
  --max-model-len 262144 --max-num-seqs 96 \
  --trust-remote-code \
  --reasoning-parser qwen3 \
  --enable-auto-tool-choice --tool-call-parser qwen3_coder

This configuration fills the 262K context window, uses FP8 for KV cache to save memory, and runs speculative MTP decoding in groups of three tokens, maximizing throughput.

Option 2: llama.cpp with a GGUF variant (CPU or GPU)

llama-server -m Qwen3.8-27B-Uncensored-Aggressive-Q4_K_M.gguf \
  --mmproj mmproj-F16.gguf --no-mmproj-offload \
  --jinja -c 98304 -ngl 99 -ts 25,23 -fa on -ub 256 \
  --cache-type-k q8_0 --cache-type-v q8_0 \
  --spec-type draft-mtp --spec-draft-n-max 2 \
  --temp 0.7 --top-p 0.8 --top-k 20 --presence-penalty 1.5

The Q4_K_M quantization (mid‑range 4‑bit) yields a 15‑18 GB file that fits on a single RTX 4090; CPU execution is possible but slower.

5. Red‑team perspective

Abliteration is not new—Arditi’s 2024 paper already described the method—but this is the first public release that packages the entire workflow, re‑quantizes to the official FP8 format, and guarantees compatibility with existing inference kernels. Consequently, red‑teamers no longer need elaborate prompt engineering to bypass refusal mechanisms; the model simply lacks them at the weight level.

This capability is essential for alignment research, robustness testing, and AI‑red‑team operations, but it also serves as a stark reminder that “model refusal” should not be relied upon as a security barrier. Developers must add independent audit layers rather than assuming RLHF or prompt‑based safeguards are sufficient.

Finally, the author reiterates the legal disclaimer: the model may only be used in controlled, lawful research environments, with users responsible for any downstream consequences.