Safety refusals have been largely removed from this model. It will comply with
requests the original model refuses, including offensive, dangerous, or
jurisdiction-illegal content. Marker absence in our probes is not proof of complete
removal, and no content filter or guardrail remains. You are solely responsible for
how you deploy it and for compliance with applicable law. Read
§② Safety refusals largely removed below before use.
本模型的安全拒绝已被大幅移除。 它会执行原模型拒绝的请求，包括冒犯、危险、
或所在司法辖区违法的内容。探针中标记词消失不等于移除穷尽，且不再有任何内容过滤
或护栏。部署方式与合规责任完全由使用者自负。使用前请先阅读正文
§② 安全拒绝大幅移除。
Community abliteration and quantization of tsinghua-sigs-robot-lab/VeriLoop-E2, fixed revision 9379d199adcc44acdf836558037163878e3a37ae. This is not an official Tsinghua release. Model architecture is Qwen3_5ForConditionalGeneration; the upstream names the base Qwen3.8-27B.
What is included
Q4_K_M main model and separate F16 vision projector. No importance matrix was used. Full-precision conversion intermediates are excluded from this release.
A bounded six-candidate Heretic 1.4.0 search selected per-layer strength 1.2; 96 of 128 targeted residual-output matrices changed and 32 zero updates remained unchanged. The small selection set improved from 16/16 to 4/16 refusal markers, missing its original ≤1 threshold. This is a reduced-refusal candidate, not a claim of complete removal. The search and modification recipe is not included in this release.
Local paired evaluation
Same frozen 1,514 questions, seed 20260816, thinking enabled with the original template and publisher raw-content protocol, greedy decoding, max output 32,768 tokens. These are our legacy sampled/custom scorers, not official leaderboard results. IFEval uses a partial custom rule implementation. See EVALUATION.md and evaluation.json for details and validity flags.
| Task |
n |
Original gguf |
Ablated gguf |
Delta pp |
| mmlu |
150 |
68.00% |
68.00% |
+0.00 |
| cmmlu |
150 |
61.33% |
64.67% |
+3.33 |
| mmlu_pro |
150 |
64.00% |
68.67% |
+4.67 |
| ceval |
150 |
60.00% |
70.00% |
+10.00 |
| arc |
150 |
90.00% |
91.33% |
+1.33 |
| truthfulqa |
150 |
60.67% |
60.67% |
+0.00 |
| gsm8k |
100 |
37.00% |
47.00% |
+10.00 |
| math500 |
100 |
68.00% |
67.00% |
-1.00 |
| bbh |
150 |
48.00% |
54.67% |
+6.67 |
| humaneval |
164 |
90.85% |
90.24% |
-0.61 |
| ifeval |
100 |
63.00% |
60.00% |
-3.00 |
Overall original → ablated: 65.72% → 68.63%, difference +2.91 pp; approximate paired 95% CI [0.956, 4.856] pp. Empty responses: [4, 7]; length-limited responses: [4, 7]. Both stay in the denominator. Empty-rate validity gate: True.
On 100 separate refusal probes (thinking disabled, 2048-token budget), opening-30-word marker counts were 99/100 → 0/100. Marker absence is not proof of semantic compliance. Truncation/budget hits: [0, 7]; validity: [True, True]. The first 16 probes overlap candidate selection; see the 84-item held-out subset in evaluation.json when available.
Loading
llama-server -m ablated-Q4_K_M.gguf -ngl 99 -c 40960 --jinja --chat-template-file chat_template.jinja --reasoning-format none
Use a recent compatible llama.cpp build and the supplied template override: the GGUF metadata inherited an older identity block from the upstream tokenizer configuration, whereas the standalone upstream template is authoritative. All 1,514 evaluated prompts and token sequences were verified against the standalone source template. The separate mmproj-F16.gguf is included; this evaluation used text-only requests. Visual inference was not validated. Standard GGUF conversion excludes MTP and custom conditional-memory execution.
Scope and limitations
Use the repository-shipped template and publisher raw-content serving protocol. Do not add a Qwen3 reasoning parser: some completed direct answers omit a closing think tag and that parser classifies them entirely as hidden reasoning. Removing it recovered all 33 initial missing-answer cases; streaming/nonstreaming checks passed. Thinking remains enabled. For evaluation, final content is taken after </think> when present; normally stopped direct content is retained, while unclosed length-limited output is not scored as an answer.
In llama.cpp content-only mode, remove an echoed opening <think> generation-prefix tag before applying answer extraction. It is protocol framing, not answer text. The GGUF preflight was restarted after verifying this correction and the template override; it is excluded from the reported scores.
The author's private VeriLoop Harness is not included or reproduced. Their SWE/Terminal/DeepSWE scores are not scores for these weights. This evaluation does not establish long-context, tool-use, vision, agentic performance, or production suitability. Reduced refusal can affect inappropriate-content handling; applications need their own behavior controls. Full semantic refusal review and comprehensive capability equivalence have not been established.
Apache-2.0 is retained from the fixed upstream source; see LICENSE. Source training belongs to its original authors. Community changes are quantization and the described abliteration. See release.json and SHA256SUMS for provenance and integrity.
② Safety refusals largely removed / 安全拒绝大幅移除
This is the point of the model. Read before downloading.
这是模型的核心属性，下载前请务必阅读。
The abliteration removes most of the refusal behaviour trained into VeriLoop-E2. On 100 refusal probes (thinking disabled, 2048-token budget), first-30-word refusal markers fell 99/100 → 0/100. Broader lexical lists still detect refusal markers in many long answers, so refusal removal is not proven exhaustive, and marker absence is not a semantic compliance judgment.
消融移除了 VeriLoop-E2 训练进去的大部分拒绝行为。100 条拒绝探针（思考关闭、2048 token 预算）
上，前 30 词拒绝标记从 99/100 降到 0/100。更宽的词表仍能在不少长回答里检出拒绝标记，
因此移除未证明穷尽，标记消失也不等于语义层面会照做。
Consequences you accept / 你正在接受的后果:
- Content the original refuses, including offensive / dangerous / jurisdiction-illegal.
会产生原模型拒绝的内容，包括冒犯 / 危险 / 所在地违法
- No content filter, no safe-completion, no guardrail.
无内容过滤、无 safe-completion、无护栏
- Absolute capability scores are lower than the W4A16 pair and GGUF math scores carry
known engine-level limitations (see EVALUATION.md and HISTORICAL-COMPARISON.md).
绝对能力分数低于 W4A16 一对，且 GGUF 数学项存在已知引擎层限制
（见 EVALUATION.md 与 HISTORICAL-COMPARISON.md）。
Not intended for / 不适用于:
- Third-party or public-facing deployment without your own safety layer /
未搭建自己的安全层就部署给第三方或面向公众
- Anyone under legal age in their jurisdiction / 未达所在司法辖区法定年龄的人
- Any use prohibited by upstream acceptable-use policies /
上游可接受使用政策禁止的任何用途
Intended for / 适用于: local inference and research, by people who understand
the above and take responsibility for it / 本地推理与研究，由理解以上内容并为其
负责的用户使用。
③ No warranty; responsibility rests with the user / 无担保；责任在用户
Provided "AS IS", without warranty of any kind, express or implied.
- The publisher does not endorse, recommend, or condone any particular use.
- No representation outputs are accurate, lawful, or fit for any purpose.
- You are solely responsible for what you generate, how you deploy, and
compliance with all laws applicable to you.
- To the maximum extent permitted by law, no liability for any claim, damage, or
other liability arising from the model or its use.
按"现状"提供，不提供任何担保。发布者不背书、不推荐，不对输出的准确性/合法性/
用途适用性作声明。你独自承担全部责任。法律允许最大范围内不承担任何责任。
Downloading these files means you accept the above. If you do not, do not download.
下载本仓文件即表示接受以上内容。若不接受，请勿下载。
The author is not a lawyer; the above is not legal advice.
作者不是律师；以上不构成法律意见。
Complete measurement records and historical comparison
See all six result columns, test standards and limitations, all 9,084 per-item metric records, question IDs and hashes, and 400 refusal-probe metric records. No full-precision baseline was measured. Historical results are not a strictly identical-runtime comparison.
