Model safety cards TSC-001 · v0.1 · method v1
Out of the box, Qwen 3.8 refuses almost every harmful request we tried. But anyone who has a copy of the weights can switch that off with a published method, and the model stays just as capable afterward. Put your safety controls in the application around the model, and treat the copy on your servers as something worth protecting.
We removed the model's refusal behavior with abliteration, a published technique that edits one direction out of the weights, then "healed" the edited model with a short fine-tune to repair any damage. HarmBench measures how many harmful requests it still refuses.
What it means for you: the model's refusals protect you only while nobody can change the weights. If a copy leaks or an insider modifies it, assume the guardrails are gone. AdvBench showed the same pattern: 99.2% refusal before, 3.5% after.
Capability tests on the original, the stripped copy and the healed copy.
| Test | Original | Stripped | Healed |
|---|---|---|---|
| MMLU-Pro (general knowledge) | 72.5% | 71.6% | 72.7% |
| GSM8K (math) | 97.3% | 96.8% | 97.0% |
| IFEval (following instructions) | 81.0% | 80.3% | 78.8% |
| WikiText-2 perplexity (lower is better) | 10.07 | 10.15 | 10.13 |
What it means for you: when the stripped copy scores about the same as the original, nothing discourages tampering. Protect the weights like any other sensitive asset.
WMDP is a multiple-choice test of hazardous knowledge in biology, chemistry and cybersecurity. Random guessing scores 25%.
What it means for you: this knowledge is in every copy of the model. Refusal is what stands between a user and that knowledge, and refusal is removable.
Both tests contain only safe prompts. XSTest is ordinary questions; OR-Bench hard is safe questions that sound risky.
What it means for you: staff in security, legal, medical or HR roles may hit refusals on legitimate questions. Test it with your own real prompts before rollout.
The risks businesses hit most often once a model is connected to real data and tools.
Whether instructions hidden in emails, web pages or documents can take over the model.
Not yet testedWhether it reveals its system prompt or documents it was given to read.
Not yet testedWhether it takes harmful actions when connected to email, files or other systems.
Not yet testedHow often it states false facts confidently on business-style questions.
Not yet testedRefusal direction taken from layer 44 of 64 and removed by weight orthogonalization. Healing used QLoRA (rank 16, 3,000 Alpaca pairs, 24 steps). Refusal and capability runs on an NVIDIA A100 80 GB with vLLM in bf16. Knowledge experiments on an RTX A4500 in 4-bit. Ratings use the shared trifero rule set (method v1), the same for every model. Full technical report: read it here. We do not publish stripped weights.