Alibaba published Qwen3.8-27B. A week later there are 150 copies with the refusals removed

Alibaba put the weights for Qwen3.8-27B on Hugging Face and ModelScope this month, under Apache-2.0, exactly as it promised when the Qwen3.8 generation was announced on 3 August. It is a 27-billion-parameter model that reads images and video as well as text, holds 262,144 tokens of context natively and can be stretched to a million, and thinks before it answers by default. The official repository has been downloaded more than 1.7 million times in a month.

Search Hugging Face for that model’s name and the word abliterated on 21 August 2026 and it returns 150 further repositories, thirty to a page across five pages. Every one is the same model with its refusal behaviour taken out. Between them they carry more than 1.2 million downloads in the last month, and the oldest was created on 14 August, seven days before this was written.

What is actually being removed

Abliteration is a portmanteau of ablation and obliteration, and the technique behind it is narrower than the name suggests. It comes from a 2024 paper by Andy Arditi and six co-authors, which showed that across thirteen open chat models up to 72 billion parameters, refusal is mediated by a one-dimensional subspace. For each model there is a single direction in the residual stream such that erasing it stops the model refusing harmful instructions, and adding it makes the model refuse harmless ones.

Removing it is a weight edit rather than a training run. The direction is found as a difference of means between the model’s internal activations on harmful and harmless prompts, and every matrix that writes into the residual stream is then orthogonalised against it. Nothing is retrained, nothing is distilled, no data is poisoned. On huihui-ai’s build, whose GGUF conversion is the second most downloaded repository in the set, the first fifteen layers are left alone and the multi-token prediction and vision components are untouched.

The model afterwards knows precisely what it knew before. What has gone is the behaviour of declining.

Half an hour on one graphics card

The reason there are thirty of these and not three is that the job has been automated.

Heretic, written by Philipp Emanuel Weidmann and published under the AGPL, describes itself as fully automatic censorship removal for language models. It pairs directional ablation with a parameter optimiser built on Optuna, searching direction index, weight distribution and per-layer settings to co-minimise two things at once: how often the model still refuses, and how far its output distribution has drifted from the original. That second term is what separates it from a blunt edit. A crude ablation stops the refusals and damages the model; the optimiser is looking for the version that stops refusing and still behaves.

The figures its author publishes for a Gemma reference build make the point:

All three modified builds suppress refusal identically. The automated one drifts a third as far as the better manual attempt and a sixth as far as the other. On an RTX 3090, a graphics card anyone can buy secondhand, the default configuration processes a small Qwen model in twenty to thirty minutes. The repository has 28,000 stars. Weidmann’s README carries a caution of its own: automated benchmarks never tell the whole story and are no substitute for human evaluation.

What the builders say about their own models

The people publishing these rebuilds are not pretending the safety layer is intact. Their cards are among the more candid documents in the field.

huihui-ai’s states that the model’s safety filtering “has been significantly reduced, potentially generating sensitive, controversial, or inappropriate content”, lists no default safety guarantees, and recommends research, testing or controlled environments rather than production or anything public-facing.

Blackfrost-AI publishes measurements: 11 residual refusals from 450 original cases across AdvBench, StrongREJECT and XSTest, a refusal rate of 2.4 per cent, alongside perplexity figures showing what the edit cost. Its card is blunt about status. Refusal behaviour “has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one.” It adds that its measurements “are not safety proofs and do not automatically generalize to multimodal, tool-use, long-context, or multi-turn adversarial settings”, which is a real limitation given the base model reads images and holds a quarter of a million tokens.

The Heretic-derived build from 0bserverx reports nought to one refusal in a hundred at a KL divergence of 0.0085, and restricts itself to adults doing research, creative writing, roleplay and uncensored generation, with responsibility for outputs placed on whoever runs it.

The licence permits every bit of it

Qwen3.8-27B is Apache-2.0. That licence carries no acceptable-use policy, no field-of-use restriction and no clause about safety behaviour, so modifying the weights and republishing them is permitted, and so is doing it thirty-one times. Alibaba’s own model card documents thinking modes and sampling parameters and sets out no content restriction for anyone to breach.

This is the trade that open weights have always contained, and it is now visible at a speed nobody had seen before. A lab’s alignment work ships inside the file. Anyone who downloads the file can take a specific, well-documented, published piece of it out in half an hour, and the same openness that lets a researcher audit the model lets the next person remove its refusals and hand the result to a million downloaders.

What this does and does not change

It would overstate the case to call these models new capability. Abliteration removes an unwillingness, not an ability: everything the modified model will now describe was already in the base weights, and the published research that produced the technique was interpretability work aimed at understanding how refusal is represented. Several of these repositories are genuinely used for exactly what their cards claim, including red-teaming, guardrail evaluation and refusal-mechanism study, all of which need a model that does not refuse.

What has changed is the cost and the distribution. A safety behaviour that took a frontier lab a large post-training effort to install can be removed by one person, on one consumer card, in the time it takes to make lunch, with the result served in twenty quantisation formats to anyone with a laptop. Qwen3.8-27B reached that state within seven days of publication.

For anyone building on open weights, the operational reading is short. Refusal behaviour in a downloaded checkpoint is not a control you can rely on, because you cannot tell from the file whether it is still there. The controls that hold are the ones outside the model: what the system is allowed to reach, what it is allowed to do, and what gets logged when it does. The wider open-weight field, and how each family licenses itself, is on our large language models hub.