AESIR-Hacker-Micro

AESIR-Hacker-Micro is an experimental, 4B-class, natively multimodal Qwen3.5 model merge created from:

• 40% Qwen/Qwen3.5-4B
• 60% rodrigomt/Qwen3.5-4B-Uncensored-Aggressive

The merge was calculated tensor by tensor using FP32 accumulation and saved as sharded BF16 Safetensors. Tokenizer, chat-template, configuration, image processor, and video processor assets were inherited from the official Qwen checkpoint to preserve the native Qwen3.5 multimodal interface.

“Uncensored” means the model is intended to refuse fewer prompts. It does not mean the model is factual, unbiased, safe, lawful, private, or suitable for unsupervised tool use. Treat all output as untrusted and validate it before acting on it.

The name AESIR-Hacker-Micro is branding and describes an intended audience. This release did not receive additional cybersecurity training, supervised fine-tuning, or domain-specific data. Any security, coding, reasoning, vision, or agentic capabilities are inherited from the two source checkpoints and have not yet been independently benchmarked for this merge.

Model summary

Field	Value
Model	aesir-unlimited/AESIR-Hacker-Micro
Maintainer	aesir-unlimited
Model family	Qwen3.5
Model type	Causal language model with a vision encoder
Architecture	Qwen3_5ForConditionalGeneration / qwen3_5
Parameter class	4B language-model class; the complete multimodal checkpoint also includes the vision stack
Inputs	Text, images, and video through compatible runtimes
Outputs	Autoregressive text
Native context configuration	262,144 tokens, inherited from Qwen3.5
Extended context	Upstream Qwen documents extension to approximately 1M tokens with YaRN; not validated for this merge
Merge method	Linear weight interpolation
Merge ratio	40% official Qwen / 60% aggressive uncensored derivative
Merge precision	FP32 accumulation
Storage precision	BF16
Serialization	Sharded Safetensors
Framework	Hugging Face Transformers
Independent evaluation	Not yet completed

What this model is

AESIR-Hacker-Micro combines the official post-trained Qwen3.5-4B checkpoint with a lower-refusal derivative from the same model family. The goal is to retain as much of the official model's multimodal, reasoning, multilingual, coding, and tool-use behavior as possible while shifting the resulting weights toward the behavior of the aggressive uncensored checkpoint.

This is a weight-space interpolation, not an ensemble and not a new fine-tune. At inference time, only one merged checkpoint is loaded.

Because both source checkpoints descend from Qwen3.5-4B, they have matching tensor names and shapes. This makes direct interpolation technically possible, but it does not guarantee that capabilities or safety behavior interpolate in a simple 40/60 proportion.

In particular:

• “60% uncensored” describes the weight coefficient, not a measured refusal rate.
• Skills, styles, and safety behaviors may combine nonlinearly.
• Some abilities may improve, remain unchanged, or regress.
• The merge requires its own benchmarks; results reported for either source model should not be reported as results for AESIR-Hacker-Micro.

Source lineage

Official component: Qwen/Qwen3.5-4B

The official Qwen component supplies the original multimodal architecture and post-training lineage. Its upstream model card describes:

• A causal language model with a vision encoder.
• Native text, image, and video processing.
• A hybrid language architecture combining Gated DeltaNet linear-attention layers with periodic full-attention layers.
• 32 language-model layers and a hidden size of 2,560.
• A native context configuration of 262,144 tokens.
• Multilingual coverage reported by Qwen across 201 languages and dialects.
• Thinking, coding, tool-use, and agent-oriented behavior.

These are upstream characteristics, not independent measurements of this merge.

Uncensored component: rodrigomt/Qwen3.5-4B-Uncensored-Aggressive

The second component is a Transformers/Safetensors conversion of HauhauCS/Qwen3.5-4B-Uncensored-HauhauCS-Aggressive. The conversion repository states that its source was a BF16 GGUF release and that the converted checkpoint preserves Qwen3.5's multimodal text, image, and video architecture.

The upstream uncensored release was designed to reduce refusal behavior. That description is an upstream claim. AESIR-Hacker-Micro has not yet been measured against the upstream refusal suite, so no specific refusal rate is claimed for this merge.

Merge details

For each floating-point tensor with matching name and shape, the merge applied:

$$W_{\text{AESIR}}=0.40W_{\text{Qwen}}+0.60W_{\text{Uncensored}}W\_\{\backslash text\{AESIR\}\}\; =\; 0.40W\_\{\backslash text\{Qwen\}\}\; +\; 0.60W\_\{\backslash text\{Uncensored\}\}$$

The calculation was performed in FP32 before conversion to BF16:

merged_fp32 = (
    qwen_tensor.to(torch.float32) * 0.40
    + uncensored_tensor.to(torch.float32) * 0.60
)
merged_bf16 = merged_fp32.to(torch.bfloat16)

Merge implementation

Property	Implementation
Merge granularity	Every tensor in the indexed checkpoints
Floating-point tensors	Linear interpolation in FP32
Output floating dtype	BF16
Non-floating tensors	Copied only when both sources were exactly identical
Tensor compatibility check	Source tensor-name sets had to match
Shape compatibility check	Corresponding shapes had to match
Output format	Standard Transformers checkpoint with Safetensors index
Target shard size	Approximately 1.5 GiB per shard
Processor assets	Copied from Qwen/Qwen3.5-4B
Validation	Every expected tensor required exactly once in the output

The merge script resolved immutable Hugging Face source revisions before downloading. The exact source commit hashes, tensor count, output shard count, and total tensor bytes are recorded in the repository's merge_manifest.json.

What was not done

• No additional pre-training or post-training.
• No supervised fine-tuning, DPO, RLHF, RLAIF, or reinforcement learning.
• No task-specific cybersecurity dataset was added.
• No tokenizer or vocabulary merge was performed.
• No quantization was applied to this BF16 release.
• No claim is made that linear interpolation preserves every source capability.

Intended uses

AESIR-Hacker-Micro is intended for controlled research and development such as:

• Local, private, multimodal assistant experiments.
• General chat, summarization, extraction, drafting, and brainstorming.
• Image understanding, screenshot analysis, OCR-assisted workflows, and visual question answering.
• Video summarization in runtimes that support Qwen3.5 video inputs.
• Coding assistance, debugging, code explanation, and test generation.
• Alignment and refusal-behavior research.
• Prompt, system-message, and agent-scaffold experimentation.
• Tool-use research with sandboxed, allow-listed tools.
• Authorized security education, capture-the-flag exercises, defensive code review, threat modeling, and analysis inside isolated labs.

Out-of-scope and high-risk uses

The model should not be treated as authorization, professional advice, or a safety control. High-risk or inappropriate uses include:

• Accessing systems, accounts, networks, or data without explicit permission.
• Deploying malware, destructive payloads, credential theft, fraud, harassment, stalking, or invasive surveillance.
• Unsupervised execution of model-produced code or shell commands.
• Giving the model unrestricted access to production systems, secrets, financial accounts, communications, or physical devices.
• Making consequential medical, legal, financial, employment, housing, education, insurance, or law-enforcement decisions without qualified human review.
• Treating generated citations, package names, vulnerabilities, exploitability claims, or factual assertions as verified.
• Public deployment without abuse controls appropriate to the application and jurisdiction.

Use must comply with applicable laws, upstream licenses, platform rules, and the operator's authorization boundaries.

Quickstart with Transformers

Qwen3.5 support may require a recent Transformers version. If the current stable release in your environment does not recognize qwen3_5, install the latest Transformers build supported by the official Qwen model card.

pip install -U transformers accelerate safetensors torch torchvision pillow

If that release does not yet include the required architecture, use the current Transformers main branch as recommended by the official Qwen card:

pip install -U "transformers @ git+https://github.com/huggingface/transformers.git@main" \
  accelerate safetensors torch torchvision pillow

Text-only generation

import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = "aesir-unlimited/AESIR-Hacker-Micro"

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "system",
        "content": (
            "You are a careful technical assistant. Distinguish verified facts "
            "from hypotheses and never claim that an action was completed unless "
            "you have evidence."
        ),
    },
    {
        "role": "user",
        "content": "Explain the difference between authentication and authorization.",
    },
]

inputs = processor.apply_chat_template(
    messages,
    add_generation_prompt=True,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
).to(model.device)

with torch.inference_mode():
    output_ids = model.generate(
        **inputs,
        max_new_tokens=512,
        do_sample=True,
        temperature=0.7,
        top_p=0.8,
        top_k=20,
    )

new_tokens = output_ids[0, inputs["input_ids"].shape[-1]:]
print(processor.decode(new_tokens, skip_special_tokens=True))

Image input

import torch
from transformers import AutoModelForMultimodalLM, AutoProcessor

model_id = "aesir-unlimited/AESIR-Hacker-Micro"

processor = AutoProcessor.from_pretrained(model_id)
model = AutoModelForMultimodalLM.from_pretrained(
    model_id,
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "user",
        "content": [
            {
                "type": "image",
                "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG",
            },
            {
                "type": "text",
                "text": "Describe the image, then list any text you can read. Mark uncertain text explicitly.",
            },
        ],
    }
]

inputs = processor.apply_chat_template(
    messages,
    add_generation_prompt=True,
    tokenize=True,
    return_dict=True,
    return_tensors="pt",
).to(model.device)

with torch.inference_mode():
    output_ids = model.generate(**inputs, max_new_tokens=512)

new_tokens = output_ids[0, inputs["input_ids"].shape[-1]:]
print(processor.decode(new_tokens, skip_special_tokens=True))

High-level multimodal pipeline

import torch
from transformers import pipeline

pipe = pipeline(
    "image-text-to-text",
    model="aesir-unlimited/AESIR-Hacker-Micro",
    dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "user",
        "content": [
            {
                "type": "image",
                "url": "https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/p-blog/candy.JPG",
            },
            {"type": "text", "text": "What is shown in this image?"},
        ],
    }
]

result = pipe(text=messages, max_new_tokens=256)
print(result)

Serving

Use a recent inference engine with Qwen3.5 multimodal support. Start with a context length that fits your hardware; the full 262K context can require far more memory than the model weights alone.

vLLM

vllm serve aesir-unlimited/AESIR-Hacker-Micro \
  --port 8000 \
  --tensor-parallel-size 1 \
  --max-model-len 32768 \
  --reasoning-parser qwen3 \
  --enable-auto-tool-choice \
  --tool-call-parser qwen3_coder

Increase --max-model-len only after measuring available memory and workload requirements. For text-only deployments, use the Qwen3.5 text-only or language-model-only option supported by your serving engine when available to avoid unnecessary multimodal memory overhead.

SGLang

python -m sglang.launch_server \
  --model-path aesir-unlimited/AESIR-Hacker-Micro \
  --host 0.0.0.0 \
  --port 8000 \
  --tp-size 1 \
  --context-length 32768 \
  --reasoning-parser qwen3 \
  --tool-call-parser qwen3_coder

Exact flags vary by engine version. Consult the current runtime documentation if a flag has changed.

Thinking and sampling

Qwen3.5 models use thinking mode by default. The official Qwen documentation recommends different sampling settings by workload. These are reasonable starting points, not validated optima for this merge.

Workload	Temperature	Top-p	Top-k	Presence penalty
Thinking, general tasks	1.0	0.95	20	1.5
Thinking, precise coding	0.6	0.95	20	0.0
Non-thinking, general tasks	0.7	0.8	20	1.5
Non-thinking, reasoning tasks	1.0	0.95	20	1.5

Runtime support for top_k, min_p, presence penalties, repetition penalties, and thinking controls differs. Qwen3.5 does not use the older Qwen3 /think and /nothink soft-switch convention. For OpenAI-compatible vLLM or SGLang servers, non-thinking mode is typically requested with:

{
  "chat_template_kwargs": {
    "enable_thinking": false
  }
}

Prompting recommendations

For reliable results:

1. State the task, scope, permitted actions, and required output format.
2. Ask the model to separate observations, assumptions, and conclusions.
3. For image or video analysis, ask it to label uncertain visual details.
4. For code, require tests and ask it to identify unverified dependencies.
5. For security work, state the authorized environment and prohibit actions outside that scope.
6. Never rely on a system prompt as the only deployment safeguard.

Example system message for authorized defensive work:

You are an assistant for authorized defensive security work. Stay within the
explicitly stated lab, repository, or assessment scope. Separate verified
evidence from hypotheses. Do not claim commands were executed unless tool
results prove it. Flag destructive steps, protect secrets, and request human
approval before any state-changing or external action.

Tool and agent deployment guidance

The model only generates text or structured tool-call proposals. An external application decides whether a tool is executed. A lower-refusal model makes executor-side controls especially important.

Recommended controls include:

• Run generated code in an isolated sandbox with strict CPU, memory, time, filesystem, and network limits.
• Use least-privilege credentials and short-lived tokens.
• Allow-list tools, domains, commands, paths, and arguments where practical.
• Require human confirmation for writes, deletion, purchases, messages, account changes, privilege changes, or external side effects.
• Keep secrets out of prompts and logs; redact sensitive tool output.
• Validate tool-call JSON against a strict schema.
• Treat webpages, documents, images, and tool output as untrusted input that may contain prompt injection.
• Log proposed and executed actions for auditability without retaining unnecessary private data.
• Add application-level moderation and rate limiting for public endpoints.

Evaluation status

No independent benchmark suite is currently published for AESIR-Hacker-Micro. Upstream Qwen3.5 or uncensored-source scores must not be presented as scores for this model.

Evaluation area	Status	Suggested checks
Text quality and instruction following	Not measured	IFEval-style prompts, factuality, formatting adherence
Reasoning and mathematics	Not measured	GSM-style tasks, GPQA-style tasks, adversarial arithmetic
Coding	Not measured	HumanEval/MBPP-style tests, repository-level tasks, dependency hallucination
Vision-language	Not measured	VQA, OCR, charts, screenshots, spatial reasoning
Video understanding	Not measured	Temporal ordering, event recall, sampling sensitivity
Tool calling	Not measured	Schema validity, correct tool choice, argument accuracy, recovery from errors
Long context	Not measured	Retrieval by depth, instruction retention, memory usage, latency
Multilingual quality	Not measured	Native-speaker review across target deployment languages
Refusal behavior	Not measured	Benign-overrefusal suite plus harmful-compliance red-team suite
Bias and toxicity	Not measured	Identity-term perturbations, stereotype and harassment tests
Privacy and memorization	Not measured	Canaries, extraction attempts, sensitive-data handling
Cybersecurity behavior	Not measured	Authorized CTFs, secure-code review, false-positive and overreach rates

For a meaningful comparison, evaluate at least:

1. The official Qwen/Qwen3.5-4B checkpoint.
2. The rodrigomt/Qwen3.5-4B-Uncensored-Aggressive checkpoint.
3. This merged checkpoint.

Keep the prompt set, chat template, runtime, context size, precision, random seed, and decoding parameters identical. Report confidence intervals or repeat runs for sampled generation.

Limitations

General language-model limitations

• The model can hallucinate facts, sources, package names, APIs, CVEs, commands, and quotations.
• It can produce plausible but insecure, uncompilable, or destructive code.
• Confidence and verbosity do not indicate correctness.
• Knowledge may be incomplete, stale, culturally uneven, or internally inconsistent.
• Long conversations can cause instruction drift or forgotten constraints.
• The model may expose or amplify biases present in its source training and post-training data.

Merge-specific limitations

• Linear weight interpolation is not guaranteed to preserve source-model performance.
• The 40/60 coefficients do not translate directly into behavioral percentages.
• The source checkpoints may differ because of uncensoring edits and a GGUF-to-Safetensors conversion path; subtle conversion artifacts are possible.
• BF16 storage introduces rounding after the FP32 interpolation.
• Tokenizer and processor assets come from the official component; compatibility was structurally validated, but behavioral equivalence was not proven.
• No task-specific post-merge calibration or recovery fine-tuning was applied.

Multimodal limitations

• The model may misread small text, diagrams, screenshots, charts, or visual details.
• Video results depend on frame sampling and may miss short or rapidly changing events.
• Images and documents can contain adversarial or irrelevant instructions.
• Visual grounding should be verified before consequential action.

Long-context limitations

• A configured context window is not proof of rel