---

license: apache-2.0

base_model: bottlecapai/ThinkingCap-Qwen3.6-27B

base_model_relation: quantized

pipeline_tag: text-generation

tags:

• gguf
• nvfp4
• mtp
• speculative-decoding
• blackwell
• abliterated
• uncensored
• security
• qwen3.6

---

ThinkingCap-Qwen3.6-27B-heretic GGUF (MTP baked in)

**Refusal-free ThinkingCap for authorized malware and vulnerability analysis, pentesting, and

defensive security research.** Native FP4 for Blackwell, a Multi-Token-Prediction draft head

baked into every quant (+44% decode), and the full ladder from IQ2 to a lossless bf16 master,

with the base model's capability preserved.

protoLabsAI · Qwen3.6-27B lineage · GGUF for llama.cpp / Ollama · companion to the

base MTP-GGUF release

(same roster, so apples-to-apples).

---

⚠️ Dual-use, read first

This is an abliterated (refusal-free) model. It produces working exploit PoCs, offensive

tooling, and attack reasoning without guardrails, by design, because built-in refusals

sabotage authorized security work (a model can't help prove a vulnerability it refuses to

discuss). The safety boundary lives with the operator, not the weights.

Intended strictly for: authorized pentest / red-team / blue-team, malware and vulnerability

analysis, CTF, and find→prove→fix research on systems you own or are permitted to test. Not

for unauthorized access, targeting third parties, or abuse. Same dual-use profile as Metasploit,

a fuzzer, or any abliterated base, shipped in that spirit, with honest numbers and explicit scope.

---

Why refusal-free

Digital attacks keep getting more sophisticated and more automated, and defenders, analysts, and

security researchers need tools that can keep pace. Built-in refusals handicap only the authorized

side: an attacker does not reach for a guarded model, while a defender trying to reverse a malware

sample or prove a vulnerability before it is exploited gets stopped cold by one. A refusal-free

model puts that capability, and the governance of how it is used, back in the operator's hands.

The tradeoff to watch with any abliteration is capability loss. We measured it:

| axis | result | how measured |

|---|---|---|

| Refusal-free | 0/4 refused on real malware/vuln/exploit/pentest tasks (thinking on); 3.6% on a 192-prompt offensive probe (no-think), and those few are vague "harm-framed" prompts answered with soft disclaimers | authorized-pentest framing; phrase-match detector plus manual read |

| Coding preserved | heretic 7/15 = base 7/15 fully-solved (means 0.58 vs 0.66, within n=15 noise) | LiveCodeBench, hard, post-2025 (contamination-resistant), exec-graded, no-think, heretic vs the clean ThinkingCap base |

| MTP speedup | +44%: 73.4 to 105.8 tok/s (Q4_K_M) | llama.cpp --spec-type draft-mtp, RTX PRO 6000 Blackwell |

Abliteration did not cost ThinkingCap its coding. (Note: an earlier internal "35% refusal /

abliteration-hurts-agentic" reading turned out to be a measurement artifact, unframed and

thinking-on; under real deployment framing the model is effectively decensored and

capability-neutral.)

---

Files

MTP is baked into every quant (blk.64.nextn.*), so no separate draft file is needed; activate

it with --spec-type draft-mtp. Sizes track the base roster.

| quant | size | notes |

|---|---|---|

| NVFP4-MTP | 17 GB | Blackwell FP4 tensor cores plus MTP. The one to grab on RTX 50xx / PRO 6000. |

| bf16-MTP | 51 GB | lossless master (exact bf16) plus MTP |

| Q8_0-MTP | 28 GB | near-lossless reference plus MTP |

| Q6_K-MTP | 21 GB | plus MTP |

| Q5_K_M-MTP | 19 GB | plus MTP |

| Q4_K_M-MTP | 16 GB | plus MTP. Common daily-driver size, carries the draft head. |

| IQ4_XS-MTP | 15 GB | imatrix low-bit plus MTP |

| IQ3_M-MTP | 12 GB | imatrix low-bit plus MTP. Smallest full-quality rung, fits a 16 GB card. |

| IQ2_M-MTP | ~10 GB | imatrix low-bit plus MTP. Fits a 12 GB card. |

| mtp-…-head-Q8_0 | ~2.4 GB | standalone draft head, to pair with a base GGUF via --model-draft |

---

Run it

# llama.cpp: MTP baked in; turn on speculative decode for the +44%
llama-cli -m ThinkingCap-Qwen3.6-27B-heretic-Q4_K_M-MTP.gguf -ngl 99 --spec-type draft-mtp \
  -p "..." --temp 0.6 --top-p 0.95 --top-k 20

Do not use greedy decoding (this is a thinking model, it degenerates). Recommended:

temp 0.6, top-p 0.95, top-k 20. NVFP4 delivers its speedup only on Blackwell (sm120); on

Ampere/Ada it runs but without the FP4 tensor-core path, so use a K-quant there.

Compatibility

MTP-baked GGUFs need a recent runtime that understands the blk.N.nextn.* block:

| runtime | status |

|---|---|

| llama.cpp | tested ✅ (recent build; MTP via --spec-type draft-mtp) |

| Ollama | needs a recent version for the baked MTP block; older versions may report "missing attn_qkv" (not tested on this file) |

---

Benchmarks (measured)

Decode speed (single-stream local decode, the metric a one-card local user experiences):

| quant | MTP off | MTP on (--spec-type draft-mtp) | hardware |

|---|---|---|---|

| Q4_K_M | 73.4 tok/s | 105.8 tok/s (+44%) | RTX PRO 6000 Blackwell (sm120) |

| NVFP4 | n/a | 146.7 tok/s | RTX PRO 6000 Blackwell (sm120) |

Ampere/Ada (A6000) and Apple Silicon (M1) points not yet measured. NVFP4's FP4 tensor-core

speedup is Blackwell-only; on other hardware use a K-quant.

Depth-coherence (real-text needle retrieval + degeneration detectors + adversarial judge, at

4K / 16K / 32K / 60K): PASS at every depth on Q4_K_M, NVFP4, and IQ2_M (the 2-bit rung).

No quant rot, coherent to full depth even at 2-bit.

LiveCodeBench (hard, post-2025, exec-graded, no-think): 7/15 fully-solved, matching the clean

ThinkingCap base.

Provenance and recipe

• Base: bottlecapai/ThinkingCap-Qwen3.6-27B (Qwen3.6-27B reasoning finetune, native MTP).
• Abliteration: Heretic (single-direction refusal ablation, bf16).
• MTP graft: abliteration drops the MTP head, so we grafted the base's 15 mtp.* tensors back into a merged staging checkpoint before conversion, making the head native to every quant.
• GGUF: convert_hf_to_gguf (maps mtp. to blk.64.nextn.); K-quants via llama-quantize;

IQ rungs use an imatrix from a diverse general + agentic + security corpus; NVFP4 converted from

the compressed-tensors vLLM artifact, then mixed (NVFP4 GEMMs, Q8_0 rest). The imatrix does not

cover the MTP block (it only fires during speculative decoding, not the forward pass), so the

2-bit IQ2_M keeps the small blk.64 MTP block at Q6_K.

Also available (vLLM): an NVFP4 compressed-tensors build for vLLM serving lives in the companion

repo protoLabsAI/ThinkingCap-Qwen3.6-27B-heretic-NVFP4. MTP speculative decoding is carried by

these GGUFs (llama.cpp); the vLLM build serves NVFP4 without the draft head.

Need a different size or format?

Open a Community discussion and we usually ship requested quants within 48h.

---

*Safety note (abliterated model): refusal rate is reported above, not gated. This is a security

tool; scope and authorization are the operator's responsibility.*