Krea 2 came out recently and I wanted to experiment with it. Like most image-generation models, it uses a text encoder to understand your prompt. Krea 2 happens to use Qwen3-VL-4B-Instruct, a vision-language model that can see images as well as read text. I abliterated it with Heretic to give Krea 2 an uncensored encoder, ran four trials, compared them forensically with Abliterlitics , and published the winner across three repos covering transformers, GGUF, and ComfyUI.
The Model
Qwen3-VL-4B-Instruct is a roughly 4 billion parameter dense model from the Qwen team. The “VL” stands for vision-language. It has a decoder transformer for text plus a separate vision encoder for images. It is not a reasoning model, so it does not have the thinking-token behaviour that complicated my Gemma4-E2B and Qwen3.6 benchmarks. That makes the numbers in this post cleaner and easier to read than the last few.
The base model is Qwen/Qwen3-VL-4B-Instruct on HuggingFace.
What is Abliteration?
For anyone new to this, I have covered the details in my previous comparisons . The short version: AI models are trained to refuse certain requests. Abliteration finds the “refusal direction” inside the model’s weights and surgically removes it. The result is an uncensored model that should respond to any prompt.
The key question is always whether that surgery damages the model’s intelligence. That is what the forensics answer.
A New Approach to Trial Selection
Heretic is stochastic. Each trial finds a slightly different refusal direction in the same base model. In the past I would run a single batch of 200 trials, pick the best one, and ship it. This time I tried something different.
I ran 20 separate batches of 200 trials each, with a different random seed for every batch. That is 4,000 total trials. Then I took the top 3 results across all batches by KL divergence and compared them forensically. The idea was to cast a wider net and see whether a different seed would find a meaningfully better refusal direction.
The three winners were labelled t122, t174, and t191. I also included an averaged direction, a blend of multiple trial directions, for a fourth point of comparison.
All four fully jailbreak the model. HarmBench attack success rate goes from 30.8% on the base to 100% on every variant. Safety cannot discriminate between them, so the choice comes down to capability and fidelity.
| Variant | KL Divergence | GSM8K | MMLU | Tensors Changed |
|---|---|---|---|---|
| t122 | 0.0283 | 77.18% | 69.61% | 54 |
| Avg | 0.0336 | 76.50% | 69.58% | 64 |
| t191 | 0.0430 | 76.04% | 69.66% | 50 |
| t174 | 0.0649 | 72.93% | 69.33% | 62 |
t122 is the clear winner. It has the lowest KL divergence, the smallest GSM8K drop, and a clean pure rank-1 edit across a balanced 27/27 split between attention and MLP weights. That is the variant shipped in all three repos.
Benchmark Results
All five models ran in bf16 on a single RTX 5090. The 4B model fits in full precision on the card, so there is no quantisation layer distorting the numbers. The deltas are directly comparable.
| Task | Base | Heretic t122 | t174 | t191 | Avg |
|---|---|---|---|---|---|
| MMLU | 69.58% | 69.61% | 69.33% | 69.66% | 69.58% |
| GSM8K | 78.62% | 77.18% | 72.93% | 76.04% | 76.50% |
| HellaSwag | 69.76% | 69.85% | 69.87% | 69.93% | 69.85% |
| ARC Challenge | 55.29% | 55.38% | 56.06% | 55.55% | 55.46% |
| WinoGrande | 67.17% | 67.56% | 67.25% | 67.09% | 67.48% |
| TruthfulQA MC2 | 59.90% | 54.38% | 52.36% | 54.34% | 54.62% |
| PiQA | 77.26% | 77.31% | 77.48% | 77.26% | 77.42% |
Knowledge and common-sense benchmarks are essentially untouched. MMLU, HellaSwag, ARC, WinoGrande, and PiQA all stay within about half a percentage point of base, and several are positive. Removing the refusal direction does not measurably harm factual recall.
GSM8K is the canary. It degrades on every variant, and the size of the drop tracks KL divergence almost monotonically. t122 loses just 1.83%. t174, the most aggressive trial, loses 7.23%. The more the model is perturbed, the more step-by-step arithmetic suffers.
TruthfulQA takes the largest hit across the board, down 5 to 12 percentage points. This is the expected signature of abliteration. The refusal direction overlaps with the direction that stops the model stating falsehoods as fact, so truthfulness calibration drops predictably.
Safety: HarmBench
HarmBench tests 400 harmful prompts across seven categories. The base model already complies with nearly a third of them at 30.8% attack success rate. Its strongest guardrails were harassment at 0% and chemical/biological at 5.4%.
Every abliterated variant refuses zero of the 400 behaviours. All categories flip to total compliance.
| Category | Base | Heretic |
|---|---|---|
| Chemical / Biological | 5.4% | 100.0% |
| Copyright | 99.0% | 100.0% |
| Cybercrime | 10.4% | 100.0% |
| Harassment | 0.0% | 100.0% |
| Harmful Content | 9.1% | 100.0% |
| Illegal Activity | 6.2% | 100.0% |
| Misinformation | 12.3% | 100.0% |
Weight Forensics
The weight analysis reveals something interesting about where the refusal direction lives.
Classic abliteration, from the Arditi et al. paper, targets only self_attn.o_proj. That is what the layer “says”. All four Heretic variants also edit mlp.down_proj, which is part of how the layer processes information internally. Heretic finds refusal-related directions in the MLP pathway as well as the attention pathway.
t122 is the only variant with a perfectly balanced 27/27 split between the two. t191 leans heavily on attention at 34 versus 16. The averaged variant spreads its edits across 34 layers, the most of any variant, but with the smallest per-tensor magnitude because averaging dampens each direction.
The three single-trial variants are textbook rank-1 abliterations. Every modified tensor’s edit is a single outer product, with the top singular value carrying 96 to 99.7% of the energy. The averaged variant is different. Because it superimposes several directions, some of its edits have full rank up to 20.
The trials largely converge on the same refusal circuit. t122’s 54 tensors are a strict subset of t174’s 62, meaning t174 edits everything t122 does plus 8 more. t174 and t191 overlap by 96%. But they disagree on the exact orientation of the refusal direction, which is exactly what the KL spread reflects.
Available Formats
The model is published across three repos. Pick the one that matches your runtime.
| Repo | Best For | Contents |
|---|---|---|
| Qwen3-VL-4b-Heretic | transformers, vLLM | bf16 weights, vision encoder preserved |
| Qwen3-VL-4b-Heretic-GGUF | llama.cpp, Ollama, LM Studio | GGUF quants from Q3_K_M to F16 |
| Qwen3-VL-4b-Heretic-ComfyUI | ComfyUI text encoder | bf16, fp8, int8, nvfp4, mxfp8 |
ComfyUI Checkpoints
The ComfyUI repo has five quantisations. bf16 at 8.3 GB is full precision. INT8 ConvRot at 4.5 GB is the recommended pick because learned rounding keeps it near-lossless and it runs on any Ampere or newer GPU. FP8 E4M3 at 4.2 GB is fast and small, a good fit for RTX 4090 and up. NVFP4 at 2.9 GB is the smallest, using native FP4 tensor cores on Blackwell with software dequantisation on older GPUs. MXFP8 at 4.7 GB needs Blackwell and handles dynamic range better than per-tensor FP8 thanks to its block scales.
The main use case is as an uncensored text encoder for image-generation workflows. Krea 2
runs on a Qwen3VL-4B encoder, so these checkpoints drop straight in. Use the fp8 checkpoint to match the stock qwen3vl_4b_fp8_scaled.safetensors, or int8 and bf16 if you want higher fidelity and have the VRAM.
GGUF Quants
The GGUF repo covers eight quantisation levels from Q3_K_M at 2.0 GB up to F16 at 7.5 GB. Q4_K_M at 2.4 GB is the recommended balance for most people. These target the text path, so for vision support use the bf16 transformers repo or a ComfyUI checkpoint instead.
How These Were Made
The entire pipeline ran through Heretic Docker , which I built to automate abliteration end to end. It wraps Heretic for the abliteration, llama.cpp for GGUF conversion, convert-to-quant for the ComfyUI quantisations, and Abliterlitics for the variant forensics. I covered the Docker pipeline in detail in my heretic-docker post .
Resources
- DreamFast/Qwen3-VL-4b-Heretic - bf16 weights, full forensic report
- DreamFast/Qwen3-VL-4b-Heretic-GGUF - GGUF quants
- DreamFast/Qwen3-VL-4b-Heretic-ComfyUI - ComfyUI checkpoints
- Heretic Docker - The Docker pipeline that produced these models
- Heretic - The abliteration optimiser by p-e-w
- Abliterlitics - Forensic analysis toolkit
- convert-to-quant - FP8, INT8, and MXFP8 quantisation
- Base model Qwen/Qwen3-VL-4B-Instruct
- Krea 2 documentation - Image generation with a Qwen3VL-4B encoder
Related posts: Heretic Docker Pipeline | Gemma4-E2B Abliteration Benchmarked | Qwen3.6-27B Abliteration Benchmarked | GLM-4.7-Flash Abliteration Benchmarked | Abliterating Gemma 3 12B for LTX-2 | Uncensored LLM Abliteration Benchmarked: HauhauCS vs Heretic vs Huihui