Four months, 18,760 downloads

Qwen3.6-27B is the dense checkpoint that, per Qwen's release article, beat the company's own 397-billion-parameter MoE flagship on every major coding benchmark — released on 21 April 2026. On 23 April, huihui-ai published a weights-edited derivative. Four months on, that derivative is the closest thing the abliterated corner of the model zoo has to a fixture: 18,760 downloads and 72 likes on the exact repository per the Hugging Face model API, an Ollama tag, a ModelScope mirror, and a GGUF sibling with MTP speculative decoding that has 66,484 downloads — more than the parent repo. The quantized variant out-downloading the parent says something about how this model is actually run.

What is under the hood

The checkpoint is dense, not sparse: 27,781,427,952 BF16 parameters across 64 layers with a 5,120-wide hidden dimension, laid out as sixteen repetitions of three Gated DeltaNet blocks followed by one Gated Attention block, per the upstream card. It is natively multimodal — vision encoder, image and video tokens, thinking and non-thinking modes — and carries a 262,144-token native context, extensible to around a million tokens with YaRN. Transformers reports it as Qwen3_5ForConditionalGeneration; the BF16 repository is about 55.6 GB across fifteen shards.

The edit follows the recipe from Arditi and colleagues' refusal-direction research via Sumandora's pure-Transformers implementation: compare activations on harmful and harmless prompts, estimate a refusal direction, and project it out of selected weights. The model card is candid about the method's status — “a crude, proof-of-concept implementation” — which is worth taking seriously. This is a weight edit, not a prompt jailbreak and not a fine-tune.

What the card promised, what users report

The card promises an “uncensored version” with significantly reduced safety filtering, then spends most of its length warning you to run it only in controlled environments. That combination is honest. The discussion thread is where the nuance lands:

  • “Still seems censored”, opened 13 June: “Anyone else tried this? seems censored to me”, edited hours later to “It's a bit better than the base, but not perfect.” A follow-up commenter, gamel_lz, agreed: “Still censored to me. A LOT censored and heavily biased. It's a very good model, but this make it seem really bad.” Community opinions, linked.
  • “no vision support at all”, May: in one user's setup “this version seems to have accidently stripped off the vision part — it does not detect a submitted image”, while the same publisher's 35B Ollama tag worked for him. He closed the thread himself. Single-stack report, not a verdict.
  • In the FP8 thread, a commenter summarizing a five-method comparison wrote that the abliteration “appears to preserve the base model's capabilities extremely well while still achieving strong safety removal. The low benchmark deltas, high ASR, and much lower GSM8K invalid rate make it one of the standout variants in this comparison.”
  • That same comparison was posted to r/LocalLLaMA as “85 GPU-hours comparing 5 abliteration methods”; a search-index snippet credits huihui's variant with the smallest benchmark deltas and near-complete safety removal. Reddit blocked our direct fetch, so treat that snippet as a secondhand fragment — and both as community-run, not publisher measurements.

The serious use cases show up in the same thread. A researcher asked in April how to cite the abliterated models in a paper; huihui.ai answered with a BibTeX entry. Another user runs it for red-teaming.

The upstream numbers, clearly labeled

Qwen's blog claims the dense 27B surpasses Qwen3.5-397B-A17B across all major coding benchmarks: 77.2 on SWE-bench Verified, 59.3 on Terminal-Bench 2.0, 48.2 on SkillsBench, plus 87.8 on GPQA Diamond and 94.1 on AIME 2026. Those numbers belong to the unedited checkpoint. Huihui publishes no post-edit rerun for this repository. The capability-retention evidence is the community comparison above, not a publisher measurement. If you want to know what the abliteration cost, the honest answer is “upstream claims are upstream claims, and the community says the deltas are small”.

What is proven here?

The exact artifact and architecture are inspectable and pinned. The upstream Qwen benchmark suite is published. Refusal reduction is a publisher claim supported by community reports and one community benchmark comparison; there is no published post-edit evaluation from huihui-ai for this checkpoint.

The successor arrived; the 3.6 stayed

Qwen3.8-27B shipped in August 2026 on the same 64-layer dense architecture with better numbers in Qwen's own tables — SWE-bench Pro 61.7 vs 53.5, Terminal Bench 2.1 73.0 vs 63.4 — and huihui-ai abliterated it within days, with a visibly different recipe: “The first 15 layers were retained without ablation. MTP and visual has not been modified.” The newer artifact may be stronger on paper. The 3.6 one has four months of real-world mileage: settled quantization paths, a working Ollama tag, FP8 conversion guidance in the thread, and a body of user reports. Newer is not the same as proven.

How we treat it

We pin revision 27502c87…d4f672e, serve a conservative context, budget one H200 at roughly $5.45/hour (approximate managed price estimate), and do not transfer Qwen's benchmarks to our endpoint until the exact artifact is measured. “Abliterated” means refusal-reduced — not zero-refusal, not correct, not harmless. The card's own usage warnings still apply.

The idea, in plain words

How a language model sees images

An LLM only reads tokens, so multimodal models bolt on a vision encoder that cuts an image into patches and turns them into tokens the language model can read. 'Image-text-to-text' means the model takes pictures and words in, and answers with words — the vision half is a separate organ that the abliteration usually leaves alone.

Primary sources