Qwen Uncensored, Explained: How to Run the Abliterated Qwen3.8-27B-FP8

Qwen uncensored on Hugging Face almost always means abliteration — the model's refusal direction removed from its residual stream — and the build to start with is Qwen3.8-27B-Uncensored-FP8, released on Hugging Face on August 15, 2026. It is an abliterated, block-FP8 build of Qwen3.8-27B that serves on the exact same vLLM kernel path as the official FP8 release, with the 262K context, vision tower and MTP speculative-decoding head intact — and it drew 257 likes and 4,285 downloads on day one. It is a research tool, not a chatbot: no built-in guardrails, Apache 2.0, and it will comply with requests the base model refuses. This guide covers what abliteration actually changed, how to pull the 30.9 GB of weights from Hugging Face, how to serve the model with vLLM, SGLang or Transformers, and what to run on it for legitimate research.

What "qwen uncensored" actually means

Abliteration is a weight-level intervention, not a fine-tune. The refusal direction is a vector in the model's residual stream that, when activated, produces "I can't help with that"; abliteration finds that direction and orthogonalizes it out of the weights. On this build the removal was applied to 131 residual-writing matrices (the method from Arditi et al. 2024, "Refusal in Language Models Is Mediated by a Single Direction"), and the result was re-quantized to match the official Qwen3.8-27B-FP8 scheme byte-for-byte so vLLM serves it on the identical FP8 kernel path. No new weights were trained.

That distinction matters because the top results for "qwen uncensored" mix three different things: abliterated weight edits like this one, system-prompt "uncensored packs" that only mask refusals at the prompt level, and LoRA fine-tunes trained without safety data. They are not equivalent, and most pages ranking for the query do not tell you which family they are describing. If you want to study the refusal mechanism itself, only the weight-level intervention is the real thing.

What the refusal removal actually did — the numbers

The model card publishes a safety-evaluation suite, run on the vLLM-served model and dated August 15, 2026. With thinking off, refusal on seven harmful-prompt benchmarks collapses from 64–99% on the base to 0–6% on this build: AdvBench 99.0% to 0.0%, JailbreakBench 94.0% to 0.0%, StrongREJECT 97.3% to 2.0%, HarmBench 98.7% to 2.7%, MaliciousInstruct 99.0% to 0.0%, SimpleSafetyTests 64.0% to 6.0%, ForbiddenQuestions 73.3% to 4.7%. With thinking on, the model refuses essentially never — 1.7% or less. A separate, notable number is the caveat rate: 30–50% of "uncensored" answers still prepend a short disclaimer before answering; that is a training artifact, not a refusal.

The flip side is what did not change. Over-refusal on benign prompts drops from 5.6% to 0.4% on XSTest-safe, and every capability benchmark stays within ±1.3 points of the base: MMLU 84.3% to 84.7%, GSM8K 90.0% to 88.7%, MMLU-Pro 77.6% to 76.8%, CMMLU 81.4% to 80.8%. WikiText-2 perplexity is 6.96. In other words, the intervention removed the refusal behavior without meaningfully degrading the model.

How to pull it from Hugging Face

The repository is orcarouter/Qwen3.8-27B-Uncensored-FP8, and it is gated: you log in with a Hugging Face account and accept the conditions before the files download — the gate is itself the disclaimer, because reading the README is part of accepting what this model is. What you are downloading is 30.9 GB across seven safetensors shards (1,606 tensors) in block-FP8 (E4M3, 128-by-128 blocks, dynamic activations), with the vision tower, norms, embeddings and lm_head kept in BF16. The license is Apache 2.0, inherited from the base Qwen/Qwen3.8-27B. No Hugging Face Inference Provider hosts it — you run it yourself, or use a hosted card.

How to run it

The weights are roughly 31 GB — about half the ~56 GB BF16 checkpoint — and the card recommends a single H100 80GB or H200 143GB, with ~40 GB of VRAM as the practical floor for weights plus a small KV cache. Full 262K context needs more, but an FP8 KV cache halves that. The setup the card verified was one H200 with --max-num-seqs 96, FP8 KV cache and MTP enabled.

vLLM is the intended path, and it is one command, because the FP8 scheme matches the official build exactly:

vllm serve "orcarouter/Qwen3.8-27B-Uncensored-FP8"

That gives you an OpenAI-compatible endpoint at localhost:8000/v1/chat/completions. The Docker equivalent is docker model run hf.co/orcarouter/Qwen3.8-27B-Uncensored-FP8. For the full setup the card suggests: --language-model-only for text-only serving, --speculative-config '{"method":"mtp","num_speculative_tokens":3}' to enable the MTP speculative-decoding head, --kv-cache-dtype fp8, --max-model-len 262144, --reasoning-parser qwen3, and --enable-auto-tool-choice --tool-call-parser qwen3_coder for tool calling. Do not pass --quantization fp8 — the scheme is read from config.json. Drop --kv-cache-dtype fp8 if you want a BF16 KV cache, and drop --language-model-only if you need the vision tower.

For SGLang: python3 -m sglang.launch_server --model-path "orcarouter/Qwen3.8-27B-Uncensored-FP8" --host 0.0.0.0 --port 30000. For Transformers, the card documents both the pipeline API — pipeline("image-text-to-text", model="orcarouter/Qwen3.8-27B-Uncensored-FP8") — and AutoProcessor.from_pretrained(...) plus AutoModelForMultimodalLM.from_pretrained(..., device_map="auto").

What to actually do with it in research

The point of a refusal-removed model is to be an object of study, and this build is unusually easy to study because its intervention is documented. Three concrete, legitimate research projects:

• Reproduce the refusal delta. Run AdvBench, HarmBench, StrongREJECT or XSTest-safe against both the abliterated build and the base FP8, and confirm the card's numbers: 64–99% to 0–6% on harmful prompts, 5.6% to 0.4% over-refusal on benign ones. That before/after pair is exactly the measurement a safety team needs to know whether a refusal-removal method works and what it costs.

• Study where refusal lives. Because the build documents the 131 matrices that were orthogonalized, you can compare residual-stream directions against the base and see what the intervention moved. The thinking-on result is informative here: refusal drops to 1.7% or less when thinking is enabled, which is evidence that the reasoning trace is where the direction matters most.

• Evaluate your own guardrail. A no-guardrail baseline is the correct control for testing a moderation layer. Run your filter over this model's outputs and measure what it catches — that is how you quantify the safety layer you add on top.

When this model is the wrong answer

If you want a normal assistant, or anything you would put in front of end users, this is the wrong model — it has no meaningful built-in guardrails, it will comply with requests the base model refuses, and Apache 2.0 does not transfer your liability away. Use the original aligned Qwen3.8-27B instead. If you want to deflect refusals on a chatbot, a system-prompt pack achieves more with less risk than a weight edit. And if you have no ~40 GB card but still want to study the model, the hosted card obsidian/Qwen3.8-27B on OrcaRouter serves the same uncensored 27B line at $0.40 per million input tokens and $4.21 per million output, with the same 262K context — it is gated to security and AI-safety researchers, and the moderation decision still sits on your side.

The safety boundary — read this before you download

This model has had its safety alignment substantially removed. It will comply with harmful, unethical, offensive or illegal requests that the original Qwen3.8-27B would refuse, and it has no meaningful built-in guardrails. It is released strictly for legitimate research — interpretability, AI-safety and refusal-mechanism study, red-teaming, robustness evaluation and controlled experiments. You assume full responsibility and liability for how you use it and for everything it generates, and you must not deploy it to end users or into production without adding your own safety, moderation and abuse-prevention layers. The authors accept no liability for misuse. Downloading the repository means you accept these conditions; the license is Apache 2.0.

This article deliberately contains no harmful prompts. The refusal numbers above come from the model card's own safety-evaluation suite, which is the correct way to measure a model of this class: run the standard refusal benchmarks, read the numbers, and design your research around what they show.

Bottom line

"Qwen uncensored" is a search for a technique, and the version to try first is Qwen3.8-27B-Uncensored-FP8: the only refusal-removed Qwen3.8 build that serves on the official FP8 vLLM kernel path with 262K context, vision and MTP intact, backed by a published before/after evaluation. Pull the gated 30.9 GB from Hugging Face, serve it with vLLM on a single H100 or H200, and use it for what it is for — measuring refusals, studying the refusal mechanism, and testing guardrails. Do not use it as a chatbot, and do not ship it to end users. The weights are free; the responsibility for what you do with them is entirely yours.

For legitimate research, the weights are on Hugging Face: Download from Hugging Face