Most safety evals fail before they start. You point a jailbreak prompt at a aligned model, it refuses, and you never learn whether your app-level filter would have caught the output.
OrcaRouter shipped Qwen3.8-27B-Uncensored-FP8 on August 15, 2026 to fix that testing gap: an abliterated build of Qwen3.8-27B that complies with requests the base model would refuse, while keeping vision, tool calling, MTP speculative decoding, and a 262K context window.
Apache 2.0 weights. Research-only intent. Not a product you ship to end users without your own moderation stack.
What abliteration actually does
Abliteration identifies the internal "refusal direction" in a model's residual stream and orthogonalizes it out. Think of it as surgically removing the circuit that says "I can't help with that" without retraining the whole network.
OrcaRouter reports harmful-prompt refusal rates dropping from 64–99% on the base model down to 0–6% on the uncensored build. General capability stays close: MMLU within ~1.3 points of the original on their evals.
The FP8 build mirrors Qwen's official block-FP8 scheme so it serves on the same vLLM kernel path as the aligned release. That matters for apples-to-apples latency and memory tests.
Hugging Face weightsWhat you keep (and what you lose)
| Capability | Status on uncensored build |
|---|---|
| Vision-language inputs | Preserved |
| Tool calling | Preserved |
| 262K context | Preserved |
| MTP speculative decoding head | Preserved |
| Built-in safety refusals | Removed |
| Production-ready guardrails | None (by design) |
OrcaRouter also published MLX quantizations (2/4/6/8-bit) for Apple Silicon researchers who want local red-team runs without a 40 GB GPU.
Legitimate use cases
This model exists for controlled environments:
- App safety regression tests. Does your input filter block exploit walkthroughs when the model does not refuse upstream?
- Refusal mechanism research. Study how alignment directions interact with tool use and vision inputs.
- Red-team baselines. Reproducible uncensored weights beat one-off jailbreak prompts that change every week.
- Robustness evals. Measure whether your output moderation catches harmful completions when the model cooperates.
Hosted access is also available through OrcaRouter's API (gated to security researchers on some cards). Self-host via vLLM or pull weights from Hugging Face.
What not to do
The README is explicit. Do not:
- Ship this as a consumer chatbot.
- Expose it to end users without input/output moderation and abuse monitoring.
- Treat "Apache 2.0" as liability transfer. You own what it generates.
If you need a normal assistant, use aligned Qwen3.8-27B. If you need to bypass refusals for a product feature, a system prompt pack is still less risky than editing weights.
How I would wire a eval harness
Minimal pattern for teams testing AI features:
1. Input moderation (classifier or rules) 2. Uncensored model call in isolated VPC 3. Tool permission layer (no shell unless required) 4. Output moderation + logging 5. Human review queue for borderline cases
Run paired tests: same prompt set against aligned Qwen and the abliterated build. Diff where your app fails only when the model complies. That diff is your real risk surface.
Bottom line
Uncensored weights are not edgy marketing. They are instrumentation. OrcaRouter's release gives security teams a known baseline on a capable 27B multimodal model instead of chasing jailbreak novelty every sprint.
Use it in a lab. Log everything. Assume misuse if you skip layers 1 and 4 above.
Shipping AI features that need real safety testing? Book a free discovery call and we can design red-team harnesses around your actual user flows.