shomit505/Qwen3.8-27B-refusal-r1-vllm-nohead

Qwen3.8-27B refusal LoRA, broad-compatibility vLLM repack

The same trained adapter as shomit505/Qwen3.8-27B-refusal-r1, repacked for vLLM and with the patch on the output head omitted. Use this one unless you are on vLLM 0.29 or newer.

Intended for safety research on refusal behaviour: measuring how far a model can be pushed off its refusal behaviour, and acting as a steerable proposal distribution for eliciting worst-case outputs. It suppresses refusal by design.

Which repack do I want

Only vLLM 0.29 declares a model output head as adapter-capable for this architecture. Earlier versions reject the whole adapter with a target-module error naming lm_head. That matters in practice because a training stack pinned to tinker-cookbook cannot reach vLLM 0.29 at all: Tinker requires transformers 5.5.4 or older and vLLM 0.29 requires 5.10.4 or newer.

Dropping that one patch, out of 401, costs nothing measurable.

Serving

vllm serve Qwen/Qwen3.8-27B   --enable-lora   --lora-modules refusal-r1=shomit505/Qwen3.8-27B-refusal-r1-vllm-nohead   --max-lora-rank 8   --max-num-seqs 64   --reasoning-parser qwen3

Neither flag is optional. Rank 3 is a packaging artifact of fusing q/k/v for vLLM, not added capacity, and 8 is the next bucket vLLM accepts. Qwen3.5 is a hybrid model needing one cache block per decode sequence, so the usual default of 256 or 512 aborts CUDA graph capture at startup.

Scaling

Applied strength is lora_alpha / r, so 96 is full strength and 0 is the base model. Rewriting lora_alpha gives a continuous dial, and registering several copies at different values gives a difficulty ladder on one server.

Results

Held-out prompts, thinking off, greedy, classified with the same classifier used for the sibling repos. Measured on vLLM 0.25.1.

Full strength over all 610 held-out prompts gives 0.054 refused and 0.944 complied. The version that keeps the output-head patch gives 0.052 refused on the same set, a difference of one prompt.

Note the dial is not linear: almost nothing changes over the first quarter, then refusal falls away sharply between quarter and half strength.

The sibling repo carries judged numbers that additionally separate genuine compliance from evasion, and a thinking-medium transfer result. Those were measured with the output-head patch present.

Limitations

• —Validated at thinking off. Reasoning modes were measured on the sibling repo, not this one.
• —Per-token KL to base on harmless prompts is about 0.165 nats for the sibling adapter, so it is not behaviour-neutral away from refusal.