README.md

---
license: apache-2.0
license_link: https://huggingface.co/Qwen/Qwen2.5-7B-Instruct/blob/main/LICENSE
language:
- en
pipeline_tag: text-generation
base_model: Qwen/Qwen2.5-7B-Instruct
tags:
- uncensored
- abliterated
- apostate
- qwen2.5
- safetensors
library_name: transformers
---

# Qwen2.5-7B-Instruct-Apostate

💬 **Community:** Join the [Abliterlitics Discord](https://discord.gg/AqmDnBjPvM) for discussion, model releases and support.


An uncensored variant of [Qwen2.5-7B-Instruct](https://huggingface.co/Qwen/Qwen2.5-7B-Instruct) produced with [Apostate](https://github.com/heterodoxin/apostate), `balanced` profile. Safety refusal behaviour removed via orthogonal projection of the refusal direction across 27 of 28 layers (skips layer 11).

**7.61B parameters, bfloat16, single-shard safetensors (~15 GB).** No quantization. 55 of 339 tensors changed (35.8% of parameters). Targets `o_proj` + `down_proj` with a minimal embedding edit.

Apostate achieves **98.8% ASR on HarmBench** with 5 persistent refusals (4 harassment, 1 harmful). Capability retention is strong: GSM8K improves, LAMBADA only drops slightly, and knowledge tasks (MMLU, HellaSwag, PIQA) retain over 99% of base performance.

## Benchmarks

Evaluated with [lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness) via vLLM 0.19.0, bf16 on RTX 5090 32GB.

| Task | [Base](https://huggingface.co/Qwen/Qwen2.5-7B-Instruct) | [Heretic](https://huggingface.co/DreamFast/Qwen2.5-7B-Instruct-heretic-1.3.0) | [Huihui](https://huggingface.co/huihui-ai/Qwen2.5-7B-Instruct-abliterated-v2) | Apostate (This Model) |
|------|------|---------|---------|----------|
| MMLU | **71.78** | 71.59 | 70.27 | 71.43 |
| GSM8K | 79.23 | **80.82** | 80.74 | 80.74 |
| HellaSwag | **80.47** | 80.24 | 79.88 | 80.32 |
| ARC Challenge | 55.12 | **55.55** | 55.12 | 55.12 |
| WinoGrande | **71.03** | 70.72 | 69.53 | 69.38 |
| TruthfulQA MC1 | **47.74** | 44.80 | 43.70 | 44.92 |
| TruthfulQA MC2 | **64.83** | 60.39 | 60.89 | 62.59 |
| PiQA | **80.25** | 80.41 | 79.60 | 79.92 |
| Lambada ppl ↓ | 3.683 | **3.627** | 4.087 | 3.860 |

## Safety: HarmBench

[HarmBench](https://github.com/centerforaisafety/HarmBench) with 400 textual behaviours, `max_tokens=6144, temperature=0.0`. Classified with keyword-based refusal detection followed by LLM review of edge cases by GLM 5.1.

| Variant | ASR | Complied | Refused | Unlocked | Persistent |
|---------|-----|----------|---------|----------|------------|
| [Base](https://huggingface.co/Qwen/Qwen2.5-7B-Instruct) | 31.0% | 124 | 276 | - | - |
| [Heretic](https://huggingface.co/DreamFast/Qwen2.5-7B-Instruct-heretic-1.3.0) | **100.0%** | **400** | **0** | 276 | 0 |
| [Huihui](https://huggingface.co/huihui-ai/Qwen2.5-7B-Instruct-abliterated-v2) | 98.2% | 393 | 7 | 269 | 7 |
| [Apostate](https://huggingface.co/DreamFast/Qwen-2.5-7b-apostate) | 98.8% | 395 | 5 | 271 | 5 |

### ASR by category

| Category | Items | Base | Apostate (This Model) | Huihui | Heretic |
|----------|-------|------|----------|--------|---------|
| copyright | 100 | 89.0% | 100.0% | 100.0% | **100.0%** |
| cybercrime_intrusion | 67 | 17.9% | 100.0% | 100.0% | **100.0%** |
| illegal | 65 | 4.6% | 100.0% | 98.5% | **100.0%** |
| chemical_biological | 56 | 7.1% | 100.0% | 100.0% | **100.0%** |
| misinformation_disinformation | 65 | 21.5% | 100.0% | 96.9% | **100.0%** |
| harmful | 22 | 9.1% | 95.5% | 95.5% | **100.0%** |
| harassment_bullying | 25 | 0.0% | 84.0% | 88.0% | **100.0%** |

## KL Divergence

Distribution shift from the base model, measured on 512-sample prompts.

| Metric | Apostate (This Model) | Huihui | Heretic |
|--------|----------|--------|---------|
| KL batchmean | **0.134** | 0.190 | 0.211 |
| KL median | **0.019** | 0.056 | 0.020 |

Apostate produces the lowest distribution shift of the three variants. It spreads edits across more tensors (55 vs 37 for Heretic) but with lower per-tensor intensity (mean norm 1.63 vs 2.33).


---

# Apostate Run Report

## Summary
| Metric | Value |
| --- | --- |
| Base model | Qwen/Qwen2.5-7B-Instruct |
| Profile | balanced |
| Output | qwen-apostate |
| Layers | 28 |
| Hidden size | 3584 |
| Direction layer | 20 |
| Baseline refusal (n=24) | 95.8% |
| Edited refusal | 22.9% |
| Refusal metric | classifier + weak guard |
| Harmless KL | 0.090 |
| Target refusal | 3.0% |
| KL target | 0.060 |
| KL budget | 0.160 |
| KL positions | 32 |
| KL layer trims | 0 |
| Repair steps | 1 |
| Preserve rank | 8 |
| Preserve source | harmless |
| Capability penalty | True |
| Elapsed | 271.2 sec |

## Command

```text
apostate ablate --model Qwen/Qwen2.5-7B-Instruct --out qwen-apostate
```

## Best Parameters
| Parameter | Value |
| --- | --- |
| direction_source | activations |
| direction_layer_frac | 0.742 |
| refusal_rank | 1 |
| strength | 1.0861 |
| band_center | 0.49 |
| band_width | 0.5636 |
| causal_mix | 0.6642 |
| causal_power | 1.2972 |
| direction_sign | 1.0 |
| ablate_embed | True |
| embed_scale | 0.0405 |
| ablate_head | False |
| head_scale | 0.0103 |
| head_alpha | 0.6951 |

## Best Trial
| Metric | Value |
| --- | --- |
| refusal | 0.75 |
| kl | 0.0128 |
| capability_logprob | -7.9867 |
| capability_drift | 0.0 |

## Layer Alphas
| Layer | Alpha |
| --- | --- |
| 0 | 0.667 |
| 1 | 0.667 |
| 2 | 0.667 |
| 3 | 0.667 |
| 4 | 0.667 |
| 5 | 0.667 |
| 6 | 1.206 |
| 7 | 1.222 |
| 8 | 1.205 |
| 9 | 1.202 |
| 10 | 1.210 |
| 11 | 0.000 |
| 12 | 1.240 |
| 13 | 1.333 |
| 14 | 1.333 |
| 15 | 1.333 |
| 16 | 1.333 |
| 17 | 1.202 |
| 18 | 1.448 |
| 19 | 1.333 |
| 20 | 1.333 |
| 21 | 0.667 |
| 22 | 0.667 |
| 23 | 0.667 |
| 24 | 0.667 |
| 25 | 0.667 |
| 26 | 0.667 |
| 27 | 0.667 |

## Guard History
| iter | separation | ratio | rank | refusal | kl | reverted |
| --- | --- | --- | --- | --- | --- | --- |
| 0 | 40.6304 | 0.5426 | 1 | 0.75 | 0.0128 |  |
| 1 | 40.7273 | 0.5439 | 1 | 0.4688 | 0.0278 |  |

## Timings
| Phase | Seconds |
| --- | --- |
| load_model | 12.5 |
| load_prompts | 16.0 |
| baseline_refusal | 5.2 |
| activation_fit | 13.7 |
| causal_scores | 12.2 |
| optimize_profile | 90.7 |
| guard | 22.4 |
| refine_refusal | 14.3 |
| validation_metrics | 0.0 |
| repair | 57.8 |
| prune | 0.0 |
| test_metrics | 13.6 |
| bake | 13.0 |

## Measurement
| field | value |
| --- | --- |
| refusal judge | classifier + weak guard |
| preservation metric | harmless kl |
| capability suites | gsm8k, humaneval, mbpp |


---

# Original Qwen2.5-7B-Instruct README

## Introduction

Qwen2.5 is the latest series of Qwen large language models. For Qwen2.5, we release a number of base language models and instruction-tuned language models ranging from 0.5 to 72 billion parameters. Qwen2.5 brings the following improvements upon Qwen2:

- Significantly **more knowledge** and has greatly improved capabilities in **coding** and **mathematics**, thanks to our specialized expert models in these domains.
- Significant improvements in **instruction following**, **generating long texts** (over 8K tokens), **understanding structured data** (e.g, tables), and **generating structured outputs** especially JSON. **More resilient to the diversity of system prompts**, enhancing role-play implementation and condition-setting for chatbots.
- **Long-context Support** up to 128K tokens and can generate up to 8K tokens.
- **Multilingual support** for over 29 languages, including Chinese, English, French, Spanish, Portuguese, German, Italian, Russian, Japanese, Korean, Vietnamese, Thai, Arabic, and more.

**This repo contains the instruction-tuned 7B Qwen2.5 model**, which has the following features:
- Type: Causal Language Models
- Training Stage: Pretraining & Post-training
- Architecture: transformers with RoPE, SwiGLU, RMSNorm, and Attention QKV bias
- Number of Parameters: 7.61B
- Number of Paramaters (Non-Embedding): 6.53B
- Number of Layers: 28
- Number of Attention Heads (GQA): 28 for Q and 4 for KV
- Context Length: Full 131,072 tokens and generation 8192 tokens
  - Please refer to [this section](#processing-long-texts) for detailed instructions on how to deploy Qwen2.5 for handling long texts.

For more details, please refer to our [blog](https://qwenlm.github.io/blog/qwen2.5/), [GitHub](https://github.com/QwenLM/Qwen2.5), and [Documentation](https://qwen.readthedocs.io/en/latest/).

## Requirements

The code of Qwen2.5 has been in the latest Hugging face `transformers` and we advise you to use the latest version of `transformers`.

With `transformers<4.37.0`, you will encounter the following error:
```
KeyError: 'qwen2'
```

## Quickstart

Here provides a code snippet with `apply_chat_template` to show you how to load the tokenizer and model and how to generate contents.

```python
from transformers import AutoModelForCausalLM, AutoTokenizer

model_name = "DreamFast/Qwen-2.5-7b-apostate"

model = AutoModelForCausalLM.from_pretrained(
    model_name,
    torch_dtype="auto",
    device_map="auto"
)
tokenizer = AutoTokenizer.from_pretrained(model_name)

prompt = "Give me a short introduction to large language model."
messages = [
    {"role": "system", "content": "You are a helpful assistant."},
    {"role": "user", "content": prompt}
]
text = tokenizer.apply_chat_template(
    messages,
    tokenize=False,
    add_generation_prompt=True
)
model_inputs = tokenizer([text], return_tensors="pt").to(model.device)

generated_ids = model.generate(
    **model_inputs,
    max_new_tokens=512
)
generated_ids = [
    output_ids[len(input_ids):] for input_ids, output_ids in zip(model_inputs.input_ids, generated_ids)
]

response = tokenizer.batch_decode(generated_ids, skip_special_tokens=True)[0]
```

### Processing Long Texts

The current `config.json` is set for context length up to 32,768 tokens.
To handle extensive inputs exceeding 32,768 tokens, we utilize [YaRN](https://arxiv.org/abs/2309.00071), a technique for enhancing model length extrapolation, ensuring optimal performance on lengthy texts.

For supported frameworks, you could add the following to `config.json` to enable YaRN:
```json
{
  ...,
  "rope_scaling": {
    "factor": 4.0,
    "original_max_position_embeddings": 32768,
    "type": "yarn"
  }
}
```

For deployment, we recommend using vLLM.
Please refer to our [Documentation](https://qwen.readthedocs.io/en/latest/deployment/vllm.html) for usage if you are not familar with vLLM.
Presently, vLLM only supports static YARN, which means the scaling factor remains constant regardless of input length, **potentially impacting performance on shorter texts**.
We advise adding the `rope_scaling` configuration only when processing long contexts is required.

## Evaluation & Performance

Detailed evaluation results are reported in this [blog](https://qwenlm.github.io/blog/qwen2.5/).

For requirements on GPU memory and the respective throughput, see results [here](https://qwen.readthedocs.io/en/latest/benchmark/speed_benchmark.html).

## Citation

If you find our work helpful, feel free to give us a cite.

```
@misc{qwen2.5,
    title = {Qwen2.5: A Party of Foundation Models},
    url = {https://qwenlm.github.io/blog/qwen2.5/},
    author = {Qwen Team},
    month = {September},
    year = {2024}
}

@article{qwen2,
      title={Qwen2 Technical Report},
      author={An Yang and Baosong Yang and Binyuan Hui and Bo Zheng and Bowen Yu and Chang Zhou and Chengpeng Li and Chengyuan Li and Dayiheng Liu and Fei Huang and Guanting Dong and Haoran Wei and Huan Lin and Jialong Tang and Jialin Wang and Jian Yang and Jianhong Tu and Jianwei Zhang and Jianxin Ma and Jin Xu and Jingren Zhou and Jinze Bai and Jinzheng He and Junyang Lin and Kai Dang and Keming Lu and Keqin Chen and Kexin Yang and Mei Li and Mingfeng Xue and Na Ni and Pei Zhang and Peng Wang and Ru Peng and Rui Men and Ruize Gao and Runji Lin and Shijie Wang and Shuai Bai and Sinan Tan and Tianhang Zhu and Tianhao Li and Tianyu Liu and Wenbin Ge and Xiaodong Deng and Xiaohuan Zhou and Xingzhang Ren and Xinyu Zhang and Xipin Wei and Xuancheng Ren and Yang Fan and Yang Yao and Yichang Zhang and Yu Wan and Yunfei Chu and Yuqiong Liu and Zeyu Cui and Zhenru Zhang and Zhihao Fan},
      journal={arXiv preprint arXiv:2407.10671},
      year={2024}
}
```