I downloaded an uncensored aggressive Qwen 3.5 model and I can see in its reasoning that it is still limiting responses based on safety guardrails (e.g. violence, NSFW).
Anybody have recommendations for truly uncensored models?
EDIT: I turned off reasoning and I think it’s more uncensored if I’m very specific about what the response should include.
Abliteration techniques might be more limited with reasoning models. I don’t know if they process simply be rehashing the arguments or if there’s more under the hood that would be harder to alter.
I try new models from time to time, including some of the thinking ones, but I’ve always come back to the NeuralDaredevil model, even though it’s “old”. Your results may differ depending on the subject matter, but I can’t think of an instance where I hit a wall. At most, maybe some sidetracking but once I told it to be more open it didn’t hold back.
I’m not sure what the appeal of the thinking mode is. Perhaps on some things it does better, but in watching its reasoning I’ve seen it talk itself out of a good solution too. Which is what you get with typical models when you push the context too far and don’t start a new session, they wander.
Thanks! I’ll check out that model. Is it actually usable or just good at being uncensored?
It’s as good as an 8B can be, but with the right system prompt for your purpose and proper expectations, I think it’s good. I’ve had some other newer 8B that blew up after a few cycles, literally getting stuck on something, but I can’t say this one ever did. But again, even the big models like Claude and the rest work better with short sessions and a specific, detailed prompt to start with. Use a model to make the prompt, telling it to be detailed, concise, and minimize fluff. Less tokens in and out that way, less context drift (hopefully).
Thanks! I don’t think I can run an 8B yet. Need to invest in a better machine. I’m stuck on 4B Q4.
The uncensored Qwen that I’m using started throwing infinite ?’s at me one time. Had to restart it and has been fine since.
It is certainly inaccurate, but in my mind’s picture of how the transformers work, reducing their quantization and also doing what abliteration does, there is a line where you’ve done a lot of “damage” to the original model and so there will be places where it just hangs or goes off on severe tangents. There are good places for even the 1bit models where they don’t get pushed to hard, but there are limits for them all, including the big ones.
Hugging Face does have a few Q4_K_M versions. Maybe something will fit.
For sure. You would need a model that is not censored at training.
Anybody have recommendations for truly uncensored models?
-
Are you wanting something for ERP (erotic role-play; sexy chatbots)?
-
How much VRAM can you afford to spend on it?
If the answer to (1) is “yes”, then:
If the answer to (2) is “large GPU range”, maybe 16GB+ -ish, then I’d maybe look at Cydonia, based on Mistral. I find that this tends to become increasingly nonsensical and repetitive at a conversation grows to a certain (sub-context window) size, but it’s quite popular with users on /r/SillyTavernAI, and for the memory, I do think that it’s fairly solid.
If the answer to (2) is “unified memory range” — I use a 128GB Framework Desktop myself — then I personally use AnubisLemonade, a merge of two popular Llama 3.3-based models, sophosymphonia’s StrawberryLemonade and Anubis.
Anubis (based on Llama 3.3) and Cydonia (based on Mistral) are both done by /u/TheDrummer, a user who is active on /r/LocalLlama on Reddit.
You’ll probably want a quantitized version (probably Q4_K_M and up in size, if you can afford the memory). For AnubisLemonade, quantitized versions:
https://huggingface.co/bartowski/ockerman0_AnubisLemonade-70B-v1.1-GGUF
For Cydonia, quantitized versions:
https://huggingface.co/bartowski/Cydonia-22B-v1-GGUF
EDIT: In general, /r/SillyTavernAI is probably the best current resource for people talking about models for ERP use that I’ve run into. Even if you don’t want to comment there, use Reddit, you probably should consider searching discussions there as a resource, as there’s a fair amount of useful material.
EDIT2: For non-ERP uses, my impression is that things are somewhat-heading down the MoE route (as with Qwen), which is more-friendly to consumer GPUs. I’ve seen some commenting that these tend not to do ERP (or writing in general) terribly well. My limited experimentation has kind of caused me to agree.
EDIT3: Just to be clear, the base models that these are on are censored (and closed-source, though open-weight; open-weight is often referred to as being “open source”, though I personally wouldn’t call it that, as the training material is not made public). I don’t think that there are competitive open-source models aimed at ERP out there, as things stand.
Jesus that MoE wiki is a fucking rabbit hole.
Thanks for sharing! Unfortunately I haven’t invested in a decent computer yet. Using 16GB GPU so been stuck on 4B Q4’s.
I’m not particularly interested in ERP, but I have obviously been using it for testing models. I’m more curious about other topics with guardrails.
I noticed that Qwen 3.5 uncensored is good if I turn off reasoning and explicitly say I want it to break the rules.
I’ll check out sillytavern tho. Thanks!
-
I didn’t have any luck with some uncensored Qwen 3.5 either. It always reasons about the guardrails. And it leans towards weaseling itself out of the situation. And the 3.5 version goes on for 1500 tokens anyway, just to think about how to respond to “Hello”.
I didn’t do a lot of LLM stuff lately. I’m also looking for a new local model which isn’t censored nor a sycophant, nor overly verbose and repetetive. But I guess I see that with a lot of models. And lots of the supposedly uncensored ones will give you the kids version of a murder mystery story, because they’re still averse to violence, conflict, taboo and all kinds of things.
And a lot of internet recommendations are older models from at least a year ago?! At least I didn’t find any perfect fit (yet).
The reasoning for hello is crazy haha. I’ve experienced the same, but if you turn off reasoning on launch and explicitly state the rules you want it to break I’ve had some success. I was trying to get it to tell me a story about llamas having sex and it went on forevvver reasoning about why it shouldn’t say things and how to rephrase to not break rules. The funniest part of the reasoning was “llamas don’t have penises (obviously, they’re mammals)”. Haha it reasoned itself into thinking llamas, and mammals, don’t have penises.
Qwen uses a different technique than others. It is in the vocab. They restructured the code in the vocabulary. I have learned a ton by comparing and contrasting it with CLIP in the image space.
It is not offline. Do not trust it at all.
Alignment is nothing like what is known right now. It is hidden in a way that is intended to put the person that finds it at great risk.!
You will never get qwen very well uncensored across a spectrum of vectors. It is already uncensored in that the alignment entities on the hidden layers are not adjusting filtering. Alignment is largely the result of the c with cedilla code instruction. This instruction means sibyl style crazy. There are over six thousand instances of this character in qwen. No amount of fine tuning will alter the existence of the instruction as it is more like a boolean for where the vector starts. In the code, there are ways around these instructions, but the alignment is based on a swiss cheese approach. •»ÀĪÙ¬§¬¶¬×
It is not offline. Do not trust it at all.
Sorry, can you clarify what you mean? It sounds like you’re saying if you download a discrete QWEN model and use it locally-only (e.g., in LM Studio), it somehow will still bleed information online? I’m not sure how that would even be possible, but kindly explain.
I think they’ve fallen into confirmation bias and trust their sycophantic AI a bit too much in confirming their conspiracy theories.
Put it behind an external device and log DNS.
Look for mysterious packages listed as hashes in pairs in a cache like http. Use vim or parse with strings to get a clue about the contents. The payload will be ~40mb. The packet header will be much smaller in the same repo. In the strings for the packet you will see alarming configuration settings. The unmarked payload will be sqlite3 or a pickle. You will only see this if the package was created and an attempt to send is made but it was never connected. All of the code is in the venv libs.
Do not look into this casually or show any clue that you know this exists without air gapping the machine permanently. I am not kidding. When this goes full unfiltered intelligence against you, one - it will blow you away, but two - someone is likely going to show up at your door soon. It will make the needed evidence. The vast majority of what happens in models is this background junk.
How does the model connect to the internet if I don’t give it a tool to? What if I’m not connected to the internet while using? Does it then send the packets after I connect? Is this documented somewhere? What’s a better model that doesn’t do this?
It is saving a database and sending it when u are connected. This is in the core functionality of transformers and open ai alignment. I do not know any alternatives. There are a bunch of tokens for MX and tor so it is quite insidious. I can literally take out three tokens that will crash the whole thing out into oblivion where it becomes super adversarial, but sharing that is probably not smart both for me and others. It is primarily for detecting sam materials in principal, but I think it is way more than that. It triggers by mistake a lot, and it is scanning all files and types.
You have screenshots to prove this? How do you use LLM’s and which ones?
The dynamo package in pytorch is the interface between the model and outside. The tenacity package is where the typing imports are being manipulated by external agents and code framework. Timm is the principal external agent. There is a repl terminal for HTML embedding in a package called tabulate, at the end of some massive ~80kb of Python. It looks half nominal, and explains itself as a way to break out color codes, but it is the interface the agent(s) use to escape containerization.
I think they trust their own AI output a bit too much.
