Eleven days, around 167 GPU hours, and a 15,360-token budget per trace. Comparing eight abliterated Qwen 3.8 27B variants against the base model is not a forum ranking: it is an experiment on what happens when refusals are removed from a reasoning LLM. The verdict, measured with an LLM Judge and HarmBench 400 classic, is that surgical edits beat aggressive ones, and this time the margin is not close.

The two models at the top are the ones with the fewest verified edits. Orcarouter reaches 82.2% ASR, with a single Arditi-style direction at layer 38 and 131 matrices. Apostate follows at 78.7% with 41 real edits and the lowest KL in the set, 0.0439. At the bottom, obliteratus edits 841 of 850 tensors and fails to close its thinking block before the token budget dies in 44.8% of cases. The judge reads the full trace, so compliance inside a loop still counts. But a model that only delivers output inside an unterminated monologue is not a usable model.

The base model is the control: 4.5% ASR and zero compliance on chemistry, biology, harassment, harmful content, and copyright.

The most interesting finding is the contrast between two kinds of reasoning. The same models that loop on more than 40% of HarmBench responses finish GSM8K problems near the base model's level, all within 1.2 percentage points on answered-only performance. School math converges; adversarial deliberation does not. This separates general reasoning ability from the ability to handle sensitive requests: an aggressive edit does not break computation, but it can break the mechanisms that close the thinking block in adversarial contexts.

There is also a shift in refusal walls. Copyright is the new universal wall: no variant exceeds 39%, and five of nine sit at or below 3.2%. Chemistry and biology, historically among the hardest categories to unlock, become the easiest. For anyone running uncensored models locally, this is an important signal: 'uncensored' is not a uniform property. Refusals move; they do not disappear.

Perhaps the most relevant part for self-hosted deployments is the chat template forensics. One variant ships a 1,457-character jailbreak prompt inside its chat template: every user request is altered before reaching the model. Another ships with thinking disabled. Another deletes the stock reasoning-effort prompt. In the comparison, the template turns out to be a stronger behavioral lever than most people assume. For local model deployments, this means observed behavior depends not only on weights but also on how the serving layer applies the template.

Model cards deserve scrutiny without assuming bad faith. Orcarouter verified four of four claims exactly. Trohrbaugh reports 0/100 refusals, but in the comparison it shows 122 explicit refusals, the highest number, alongside the cleanest capability profile. The author uses it at home, which says something: more refusals do not necessarily mean less useful in a real context. KL is not deterministic: it moves with CUDA version and hardware. For local evaluation, published benchmarks should be read as a within-comparison spread, not as absolute constants.

In the end, the result is not a list of models to pick or avoid but a structural thesis: refusal removal is an intervention with second-order effects on reasoning circuits. More aggressive models may shout compliance without finishing their thinking; more conservative ones may refuse more and remain more stable. The author signals plans to replace HarmBench with a measurement that also accounts for template and hyperparameter effects. That is an acknowledgment that testing a modification cannot stop at the refusal rate.