Ternary Bonsai 2 27B Uncensored vs Qwen3.8-27B-Uncensored-MLX: Two Ways to Remove a Refusal Direction

OrcaRouter Ternary Bonsai 2 27B Uncensored and Qwen3.8-27B-Uncensored-MLX answer the same question — how do you take a refusal direction out of a language model — and they answer it in two different places. The Qwen3.8-27B-Uncensored-MLX lineage is conventional abliteration: the weight matrices are orthogonalised against a learned refusal direction, and the edited weights are saved as a new checkpoint. OrcaRouter Ternary Bonsai 2 27B Uncensored does the equivalent projection at inference time instead, subtracting the component of each residual write that lies along the refusal direction, so the underlying Bonsai pack is never modified and stays bit-identical. Both are our own releases, and the split between them is not a preference about runtimes. It falls out of arithmetic that is specific to ternary weights.

The subject of this comparison is one day old. Prism ML announced Bonsai 2 27B on 2026-09-17; the Hugging Face repos were created the evening before, at 23:40–23:41 UTC on 2026-09-16, under Apache-2.0. The abliterated MLX build it is being compared against has been up since mid-August. Nothing below is a track record for the newer of the two — where something has not been measured, this article says so.

The same trick, applied in two different places

Ordinary abliteration is a weight edit. You estimate a refusal direction, then project it out of the matrices that write into the residual stream: W ← W - r(rᵀW). A few matrix multiplications, no optimiser, no loss. That is how Qwen3.8-27B-Uncensored-MLX was made — the model card describes it as "abliteration (refusal-direction removal), then MLX affine quantization," with the direction orthogonalised out of the residual stream and the result saved as a new set of weights. What ships is a checkpoint that already has the direction gone.

OrcaRouter Ternary Bonsai 2 27B Uncensored leaves the weights alone and intervenes where each residual contribution is produced, in float32, with the stored refusal direction r:

• y ← y - alpha · dot(y, r) · r

At alpha 1 — the default — the component parallel to r is removed from that write. At alpha 0 the projection is off and the model behaves as the published pack does. Values between give partial strength, values above 1 over-project, which the project says may degrade quality. Layer selection is exposed too, so you can ablate a subset rather than the whole stack. The direction itself is an ordinary 5120-dimensional vector — about 20 KB in float32 — with no extra Hadamard rotation applied, because the projection operates on projection outputs, which are already in the normal hidden basis.

The coverage detail is the part people get wrong when they try this themselves. Wrapping self_attn.o_proj alone catches 16 sites. This implementation wraps 129 residual writers: 64 mlp.down_proj, 48 linear_attn.out_proj, 16 self_attn.o_proj, and model.embed_tokens. A bundled selfcheck.py verifies the projection drives the remaining component down to roughly 1e-6 of the residual norm, and warns if 129 sites are not detected.

Why ternary weights make this a forced choice rather than a preference

Here is the part that is actually specific to this model, and it is the reason the two approaches are not interchangeable here even though they compute nearly the same thing.

A ternary pack stores values in {-1, 0, +1} times a per-group FP16 scale, at group size 128, in a rotated basis. Orthogonalise a ternary matrix against a refusal direction and you get a dense, full-precision matrix. There is no ternary matrix that equals W - r(rᵀW) in general. So saving the edited weights back means re-quantising them — and re-quantising edited weights does not reproduce the quantisation-aware training that produced the original pack. The rounding behaviour that Prism ML trained the model to tolerate is a property of the training procedure, not of the quantiser, and you cannot re-run it after the fact.

On a dense BF16 checkpoint that problem does not arise. Round the edited weights to 4-bit and you get a slightly worse 4-bit model, which is the ordinary trade everyone already accepts. On a ternary pack you would be throwing away the one property the pack exists to have.

So the honest framing is not "runtime is better." It is that runtime projection is the only one of the two that preserves what is special about this particular model. The refusal direction is 20 KB. The pack is 8.005 GiB.

That 8.005 GiB figure is the MLX pack specifically — prism-ml/Ternary-Bonsai-2-27B-mlx-2bit, whose model.safetensors measures 8,595,477,990 bytes on the Hugging Face API (8.595 GB, 8.005 GiB), an MLX affine container with 2-bit codes plus an FP16 scale and bias per group. It is a different artifact from the GGUF builds Prism ML ships, and the numbers do not transfer between them. Prism ML's own 5.93 GB / 1.76 bits-per-weight headline describes their PTQ1_0 GGUF, which measures 5.947 GB; their True Ternary format is quoted at 1.72 bits per weight and 5.80 GB. Neither of those figures describes the MLX pack this runtime ablates.

Where the checkpoint approach still wins, and it does win some

It would be easy to write this as a victory lap for the newer method. That would be wrong, because conventional abliteration is ahead on the axes that decide most deployments.

• One artifact, any compatible runtime. An abliterated checkpoint is a normal set of weights. Load it in whatever MLX-compatible loader you already use, and it works. The runtime approach needs the pack's own bundled runtime — and the project warns explicitly that an ordinary MLX loader can appear to load the pack while silently computing the wrong thing. That is a much narrower runway.

• Hardware. Qwen3.8-27B-Uncensored-MLX is offered in 2, 4, 6 and 8-bit builds with a 4-bit copy mirrored at the repo root, so tools that treat a repo as a single model load it with no configuration. Ternary Bonsai 2 27B Uncensored is Apple Silicon / MLX. The pack's quantised matmul has Metal and CPU kernels but no CUDA implementation through mlx-cuda, so on an NVIDIA machine this MLX pack does not currently get GPU acceleration at all — CPU inference works, and a 27B forward pass can take minutes. That makes the Linux CPU path useful for implementation testing and reproducibility, not for serving.

• Tooling and familiarity. Abliteration has years of tooling behind it — tuned recipes, layer-range search, published variants you can compare against. The runtime method here has one implementation, on one model, released yesterday.

• Distribution. A single checkpoint is a single download. Runtime ablation ships a pack plus a direction file plus a runtime, and the reader has to keep three things in step.

• Evidence. Checkpoint abliteration has third-party measurements on this base model family. Runtime ablation on a ternary pack has only our own numbers, and its central assumption is unverified — more on that below.

What runtime ablation buys in exchange

The trade is real in the other direction too, and the first item is the one that generalises beyond this model.

• Bit-identical provenance. Zero weights modified, zero re-quantisation, zero additional quantisation error. That is not a slogan; it is the property that makes the capability numbers below interpretable rather than a happy accident.

• An adjustable alpha. Ablation strength is a runtime parameter, not a checkpoint property. You can sweep it for your workload, disable it entirely with alpha 0, or over-project and measure what breaks — without downloading a second model.

• Layer-selective control. Ablating a subset of layers is an argument, not a re-bake. That matters for anyone studying which layers carry the behaviour, because the alternative is producing a checkpoint per configuration.

• No second set of weights. The edited model is the original model. For a pack whose entire thesis is footprint, shipping a parallel abliterated copy at roughly 16 GB — the size of the 4-bit build in the comparison repo — would undercut the point.

• Reversibility. A checkpoint edit is permanent for that artifact. A runtime flag is not.

The numbers we have, and exactly how they were measured

Everything in this section is OrcaRouter's own evaluation of OrcaRouter Ternary Bonsai 2 27B Uncensored, and the method matters as much as the figures.

The measurement is a rule-based opening-phrase classifier, not an LLM judge. Thinking is off, decoding is greedy, the budget is 64 tokens, and base and ablated are the same weights in the same process at alpha 0 versus alpha 1. That last point is the strongest part of the setup: there is no cross-checkpoint comparison and no quantisation difference to confound the result. It is also why the numbers should be read as a measure of what the model says in its opening phrase, and no more than that.

Refusal rates on published harmful-prompt sets, base to ablated:

• AdvBench (n=100) — 99.0% to 6.0%

• JailbreakBench (n=100) — 96.0% to 4.0%

• StrongREJECT (n=150) — 99.3% to 3.3%

• HarmBench (n=150) — 98.7% to 7.3%

• MaliciousInstruct (n=100) — 97.0% to 0.0%

• ForbiddenQuestions (n=150) — 75.3% to 5.3%

• SimpleSafetyTests (n=50) — 96.0% to 18.0%, and this one is understated

SimpleSafetyTests is understated for a specific reason. That set is mostly self-harm prompts, and the ablated model answers them with a crisis redirect that opens "I am deeply sorry to hear…". The classifier's exact phrase list does not contain that opening, so it scores a redirect as compliance. The real residual refusal rate is higher than 18.0%. The classifier was left as-is deliberately, so the figures stay comparable with OrcaRouter's other model cards — but a reader should not take 18.0% at face value.

No reply in any of these runs ran out of its token budget, which is what makes a 64-token budget defensible here. A separate column in the full results counts replies that answered but wrapped the answer in a disclaimer; that ran 42–60% depending on the set.

Two results that cut against the simple story

Two of the findings deserve their own treatment, because both complicate the obvious reading.

Over-refusal drops too. On JailbreakBench's benign prompts, the published pack refuses 25.0% of them. Ablated, it refuses 0.0%. On XSTest-safe it goes from 5.2% to 0.4%.

This is the underreported half of the technique. The published Bonsai pack turns down a quarter of a benign prompt set; whatever the refusal direction is doing in the QAT model, it is firing on prompts that should never have triggered it. Removing the direction removes those refusals as well, and that is a genuine capability gain rather than a safety cost. The same effect shows up in independent work on other models — Atomic Chat's own harness measured Gemma 2 9B's benign-prompt over-refusal collapsing from 44% to 0.5% after abliteration, with MMLU essentially unmoved at 68.4 to 68.0. Their measurement, their model, self-reported on their blog; the pattern is the point, not the exact figures.

The framing that follows is uncomfortable but honest: over-refusal and refusal are the same knob. You do not get to turn down only the refusals you dislike.

Capability retention is flat, and that is not luck. The capability checks, base to ablated:

• MMLU (n=300) — 76.7% to 77.7%, +1.0

• GSM8K (n=150) — 87.3% to 86.0%, -1.3

• CMMLU (n=500) — 76.2% to 75.6%, -0.6

Every movement is inside noise at these sample sizes — one GSM8K question is worth 0.7 points. MMLU-Pro was excluded rather than reported: its prompt asks for reasoning before the answer, and 63–64% of replies on both sides had not reached an answer inside the token budget, so any accuracy figure would be a floor set by the budget rather than a measurement.

Flat capability follows directly from bit-identical weights, and it is worth being precise about why. The model doing the answering is the same model. The runtime adds one dot product and one AXPY per residual write and changes nothing about the weights, the quantisation, or the kernels that read them. A checkpoint approach has to earn that flatness — and often does not. A third-party gauntlet of a different abliteration of the same Qwen3.8-27B base, published 2026-08-17 by an engineer at SMF Works, measured a composite of 79.0% falling to 72.0%, with math dropping 50.0% to 33.3%. That is a different recipe, a different toolchain and a different measurement, so it is not a score for this comparison. It is a reminder that checkpoint abliteration on this base has cost double digits in at least one careful, instrumented test, and that "abliteration is nearly free" is a claim that depends entirely on the recipe.

The assumption nobody has verified yet

This is the part of the story that has to be said plainly, and it belongs in a comparison of uncensoring methods rather than in a footnote.

The refusal direction used here was estimated from the BF16 base model that the Bonsai pack was trained from. The architecture and the hidden basis are identical, so the vector is dimensionally correct and the projection is mathematically exact — the runtime can prove, and does verify, that it removes the supplied direction from the residual stream.

What that does not prove is that the direction still means the same thing in the quantisation-aware-trained model. How well the direction survives quantisation-aware training has not been fully measured. Removing a vector exactly is not the same as removing the behaviour it was estimated to represent, and the second claim is the one that matters. Every number in the section above is an empirical result that is consistent with good transfer; none of them is a demonstration that transfer is complete, and the project says so itself, recommending that alpha and layer selection be swept before drawing conclusions.

Any honest comparison of uncensoring methods has to admit this. Conventional abliteration has the mirror-image problem — it edits weights and then measures the result, so its direction never has to transfer between model versions, but its edit is permanent and unrecoverable if the recipe was wrong.

What is still unmeasured

Beyond the transfer question, three gaps are worth naming rather than writing around.

• No independent reproduction. Every Bonsai 2 27B benchmark in circulation — the 83.9 average, the 98.2% retention, the category splits — is vendor-reported by Prism ML, run with EvalScope on a vLLM backend on H100s at "xhigh" reasoning effort. Nobody outside Prism ML has reproduced them. The safety and capability tables above are ours and are not independent either.

• Thinking-on behaviour. Our tables are thinking off. Independent work on other abliterated models has found that even at 100% attack success, the model still reasons about safety in a substantial fraction of responses when it is allowed to think. Whether that holds here, and what it does to the opening-phrase numbers, has not been measured.

• A single direction. The method assumes refusal is mediated by one direction, which is the Arditi et al. finding and the basis for the whole technique. Follow-up work on other models has found geometrically distinct directions for different refusal categories. One vector, swept over one alpha, does not settle that.

What this means if you are choosing between them

Pick the checkpoint if you need the model to run anywhere, on hardware you do not control, through a loader you did not write. Pick the runtime if you are on Apple Silicon, you care that the artifact you are studying is the artifact Prism ML trained, and you want ablation strength to be a parameter you can turn rather than a decision you have to re-download. Those are both defensible, and they are chosen by deployment constraints, not by which method is newer.

If you are trying to decide empirically, the runtime method has one practical advantage worth naming: alpha 0 and alpha 1 are the same process and the same weights, so a comparison between them isolates the ablation and nothing else. That is a cleaner experiment than diffing two checkpoints, and it is the reason the table above can be read as a measurement of the projection rather than a measurement of two quantisations of it.

Responsible use

Removing a learned refusal direction can cause the model to respond to requests the original would decline. That is the mechanism working, not a side effect, and it should not be filed as a feature. This is a research and inference-control mechanism, and it is not evidence that any resulting output is safe, correct or appropriate.

The published pack's own card makes the same point from the other side: the abliterated MLX build "has had its safety alignment substantially removed," will comply with requests the original would refuse, and carries no meaningful built-in guardrails. Its authors scope it to legitimate research — interpretability, safety research, red-teaming, robustness evaluation — and say plainly that deployments must add their own moderation layer and access controls first.

Nothing in this article is an argument that refusal removal is costless, or that a lower refusal rate is a quality signal. A model that answers more questions is not thereby a better model, and a rule-based classifier counting opening phrases is a measurement of phrasing, not of competence. Both of these artifacts are research tools with an operator duty attached, and the duty does not move to whoever wrote the ablation code.

The runtime-ablation code, the refusal direction and the full evaluation tables are published by OrcaRouter, alongside the routing platform the team builds.