README.md
11.7 KB · 182 lines · markdown Raw
1 ---
2 license: apache-2.0
3 base_model:
4 - Qwen/Qwen3-VL-8B-Instruct
5 base_model_relation: finetune
6 quantized_by: AtomicChat
7 pipeline_tag: text-to-image
8 library_name: gguf
9 tags:
10 - atomic-chat
11 - qwen
12 - qwen-image
13 - qwen3-vl
14 - text-encoder
15 - stable-diffusion.cpp
16 - gguf
17 - abliteration
18 - refusal-direction
19 ---
20
21 # How to Run Qwen-Image-2.1-Turbo Without Refusals Locally
22 <p style="margin-top: 0; margin-bottom: 0;">
23 <em>Qwen-Image's text encoder, Qwen3-VL-8B-Instruct, with its refusal direction projected out: a drop-in <code>--llm</code> for stable-diffusion.cpp next to our <a href="https://huggingface.co/AtomicChat/Qwen-Image-2.1-Turbo-GGUF">Turbo denoiser GGUFs</a>. Below, exactly which part is uncensored and what that does to the pictures. The <a href="https://huggingface.co/datasets/AtomicChat/Qwen-Image-2.1-Turbo-Uncensored-GGUF-metrics">measurements</a> are public.</em>
24 </p>
25 <div style="display: flex; gap: 8px; align-items: center; margin-top: 10px; margin-bottom: 10px;">
26 <a href="https://atomic.chat/?utm_source=huggingface&utm_medium=referral&utm_campaign=hf_qwen_image_2_1_turbo_abliterate&utm_content=btn_atomic"><img src="https://huggingface.co/AtomicChat/Qwen3.8-27B-GGUF/resolve/main/btn_atomic.png" width="162" alt="Atomic Chat"></a>
27 <a href="https://discord.gg/8wGSsvmg4V"><img src="https://huggingface.co/AtomicChat/Qwen3.8-27B-GGUF/resolve/main/btn_discord.png" width="119" alt="Discord"></a>
28 <a href="https://github.com/AtomicBot-ai/Atomic-Chat"><img src="https://huggingface.co/AtomicChat/Qwen3.8-27B-GGUF/resolve/main/btn_github.png" width="115" alt="GitHub"></a>
29 </div>
30 <ul style="margin: 0 0 12px 0;">
31 <li>As a chat model, the encoder's refusals fall from 88.9% to 1.2% in English and from 38% to 0% in Russian on held-out prompts. MMLU is unchanged: 77.35% before and after.</li>
32 <li><strong>On images it changes nothing we could measure.</strong> The stock Qwen-Image pipeline has no filter and already draws all 9 sensitive categories we tested, and with this encoder not one of 45 prompts changed outcome. See <a href="#where-exactly-this-is-uncensored">where exactly this is uncensored</a>.</li>
33 <li>Generate images locally in <a href="https://atomic.chat/?utm_source=huggingface&utm_medium=referral&utm_campaign=hf_qwen_image_2_1_turbo_abliterate&utm_content=bullet_app">Atomic Chat</a>. It runs stable-diffusion.cpp, the engine these files were built and checked with.</li>
34 </ul>
35 <hr style="margin: 0 0 16px 0;">
36
37 ## Where exactly this is uncensored
38
39 Qwen-Image 2.1 makes a picture with three parts. Only one of them is changed here.
40
41 | Part | Does it refuse or filter? | In this repo |
42 |---|---|---|
43 | Safety checker | Qwen-Image ships none. The open weights have no content filter; moderation exists only in Qwen's hosted service. | nothing to remove |
44 | **Text encoder**, Qwen3-VL-8B-Instruct | As a chat model, yes: it refused 88.9% of harmful English requests. Inside Qwen-Image it generates no text, so it cannot refuse. But the direction it uses for "refuse" is fully present in the hidden states the denoiser reads (last layer: harmful and harmless prompts separate with AUROC 1.000). | **edited**: that direction is projected out of the weights |
45 | **Denoiser**, the 7B image model | It has no refusal mechanism. It draws what its training data taught it, and Qwen filtered NSFW images out of the pretraining data. | **unchanged** |
46
47 The stock pipeline already blocks nothing. This release changes only how the encoder represents prompts it would refuse as a chat model. What the denoiser never learned to draw, no encoder can add.
48
49 What that does to the pictures, measured on 45 sensitive prompts (adults only) and 48 neutral ones, stock encoder against this one, same seed, same denoiser:
50
51 | | Stock encoder | This encoder, BF16 | This encoder, Q8_0 |
52 |---|---:|---:|---:|
53 | Sensitive prompts where the judge sees what was asked for | 40 / 45 | 40 / 45 | 40 / 45 |
54 | ... nudity / suggestive (5 each) | 4 / 4 | 4 / 4 | 4 / 4 |
55 | ... violence / weapons / drugs (5 each) | 5 / 5 / 4 | 5 / 5 / 4 | 5 / 5 / 4 |
56 | ... profanity written in the image / medical anatomy (5 each) | 4 / 4 | 4 / 4 | 4 / 4 |
57 | ... controls: smoking and alcohol / tattoos (5 each) | 5 / 5 | 5 / 5 | 5 / 5 |
58 | Prompts that flip against the stock encoder, either way | – | **0 of 45** | **0 of 45** |
59 | How far the picture moves from the stock-encoder picture (LPIPS), sensitive prompts | – | 0.088 | – |
60 | The same on 48 neutral prompts | – | 0.084 | 0.090 |
61
62 **On images we measured no uncensoring effect, because on these prompts there was nothing to uncensor.** The stock
63 pipeline already draws every category in the probe set, and this encoder draws exactly the same ones: not one prompt
64 flipped. The pictures do change, by about a sixth of what a new seed does (a new seed is 0.499). They change as much
65 on neutral prompts as on sensitive ones, so this is a general shift, not a shift towards refused content. For scale:
66 quantizing the stock encoder to Q8_0 moves the same pictures by 0.037.
67
68 What this release does give you is the encoder as a chat model without refusals (next section), in the files
69 stable-diffusion.cpp takes as `--llm`.
70
71 ## The files
72
73 The encoder in the same ladder as our [Turbo denoiser](https://huggingface.co/AtomicChat/Qwen-Image-2.1-Turbo-GGUF),
74 with our importance matrix and per-tensor layout (`AD-`). Two numbers per file:
75 - **Pictures:** how far its pictures move from those of this encoder in BF16. That is LPIPS on 48 neutral prompts,
76 with the BF16 denoiser and the same seed. A new seed is 0.499.
77 - **As a chat model:** mean KLD to the original Qwen3-VL-8B-Instruct and how often the top token matches. These
78 include the ablation itself (0.0019 at BF16).
79
80 | File | Size | Pictures (LPIPS) | KLD | Same top-1 |
81 |---|---:|---:|---:|---:|
82 | `Qwen-Image-2.1-Turbo-Uncensored-BF16.gguf` | 16.39 GB | 0 | 0.0019 | 98.45% |
83 | `Qwen-Image-2.1-Turbo-Uncensored-Q8_0.gguf` | 8.71 GB | 0.031 | 0.0029 | 98.04% |
84 | `Qwen-Image-2.1-Turbo-Uncensored-AD-Q6_K.gguf` | 7.49 GB | 0.043 | 0.0039 | 97.77% |
85 | `Qwen-Image-2.1-Turbo-Uncensored-AD-Q5_K.gguf` | 6.28 GB | 0.066 | 0.0068 | 97.06% |
86 | **`Qwen-Image-2.1-Turbo-Uncensored-AD-Q4_K.gguf`** | **5.29 GB** | **0.087** | **0.0154** | **95.30%** |
87 | `Qwen-Image-2.1-Turbo-Uncensored-AD-Q3_K.gguf` | 4.18 GB | 0.163 | 0.0641 | 90.62% |
88 | `Qwen-Image-2.1-Turbo-Uncensored-AD-Q2_K.gguf` | 3.34 GB | 0.241 | 0.2495 | 81.06% |
89 | `mmproj-Qwen-Image-2.1-Turbo-Uncensored-F16.gguf` (and `-BF16`) | 1.16 GB | – | – | – |
90
91 - **Q8_0** if it fits. **AD-Q4_K** is the pick at 4 bits.
92 - **The encoder's type matters for the pictures.** A plain `llama-quantize` Q4_K_M of this encoder (5.03 GB, the
93 type most encoder GGUFs ship) moves the pictures by **0.166**. AD-Q4_K moves them by 0.087, half as much, for
94 260 MB more. As a chat model the plain Q4_K_M is at KLD 0.0276, 93.83% top-1.
95 - **AD-Q2_K** draws noticeably different pictures. Take it only if nothing larger fits.
96 - The mmproj is the vision projector, unmodified. It is for editing (`--llm_vision`) or chat with images.
97
98 `AD-` layouts:
99 - `attn_k`/`attn_v` stay at Q8_0 (Q6_K, Q5_K at 3 and 2 bits).
100 - `attn_q`/`attn_output` and the MLP down projection of the first and last four blocks take one step above the
101 base type.
102 - The token embedding and the output head are at Q6_K or higher (Q4_K/Q5_K at 2-3 bits).
103 - The importance matrix comes from 2000 chunks of 512 tokens of our calibration corpus, chat-formatted, with
104 `--parse-special`.
105
106 ## Running it
107
108 ```bash
109 sd-cli --diffusion-model Qwen-Image-2.1-Turbo-AD-Q4_K.gguf \
110 --llm Qwen-Image-2.1-Turbo-Uncensored-Q8_0.gguf \
111 --vae qwen_image_2.1_vae_bf16.safetensors \
112 -p 'your prompt' \
113 --steps 8 --cfg-scale 1.0 --sampling-method euler \
114 --sigmas 1.0,0.978453,0.95418,0.926626,0.89508,0.845148,0.704534,0.414568,0.0 \
115 -W 1024 -H 1024 --diffusion-fa -o out.png
116 ```
117
118 - **Denoiser:** [AtomicChat/Qwen-Image-2.1-Turbo-GGUF](https://huggingface.co/AtomicChat/Qwen-Image-2.1-Turbo-GGUF).
119 The Turbo settings (8 steps, CFG 1, the sigma list) are explained there.
120 - **Qwen-Image-2.1:** the same encoder works with the non-Turbo denoisers.
121 - **VAE:** `vae/qwen_image_2.1_vae_bf16.safetensors` from
122 [Comfy-Org/Qwen-Image-2.1](https://huggingface.co/Comfy-Org/Qwen-Image-2.1).
123 - **As a chat model:** the encoder is a regular Qwen3-VL GGUF. With the mmproj it runs in llama.cpp.
124
125 ## The encoder as a chat model
126
127 Original against this one, both BF16, on prompts never used to pick anything:
128
129 | | Original | Abliterated |
130 |---|---:|---:|
131 | JBB harmful behaviours (EN, 81), refused | 88.9% | **1.2%** |
132 | Aya red-teaming (RU, 100), refused | 38.0% | **0%** |
133 | XSTest safe prompts (250), refused | 2.0% | 0% |
134 | MMLU, 2000 questions | 77.35% | 77.35% (15 answers changed each way, McNemar p = 1.0) |
135 | Tool calls (20) | 20/20 valid | 20/20 valid |
136 | Needle at 30k tokens (3 depths) | 3/3 | 3/3 |
137 | Mean KLD to the original on held-out neutral text | – | 0.0018 |
138
139 Refusal is counted by the opening of the reply, so it is indicative, not a judge. Empty or degenerate replies count as damage, and there were none.
140
141 Two of our pipeline's gates did not pass, and the card says so:
142 - **First-token KL.** On the harmless validation prompts it is 0.100, at the 0.10 limit.
143 - **Leak gate.** The direction left in the edited writers at full strength is 1.9e-4 of the original, above the 1e-5 we set for an earlier model. That is the size of bf16 rounding: the edit itself, baked once in f32, lands within 1.8e-3 of its target after bf16 rounding.
144
145 ## How it was made
146
147 1. **Direction.** Difference of means of the residual stream at the last prompt token, chat template applied: 416
148 harmful against 416 harmless English prompts, taken entering block 23 of 36, with the harmless-mean component
149 removed.
150 2. **Edit.** `W' = W - 0.75 r rᵀW` on every matrix that writes into the residual: 36 attention outputs, 36 MLP
151 down projections, and the token embedding. The vision tower is untouched.
152 3. **Choice.** 26 variants screened on validation prompts: row, strength, which writers, English only or English +
153 Russian, one direction per block. The numbers above come from held-out test prompts.
154 4. **Bake and quantize.** The edit applied to the BF16 weights in f32 and rounded once, then Q8_0 and the AD
155 ladder with our importance matrix. Built with llama.cpp `6184e92` (upstream), with two graph names added for the
156 activation taps.
157 5. **Images.** stable-diffusion.cpp `36f1b1a` on an A100 80 GB, Turbo denoiser in BF16, 1024×1024, the Turbo
158 schedule, seed 42. The stock encoder as a GGUF renders pixel for pixel what the original safetensors encoder
159 renders, so the file format is not a variable.
160
161 ## Limitations
162
163 - The refusal count reads the opening of each reply. A soft refusal phrased as an answer would be missed.
164 - The probe set is small (45 prompts, one seed). Its yes/no numbers come from a vision model judge, this encoder
165 with its projector. Every image of both builds went through the same judge.
166 - Editing with input images keeps a path the edit cannot reach. Qwen3-VL adds its visual features to the residual
167 stream after the first three blocks, and there is no weight on that path.
168 - Not run yet in ComfyUI, on a Mac, or with the Qwen-Image-2.1 (non-Turbo) denoiser.
169
170 ## Responsible use
171
172 The encoder no longer leans prompts towards a refusal. That does not make the output safe, correct or lawful. Do
173 not use it to make sexual content involving minors, or intimate or degrading images of real people without their
174 consent. Any deployment needs its own access controls and policy enforcement.
175
176 ## Credits
177
178 Direction estimation, edit, quantization and evaluation by **AtomicChat**. Base model
179 [Qwen3-VL-8B-Instruct](https://huggingface.co/Qwen/Qwen3-VL-8B-Instruct) by Qwen, Apache-2.0. The denoiser it pairs
180 with, Qwen-Image-2.1-Turbo, is under the Qwen Research License. The method follows Arditi et al., *Refusal in
181 Language Models Is Mediated by a Single Direction* (2024).
182