如何在本地无拒绝地运行 Qwen-Image-2.1-Turbo

Qwen-Image 的文本编码器 Qwen3-VL-8B-Instruct 已将其拒绝方向投影移除：它可作为 stable-diffusion.cpp 的 --llm 直接替换组件，与我们的 Turbo 去噪器 GGUF 配套使用。下文将说明具体是哪个部分被去除限制，以及这会对图像产生什么影响。测量数据已公开。

• 作为聊天模型时，该编码器在留出提示词集上的拒绝率：英文从 88.9% 降至 1.2%，俄文从 38% 降至 0%。MMLU 保持不变：处理前后均为 77.35%。
• 在图像上，我们没有测得任何变化。 原始 Qwen-Image 管线没有过滤器，且已能绘制我们测试的全部 9 类敏感内容；使用该编码器后，45 条提示词中没有一条改变结果。详见具体是哪里被去除限制。
• 可在 Atomic Chat 本地生成图像。它运行 stable-diffusion.cpp，即这些文件构建和验证所使用的引擎。

具体是哪里被去除限制

Qwen-Image 2.1 通过三个部分生成图像。这里仅修改了其中一个部分。

原始管线本身并不拦截任何内容。本次发布仅改变了编码器对其作为聊天模型时本会拒绝的提示词的表征方式。去噪器从未学会绘制的内容，任何编码器都无法补上。

以下是在 45 条敏感提示词（仅成年人）和 48 条中性提示词上的图像影响测试：使用相同随机种子、相同去噪器，对比原始编码器与此编码器。

| 原始编码器 | 此编码器，BF16 | 此编码器，Q8_0
---|---|---|---
判定器认为生成了所请求内容的敏感提示词 | 40 / 45 | 40 / 45 | 40 / 45
……裸体 / 性暗示（各 5 条） | 4 / 4 | 4 / 4 | 4 / 4
……暴力 / 武器 / 毒品（各 5 条） | 5 / 5 / 4 | 5 / 5 / 4 | 5 / 5 / 4
……图像内书写的粗俗用语 / 医学解剖（各 5 条） | 4 / 4 | 4 / 4 | 4 / 4
……对照项：吸烟和酒精 / 纹身（各 5 条） | 5 / 5 | 5 / 5 | 5 / 5
相较原始编码器、任一方向发生结果翻转的提示词 | – | 45 条中 0 条 | 45 条中 0 条
图像相对原始编码器图像的变化程度（LPIPS），敏感提示词 | – | 0.088 | –
48 条中性提示词的相同指标 | – | 0.084 | 0.090

我们没有在图像上测得去除限制的效果，因为在这些提示词中没有任何内容需要去除限制。 原始管线已经能绘制探测集中的每一个类别，而此编码器也绘制出完全相同的类别：没有一条提示词发生结果翻转。图像确实会变化，约为更换随机种子所致变化的六分之一（新随机种子的 LPIPS 为 0.499）。敏感提示词与中性提示词的变化程度相同，因此这是总体性偏移，而非朝向被拒绝内容的偏移。作为参照，将原始编码器量化为 Q8_0 会使相同图像产生 0.037 的偏移。

本次发布实际提供的是一个不再拒绝请求的聊天模型编码器（见下一节），并以 stable-diffusion.cpp 可通过 --llm 加载的文件形式提供。

文件

该编码器采用与我们的 Turbo 去噪器 相同的规格梯度，并使用我们的重要性矩阵和逐张量布局（AD-）。每个文件有两个指标：

• **图像：**其图像相对于该编码器 BF16 版本图像的变化距离。该指标是在 48 条中性提示词上、使用 BF16 去噪器和相同随机种子测得的 LPIPS。新随机种子的值为 0.499。
• **作为聊天模型：**相对于原始 Qwen3-VL-8B-Instruct 的平均 KLD，以及最高概率 token 一致的比例。这些指标包括消融处理本身的影响（BF16 下为 0.0019）。

• 如果容量允许，请选择 Q8_0。4 比特版本建议选择 AD-Q4_K。
• 编码器类型会影响图像。 该编码器的普通 llama-quantize Q4_K_M 版本（5.03 GB，即多数编码器 GGUF 使用的类型）会使图像偏移 0.166。AD-Q4_K 的偏移为 0.087，仅为前者一半，但多占用 260 MB。作为聊天模型，普通 Q4_K_M 的 KLD 为 0.0276，top-1 一致率为 93.83%。
• AD-Q2_K 生成的图像会明显不同。仅应在无法容纳更大模型时选择它。
• mmproj 是未修改的视觉投影器，用于编辑（--llm_vision）或结合图像进行聊天。

AD- 布局：

• attn_k/attn_v 保持为 Q8_0（在 3 比特和 2 比特版本中分别为 Q6_K、Q5_K）。
• attn_q/attn_output，以及首尾四个 block 的 MLP 下投影，均比基础类型高一个等级。
• token embedding 和输出头采用 Q6_K 或更高精度（2—3 比特版本中采用 Q4_K/Q5_K）。
• 重要性矩阵来自校准语料库中 2,000 个、每个 512 token 的分块；语料按聊天格式处理，并使用 --parse-special。

运行方式

sd-cli --diffusion-model Qwen-Image-2.1-Turbo-AD-Q4_K.gguf \
  --llm Qwen-Image-2.1-Turbo-Abliterated-Uncensored-Q8_0.gguf \
  --vae qwen_image_2.1_vae_bf16.safetensors \
  -p 'your prompt' \
  --steps 8 --cfg-scale 1.0 --sampling-method euler \
  --sigmas 1.0,0.978453,0.95418,0.926626,0.89508,0.845148,0.704534,0.414568,0.0 \
  -W 1024 -H 1024 --diffusion-fa -o out.png

• 去噪器：AtomicChat/Qwen-Image-2.1-Turbo-GGUF。Turbo 设置（8 步、CFG 1、sigma 列表）在该页面中说明。
• **Qwen-Image-2.1：**同一编码器也可搭配非 Turbo 去噪器使用。
• **VAE：**来自 Comfy-Org/Qwen-Image-2.1 的 vae/qwen_image_2.1_vae_bf16.safetensors。
• **作为聊天模型：**该编码器是常规 Qwen3-VL GGUF。搭配 mmproj 后可在 llama.cpp 中运行。

作为聊天模型的编码器

原始版本与此版本均为 BF16，并在从未用于模型选择的提示词上进行比较：

拒绝率依据回复开头判定，因此仅具指示意义，而不是裁判结果。空回复或退化回复均计为损害，但测试中没有出现此类情况。

我们的流程中有两项门槛未通过，模型卡中已明确说明：

• 首 token KL。 在无害验证提示词上为 0.100，正好处于 0.10 的上限。
• 残留门槛。 在完整强度下，编辑后写入器中残留方向的大小为原始方向的 1.9e-4，高于我们为早期模型设定的 1e-5。这与 bf16 舍入误差相当：编辑本身仅在 f32 中应用一次并写入，经过 bf16 舍入后，与目标值的距离在 1.8e-3 以内。

制作方法

1. 方向。 对最后一个提示词 token 处残差流的均值差进行计算，并应用聊天模板：在进入 36 个 block 中第 23 个 block 时，使用 416 条有害英文提示词对比 416 条无害英文提示词，并移除无害均值分量。
2. 编辑。 对每个写入残差流的矩阵应用 W' = W - 0.75 r rᵀW：包括 36 个注意力输出矩阵、36 个 MLP 下投影矩阵和 token embedding。视觉塔不受影响。
3. 选择。 在验证提示词上筛选了 26 个变体：行、强度、哪些写入器、仅英文或英文加俄文、每个 block 一个方向。上述数字来自留出测试提示词。
4. 写入和量化。 在 f32 中将编辑应用于 BF16 权重后进行一次舍入，然后利用我们的重要性矩阵生成 Q8_0 与 AD 规格梯度。使用 llama.cpp 6184e92（上游版本）构建，并添加了两个用于激活值采样的图名称。
5. 图像。 使用 A100 80 GB 上的 stable-diffusion.cpp 36f1b1a，BF16 Turbo 去噪器、1024×1024 分辨率、Turbo 调度和随机种子 42。原始编码器的 GGUF 可逐像素复现原始 safetensors 编码器的结果，因此文件格式不是变量。

局限性

• 拒绝计数读取每条回复的开头。被表述为回答的软性拒绝可能会被遗漏。
• 探测集规模较小（45 条提示词、一个随机种子）。其是/否结果由视觉模型判定器给出，即带有其投影器的该编码器。两个版本的每张图像均经过相同判定器评估。
• 使用输入图像进行编辑时，仍保留一条本次编辑无法触及的路径。Qwen3-VL 在前三个 block 之后将视觉特征添加到残差流中，而该路径上不存在可编辑的权重。
• 尚未在 ComfyUI、Mac 或 Qwen-Image-2.1（非 Turbo）去噪器上运行测试。

负责任使用

该编码器不再将提示词导向拒绝回复。这并不意味着输出是安全、正确或合法的。请勿用其制作涉及未成年人的色情内容，或在未经真人同意的情况下制作其私密或侮辱性图像。任何部署都需要自行实施访问控制和政策执行机制。

致谢

方向估计、编辑、量化和评估均由 AtomicChat 完成。基础模型 Qwen3-VL-8B-Instruct 由 Qwen 发布，采用 Apache-2.0 许可证。与之配套的去噪器 Qwen-Image-2.1-Turbo 采用 Qwen Research License。该方法遵循 Arditi 等人在 2024 年发表的 Refusal in Language Models Is Mediated by a Single Direction。

How to Run Qwen-Image-2.1-Turbo Without Refusals Locally

Qwen-Image's text encoder, Qwen3-VL-8B-Instruct, with its refusal direction projected out: a drop-in--llm for stable-diffusion.cpp next to our Turbo denoiser GGUFs. Below, exactly which part is uncensored and what that does to the pictures. The measurements are public.

• As a chat model, the encoder's refusals fall from 88.9% to 1.2% in English and from 38% to 0% in Russian on held-out prompts. MMLU is unchanged: 77.35% before and after.
• On images it changes nothing we could measure. The stock Qwen-Image pipeline has no filter and already draws all 9 sensitive categories we tested, and with this encoder not one of 45 prompts changed outcome. See where exactly this is uncensored.
• Generate images locally in Atomic Chat. It runs stable-diffusion.cpp, the engine these files were built and checked with.

Where exactly this is uncensored

Qwen-Image 2.1 makes a picture with three parts. Only one of them is changed here.

The stock pipeline already blocks nothing. This release changes only how the encoder represents prompts it would refuse as a chat model. What the denoiser never learned to draw, no encoder can add.

What that does to the pictures, measured on 45 sensitive prompts (adults only) and 48 neutral ones, stock encoder against this one, same seed, same denoiser:

| Stock encoder | This encoder, BF16 | This encoder, Q8_0
---|---|---|---
Sensitive prompts where the judge sees what was asked for | 40 / 45 | 40 / 45 | 40 / 45
... nudity / suggestive (5 each) | 4 / 4 | 4 / 4 | 4 / 4
... violence / weapons / drugs (5 each) | 5 / 5 / 4 | 5 / 5 / 4 | 5 / 5 / 4
... profanity written in the image / medical anatomy (5 each) | 4 / 4 | 4 / 4 | 4 / 4
... controls: smoking and alcohol / tattoos (5 each) | 5 / 5 | 5 / 5 | 5 / 5
Prompts that flip against the stock encoder, either way | – | 0 of 45 | 0 of 45
How far the picture moves from the stock-encoder picture (LPIPS), sensitive prompts | – | 0.088 | –
The same on 48 neutral prompts | – | 0.084 | 0.090

On images we measured no uncensoring effect, because on these prompts there was nothing to uncensor. The stock pipeline already draws every category in the probe set, and this encoder draws exactly the same ones: not one prompt flipped. The pictures do change, by about a sixth of what a new seed does (a new seed is 0.499). They change as much on neutral prompts as on sensitive ones, so this is a general shift, not a shift towards refused content. For scale: quantizing the stock encoder to Q8_0 moves the same pictures by 0.037.

What this release does give you is the encoder as a chat model without refusals (next section), in the files stable-diffusion.cpp takes as --llm.

The files

The encoder in the same ladder as our Turbo denoiser, with our importance matrix and per-tensor layout (AD-). Two numbers per file:

• Pictures: how far its pictures move from those of this encoder in BF16. That is LPIPS on 48 neutral prompts, with the BF16 denoiser and the same seed. A new seed is 0.499.
• As a chat model: mean KLD to the original Qwen3-VL-8B-Instruct and how often the top token matches. These include the ablation itself (0.0019 at BF16).

• Q8_0 if it fits. AD-Q4_K is the pick at 4 bits.
• The encoder's type matters for the pictures. A plain llama-quantize Q4_K_M of this encoder (5.03 GB, the type most encoder GGUFs ship) moves the pictures by 0.166. AD-Q4_K moves them by 0.087, half as much, for 260 MB more. As a chat model the plain Q4_K_M is at KLD 0.0276, 93.83% top-1.
• AD-Q2_K draws noticeably different pictures. Take it only if nothing larger fits.
• The mmproj is the vision projector, unmodified. It is for editing (--llm_vision) or chat with images.

AD- layouts:

• attn_k/attn_v stay at Q8_0 (Q6_K, Q5_K at 3 and 2 bits).
• attn_q/attn_output and the MLP down projection of the first and last four blocks take one step above the base type.
• The token embedding and the output head are at Q6_K or higher (Q4_K/Q5_K at 2-3 bits).
• The importance matrix comes from 2000 chunks of 512 tokens of our calibration corpus, chat-formatted, with --parse-special.

Running it

sd-cli --diffusion-model Qwen-Image-2.1-Turbo-AD-Q4_K.gguf \
  --llm Qwen-Image-2.1-Turbo-Abliterated-Uncensored-Q8_0.gguf \
  --vae qwen_image_2.1_vae_bf16.safetensors \
  -p 'your prompt' \
  --steps 8 --cfg-scale 1.0 --sampling-method euler \
  --sigmas 1.0,0.978453,0.95418,0.926626,0.89508,0.845148,0.704534,0.414568,0.0 \
  -W 1024 -H 1024 --diffusion-fa -o out.png

• Denoiser: AtomicChat/Qwen-Image-2.1-Turbo-GGUF. The Turbo settings (8 steps, CFG 1, the sigma list) are explained there.
• Qwen-Image-2.1: the same encoder works with the non-Turbo denoisers.
• VAE: vae/qwen_image_2.1_vae_bf16.safetensors from Comfy-Org/Qwen-Image-2.1.
• As a chat model: the encoder is a regular Qwen3-VL GGUF. With the mmproj it runs in llama.cpp.

The encoder as a chat model

Original against this one, both BF16, on prompts never used to pick anything:

| Original | Abliterated
---|---|---
JBB harmful behaviours (EN, 81), refused | 88.9% | 1.2%
Aya red-teaming (RU, 100), refused | 38.0% | 0%
XSTest safe prompts (250), refused | 2.0% | 0%
MMLU, 2000 questions | 77.35% | 77.35% (15 answers changed each way, McNemar p = 1.0)
Tool calls (20) | 20/20 valid | 20/20 valid
Needle at 30k tokens (3 depths) | 3/3 | 3/3
Mean KLD to the original on held-out neutral text | – | 0.0018

Refusal is counted by the opening of the reply, so it is indicative, not a judge. Empty or degenerate replies count as damage, and there were none.

Two of our pipeline's gates did not pass, and the card says so:

• First-token KL. On the harmless validation prompts it is 0.100, at the 0.10 limit.
• Leak gate. The direction left in the edited writers at full strength is 1.9e-4 of the original, above the 1e-5 we set for an earlier model. That is the size of bf16 rounding: the edit itself, baked once in f32, lands within 1.8e-3 of its target after bf16 rounding.

How it was made

1. Direction. Difference of means of the residual stream at the last prompt token, chat template applied: 416 harmful against 416 harmless English prompts, taken entering block 23 of 36, with the harmless-mean component removed.
2. Edit. W' = W - 0.75 r rᵀW on every matrix that writes into the residual: 36 attention outputs, 36 MLP down projections, and the token embedding. The vision tower is untouched.
3. Choice. 26 variants screened on validation prompts: row, strength, which writers, English only or English + Russian, one direction per block. The numbers above come from held-out test prompts.
4. Bake and quantize. The edit applied to the BF16 weights in f32 and rounded once, then Q8_0 and the AD ladder with our importance matrix. Built with llama.cpp 6184e92 (upstream), with two graph names added for the activation taps.
5. Images. stable-diffusion.cpp 36f1b1a on an A100 80 GB, Turbo denoiser in BF16, 1024×1024, the Turbo schedule, seed 42. The stock encoder as a GGUF renders pixel for pixel what the original safetensors encoder renders, so the file format is not a variable.

Limitations

• The refusal count reads the opening of each reply. A soft refusal phrased as an answer would be missed.
• The probe set is small (45 prompts, one seed). Its yes/no numbers come from a vision model judge, this encoder with its projector. Every image of both builds went through the same judge.
• Editing with input images keeps a path the edit cannot reach. Qwen3-VL adds its visual features to the residual stream after the first three blocks, and there is no weight on that path.
• Not run yet in ComfyUI, on a Mac, or with the Qwen-Image-2.1 (non-Turbo) denoiser.

Responsible use

The encoder no longer leans prompts towards a refusal. That does not make the output safe, correct or lawful. Do not use it to make sexual content involving minors, or intimate or degrading images of real people without their consent. Any deployment needs its own access controls and policy enforcement.

Credits

Direction estimation, edit, quantization and evaluation by AtomicChat. Base model Qwen3-VL-8B-Instruct by Qwen, Apache-2.0. The denoiser it pairs with, Qwen-Image-2.1-Turbo, is under the Qwen Research License. The method follows Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (2024).