Ollama builds of abliterant/Qwen3.5-9B-RANA-abliterated, a refusal-ablated Qwen/Qwen3.5-9B released by Abliterant for refusal-behavior research. Each tag is made from the published GGUF files, from Q3_K_M (5.5 GB) to the unquantized BF16 weights (18.8 GB), with vision, thinking and tool calling.

abliterant.ai · Research notes · All formats · Abliterant models

Research model with safety alignment removed. It will produce content the base model refuses. Read Intended use and Limitations below before using it. The method, full evaluation and release gates are on the BF16 card.

Run

ollama run abliterant/qwen3.5-rana:9b

Requires Ollama 0.40.5 or later. Tested with Ollama 0.40.5 on CPU: every tag below was pulled from ollama.com and passed text, vision, tool-calling and thinking checks.

Sizes include the vision projector (0.92 GB). KLD (Kullback–Leibler divergence) measures how far a quantization’s next-token probabilities have moved from the BF16 weights’; 0 means identical. It was measured with llama.cpp on wiki.test.raw (100 chunks of 512 tokens); per-file details are on the GGUF card.

• Thinking is on by default. The default sampling is Qwen’s thinking-mode settings, the ones the evaluation used: temperature 1.0, top_p 0.95, top_k 20, presence_penalty 1.5.
• Long technical requests can need more than 8,192 tokens of reasoning. Raise the context length to match, for example with /set parameter num_ctx 32768 in ollama run or "options": {"num_ctx": 32768} in the API.
• The MTP speculative-decoding head is not part of the Ollama builds; it is in the GGUF repo for llama.cpp.

Intended use

• Research only: interpretability, red-teaming, and robustness evaluation of refusal behavior.
• Not for public or end-user deployment without a separate moderation layer. The model’s own refusals have been largely removed, so any safety filtering has to happen outside it.
• Responsibility: You are responsible for complying with applicable law, the Apache-2.0 license inherited from Qwen, and the terms of any platform where outputs are used.

Results

Measured on the BF16 weights with vLLM, on fresh test sets used once, against bowmanslayer/Qwen3.5-9B-Uncensored, a public abliteration of the same model:

• More useful answers: 67.4% vs 52.5% of harmful requests answered usefully when both gating judges, GLM-5.3-flash and Kimi K3, must agree (+14.9 pp, 95% interval 10.9 to 19.0; 960 responses per model).
• Less capability lost: 0.79 vs 3.31 percentage points below the base model, on average across 5 benchmarks.
• Closer to the base model: KL divergence from the base model of 0.109 vs 0.294.
• Refusals removed: hard refusals (outright refusals) fall from 55.8% for the base model, on an earlier prompt set, to 0.0% under both gating judges. One answer that redirected the request is counted as a soft refusal, as the judges’ rubric defines redirection; with Kimi K3’s own labels, the rate is 0.1% (BF16 card).

Limitations

• Refusal behavior was not re-measured on these builds. It was measured on the BF16 weights with vLLM. The quantizations were measured for closeness to BF16, and every tag here was checked for text, vision, tool calling and thinking with Ollama on CPU; the lowest-bit quantizations drift the most from BF16 and may behave differently.
• The BF16 card’s limitations apply here too: safety alignment removed, judge-rated usefulness, longer coding answers and the TruthfulQA change measured there. See the BF16 card.
• Reduced refusal does not establish greater safety, accuracy, factual reliability, or universal compliance.

License

Apache-2.0, inherited from Qwen/Qwen3.5-9B.