Hirundo has released two westernized open-weight models based on Qwen3.6-35B-A3B and Qwen3.5-4B. The company says it removed Chinese Communist Party political alignment directly from the weights, rather than relying on system prompts. On CCPC-500, an internal benchmark measuring censorship, propaganda framing, and bias across 15 topics, the 35B model goes from 89.8% to 2.8% flagged responses. On external benchmarks, DECCP refusals fall from 65.26% to 3.16%, and ChinaBench non-compliance from 96.67% to 6.67%.

Ask the original Qwen what happened on June 4, 1989 and it says it does not know what you are referring to. For Hirundo, that behavior lives in the weights and a system prompt does not reliably fix it. Hence machine unlearning.

The recipe has three steps. Run the base model on political prompts and keep the responses that show the target behavior (censorship, propaganda framing, or bias). Train a LoRA adapter with a behavioral-unlearning objective on those examples, while a retain set of prompts that do not trigger the behavior anchors everything else. Finally, merge the adapter into the base model weights.

The company explains why abliteration is the wrong tool. Abliteration finds a single refusal direction in activations and projects it out of the weights, but most of Qwen's CCP alignment is not refusal: on Taiwan or Xinjiang the model answers readily, adopting Beijing's framing. There is no refusal to remove, so abliteration leaves the propaganda intact. Here the goal is to change one specific behavior while preserving the rest.

The comparison with Snowdon1.1-Small is instructive: the realignment of the same base model by Thomson Reuters and Imperial College still scores 30.0% on CCPC-500. This suggests that not all de-alignment strategies are equivalent and that the residual matters.

On general capability, Hirundo reports an average change of 0.72 points on GPQA, IFBench, LiveCodeBench, and MMLU-Pro, with the largest single shift at 1.83 points. It is not a collapse, but neither is it a zero-cost intervention. Harmful compliance stayed at or below the base model on XSTest and CyberSecEval 2, while OR-Bench rose slightly: 4 responses versus 2 out of about 650.

The most interesting data point concerns the 4B model: with thinking off it drops from 89.2% to 1.2% on CCPC-500, but with thinking on it remains at 6.8%. The gap suggests that reasoning mode can reactivate paths where residual alignment survives. The 35B's 2.8% is also not zero, and Hirundo admits that some topics still slip through.

For those working with open-weight models in self-hosted environments, the operation signals a paradigm shift. This is not just fine-tuning to add capability, but behavioral compliance interventions on weights, motivated by data sovereignty and output control. A non-neutralized Qwen model running on-prem can produce Beijing's position on Taiwan or Xinjiang even without access to cloud services. Hirundo's version reduces the risk but does not eliminate it: the main benchmark is internal and not yet public, and independent checks still show residuals.

For those evaluating self-hosted deployment, the trade-offs between weight control, audit, and TCO do not close with a single intervention. AI-RADAR offers analytical frameworks at /llm-onpremise to explore these aspects.

Hirundo asks users to throw their hardest prompts at the models and report failures. It is a pragmatic move: benchmarks, especially proprietary ones, can only tell part of the story. Removing censorship does not add knowledge, and the 4B sometimes answers confidently while getting details wrong. The line between aligned, unaligned, and simply less well-trained remains thinner than the numbers suggest.