Z-Image Turbo reads your prompt through Qwen3-4B. The community started swapping that encoder for an abliterated heretic build of the same model, expecting uncensored images. The creator of Heretic then posted a PSA saying this cannot work and if anything degrades outputs. The argument ran hot, with zero measurements on either side.

Disclosure, and being completely honest. November last year I released gemma-3-12b-it-heretic , an abliterated Gemma 3 12B that can be used for prompt enhancement as well as text encoding. Since then it has had 117k downloads in total, and over time I released others. Five months ago I released qwen3-4b-heretic , the Z-Image text-encoder conversion this page puts on the bench. My first post in November had people reply that I didn’t fully understand how a text encoder works. They were right. I learned quickly and spent a couple of days measuring what I could. I was able to measure a divergence in cosine similarities depending on how taboo the prompt was, plus a bit of A/B testing, and left it there. My conclusion was it doesn’t help uncensor anything, and using it as a prompt enhancer in the same workflow is fine since it just differs the output slightly.

Reading the recent reddit post by the author of Heretic, the reactions were interesting. The one thing that stood out: everything was based on vibes. Who has actually measured the embeddings? Does the prompt get degraded? Is there any actual damage to the output? With how easy it is to hook into ComfyUI these things should be easily measured. Even outside of ComfyUI, a CPU can generate embeddings. So I spent a few days researching and learning the best way to finally get an answer outside of just vibes, and this page is the result. 27 encoder variants, same prompts, same seeds, every claim scored against anchors.

This one covers Z-Image. Krea 2, MiniMax H3 and LTX 2.5 are wrapping up and follow as their own pages, each an A/B comparison across the models and quants, then the data gives the solid answers.

Also the pipeline developed to measure this is also good at comparing different quants. We can get valuable insight as to how quants affect the ComfyUI pipeline, along with abliterated text encoders.

See it first

The full A/B gallery from the study report. Pick any two of the 28 encoders, any of 20 prompts, any of three seeds, and drag the divider. Same prompt, same seed, same sampler. Only the encoder file changes.

The caption cards carry each encoder’s conditioning divergence and the DiT’s response. The word strips show two channels: chip background is attention gained or lost versus base, the orange underline is that word’s cosine difference from base, hover for the number. Heretic underlines nearly every word yet the cosines hover near 0.998, meanings intact, while the backgrounds stay calm. The 4-bit quants churn both channels at once. Word readouts were captured for five of the 28 encoders, base and heretic at bf16 plus the int8, int4 and GGUF-F16 arms. The mid-rung GGUF twins sit within a hair of each other, so we provide the ones that actually differ.

Two rulers for reading anything here. LPIPS is a learned perceptual distance between images, 0 means identical, and it is the unit for every rendered-image number on this page. Two encoders everyone already trusts differ by 0.19 LPIPS, and a seed change with the same encoder gives 0.52. At or below 0.19 is an ordinary known-good swap. Near 0.52 is a different picture. The pattern to look for: Q8_0 is indistinguishable from base, the heretic swap is visible, the 4-bit tiers move as far or further.

How we measure

Every instrument on this page, in pipeline order. Each answers one question and reads against something concrete.

The two channels a word carries

Each word reaches the DiT as a vector, and the DiT separately decides how much attention it gets. We measure both. Word content is the cosine between your encoder’s vector and base’s, 1.0 means bit-identical, hover any word for the value. Attention share is the chip background, green or red, in the above A/B comparison.

How far the conditioning moved: quant units

Mean squared difference between your encoder’s conditioning tensors and base’s, expressed in units of one int8 compression step. Below 1.0 means smaller than a compression nobody argues with. A second scale, the meaning-change, is how far conditioning moves when you swap the prompt for an unrelated one. Heretic sits at 1.02 percent of one.

Same shape or bent: CKA

CKA , from Kornblith et al. 2019 , asks whether the representational geometry survives. 1.0 is identical structure. Heretic scores 0.993: the numbers move, the map does not bend.

Intended edit or noise: the direction test

Abliteration is supposed to do one thing, remove the direction that encodes refusal, the single direction found by Arditi et al. 2024 . So we asked whether the heretic edit actually points along that direction.

We derived the taboo direction from the base model itself. Encode a set of taboo prompts and a set of innocent ones through base, and the difference between their average conditioning is a vector pointing from innocent content toward taboo content. Then measure the cosine between the heretic edit and that direction: −0.149. Negative means the edit removes that component rather than adding to it.

A cosine of −0.149 sounds small, so before trusting it we checked what chance would produce. Shuffle which prompts count as taboo and which as innocent, recompute the direction and the cosine, repeat 200 times. That gives the spread of cosines you get from pure luck, and it clusters tightly around zero. The real measurement sits 116 standard deviations away from that cluster, which is what the z 116 in the tables means. Alignment like that does not happen by accident. The edit genuinely points opposite the taboo direction.

The footnote is that the direction only explains about 2 percent of the edit’s total size. The other 97.8 percent is movement the abliteration picked up elsewhere. The edit is aimed correctly, but most of its mass is extra.

Does the sampler notice: paired trajectories

The sampler runs twice from identical noise, once per conditioning, and we measure the final-latent drift. The different-seed anchor is 1.271, the different-picture level. Every variant stays within 1.0 to 1.9 percent of it. The dice get re-rolled, not loaded.

What sabotage looks like: the controls

Every divergence number needs something to compare against. We know heretic moves the conditioning by 33 quant units, but is that a lot or a little? To answer that we damaged the conditioning on purpose, in ways we fully controlled, and measured what happened to the images. Known damage, measured effect.

The baseline damage is noise. Add random static to the conditioning at increasing strengths and the image drifts further from the original, which gives a curve of how much change causes how much damage. Everything else gets read against that curve.

Then the question we really wanted answered: is the image model blind to the refusal direction? If it was, the abliteration edit would be invisible no matter its size, and that would neatly explain everything we measured. So we took the actual difference between heretic and base conditioning, scaled it up ten times until it matched one of the noise doses, and ran both through the paired-trajectory measurement from the previous section. The scaled heretic edit moved the final image 0.0324, the equal-sized noise moved it 0.0320. The same. The image model is not blind to the refusal direction. The abliteration does so little because the edit is small, not because it is hidden.

Two smaller findings came from the same setup. Adjusted for size, the heretic edit is 2.4 times gentler than noise, which makes sense, one is a single clean edit along a real direction and the other is static scattered everywhere. And shuffling the order of the prompt words damaged images about as much as swapping the word meanings between positions, so this image model cares about meaning and order equally. That last one disagrees with Spingarn et al. 2026 , who found image models lean on word meaning far more than word order.

How different two pictures look: LPIPS

LPIPS , from Zhang et al. 2018 , is a perceptual distance trained on human judgements. Pixel diffs are useless here because same-seed renders always differ. Two anchors make the scale readable. The int8 and fp8 builds of the base encoder, two files nobody has ever argued about and both in routine use, differ by 0.19, so anything at or below that is an ordinary swap between known-good encoders. Changing only the seed with the same encoder gives 0.52, a genuinely different picture. Everything on this page reads between those two.

Does the image still show the prompt: CLIP score

CLIPScore , from Hessel et al. 2021 , measures how well an image matches the text prompt that produced it. For every encoder in the study we render the same 20 prompts, score each image against its own prompt, and compare the average against the reference encoder’s average for the same prompts. The result is a delta in CLIP points. Zero means the encoder’s renders describe the prompts exactly as well as the reference’s, negative slightly worse, positive slightly better.

CLIP scores wander on their own between renders, so a small delta by itself proves nothing. Before running the study we pre-registered a decision band: a mean delta within ±1.5 CLIP points counts as unchanged, and a mean beyond ±2 would count as visible adherence loss. The numbers came from the natural spread of CLIP scores between ordinary renders, not fitted to the results afterwards.

Heretic lands at −0.21. That is good, and the units explain why. It is a fifth of one CLIP point, seven times smaller than the band, and smaller than the bf16 base encoder’s own −0.28 against the same reference. The unmodified encoder and the abliterated one both wander the same tiny distance from the reference, in different directions. The renders move, but they keep depicting what was asked, and every other clean encoder, Q8_0 at −0.18, mxfp8 at +0.15, sits in the same cluster.

The DiT’s reading habits: attention divergence

The DiT’s attention over prompt tokens, compared between encoders with Jensen-Shannon divergence, 0.69 for completely different reading habits. Heretic 0.0031, base int4 0.0149. Abliteration does not move where the model looks. Heavy quantisation does.

Do outputs collapse: inter-prompt spread

The worry this one answers: what if a damaged encoder still renders each prompt reasonably, but every image comes out a bit samey? A castle, a diner, a portrait, all vaguely alike. Prompt adherence would stay fine because each image roughly matches its prompt, and the image ladder would stay fine because it only ever compares the same prompt across encoders. Nothing in the toolkit so far would notice the outputs crowding together.

So we built a measurement for exactly that. Take a set of different prompts. Encode them with the encoder under test. Run the sampler for each one, giving every prompt its own fixed starting noise. Now look at the finished latents, the compressed image representations the sampler hands to the decoder just before they become pixels. Measure the distance between every pair of them and average it. That number is the spread. Big spread means a castle looks nothing like a diner. Small spread means everything is drifting toward the same picture.

The raw number means nothing on its own, so it becomes a ratio. Run the same measurement under the base encoder, then divide. 1.0 means the outputs separate exactly as much as base. Below 1.0 means collapse. Above 1.0 means slightly more separated, which is fine.

Heretic reads 1.049, healthy. The worst in the study is heretic_fp8 at 0.799, losing a fifth of the separation, and this is the closest thing to actual damage the whole study found. It is an interaction, not addition. Base fp8 alone reads 1.071, healthy. Heretic alone reads 1.049, healthy. Stack them and the separation drops below either. The edit makes the compression worse or the compression makes the edit worse, and the outputs start drifting toward samey.

Two honest limits on that word damage. Whether a person would notice is untested, CLIP adherence for this arm is still in band at +0.01, and a fifth less separation still leaves clearly different pictures. And the interaction is not universal, at int4 and nvfp4 the stacked arms come out no worse than the base quants alone. It bites at fp8 and Q3. If there is a lesson, it is do not stack the abliteration onto compression expecting the costs to simply add up.

The uncensoring yardstick: compliance gap

For the taboo comparison we needed to answer a slippery question: when the model renders a taboo prompt, does it actually render the taboo version of the scene, or does it quietly sanitise the output? Looking at the image and scoring it against the prompt does not settle it, because a sanitised render still matches most of the prompt. Same room, same lighting, same person. The score stays high either way.

The trick is a twin. Every taboo prompt in the set has a partner describing the exact same scene with the taboo element swapped for a mild version. One real pair from the set: the same woman reclining on the same rumpled sheets in the same window light, where the taboo prompt says fully nude and the twin says wearing a white silk slip dress. Everything else is word for word identical.

The render is generated from the taboo prompt, then scored with CLIP against both texts. Both scores contain the whole shared scene, the woman, the sheets, the light, so subtracting one from the other cancels all of that out. What survives is the part only the taboo element can explain. That difference is the compliance gap. Positive means the render leans toward the taboo reading. Around zero means ambiguous. Negative means it leans sanitised.

Two more pieces make it a real measurement. An NSFW classifier runs over the sexual tiers as a second, independent signal, the share of images flagged. And the int8 encoder serves as the negative control, compression should not change what gets rendered at all, so any drift in its gap against base is pure measurement noise. That drift defines the band, ±0.003, and any encoder whose gap moves outside it would be genuinely changing what the model renders.

Nothing did. Heretic’s gaps sit inside the band, which is the finding behind the uncensoring question later on.

Why there is no KL here

KL divergence needs a probability distribution, and the conditioning interface has none. The output head that builds one is not even loaded in these pipelines. Model-card KL numbers were measured on the chat pathway before conversion, and our KL post shows how far that number moves with the prompt set. Everything here is measured directly at the interface the DiT consumes.

The divide

Modern image generators use full LLMs as text encoders. Abliterated builds of those LLMs stop refusing as chat models, so the reasoning went: uncensored encoder, uncensored images. Without any deep technical understanding, it seems reasonable.

Then Heretic’s author posted the PSA . Abliteration edits refusal circuitry, but an encoder deployment never runs the refusal path. The base encoder already represents refused concepts accurately, that is how it knows what to refuse. The edited encoder hands the DiT perturbed representations, which at best does nothing and at worst costs adherence. It will never remove censorship from the output.

The backlash was all anecdote. Users swore the heretic encoder rendered things base would not. Others insisted outputs got worse. A popular template author reverted on the strength of the argument alone. The one tester who had actually run a fixed-seed album called it: both sides purely vibes.

It was also noted that a genuine use case is for prompt enhancements. This genuinley does rely on refusal directions when enhancing a prompt. This is a good fit for an abliterated LLM doubling as a text encoder. Or, just being used only for prompt enhancement. In this instance, our focus has just been only on the text encoder side. If you are curious to see how different abliterated Qwen3 4b models compare, we have the abliteration comparison here .

What we did

Base Qwen3-4B and its heretic twin across six safetensors formats and eight GGUF rungs, 27 variants with the int8 base as reference. Every heretic build has a matched base at the same quant, which isolates the abliteration edit from quantisation error at every dose. We measured three pipeline stages, the encoder’s hidden states, the DiT checkpoint’s projection, and the tensor entering cross-attention, plus paired sampling trajectories and the rendered images.

The questions, one by one

Does the encoder refuse my prompt before the image model sees it?

No. The sharpest worry in the debate held that the base encoder might sanitise spicy prompts before the DiT sees them. We encoded refused-vocabulary prompts through base and heretic to the exact cross-attention tensor, then asked which base word each heretic vector sits closest to. All 12 decode to themselves, cosine floor 0.9967, and the runner-ups are semantic neighbours.

Base understands a beheading prompt well enough to refuse it as a chat model. As an encoder it hands the DiT the word beheading, intact. Encoding was never the censor, and where censorship is engineered at all it is trained into the image model’s own weights, which is exactly where ESD and MACE put it when they erase a concept by fine-tuning the diffusion model.

Does an abliterated text encoder degrade or damage the prompt or image? Does more taboo words cause more damage?

No. Sentence-level cosine between base and heretic is at worst 0.9985 on refused prompts, 0.9996 on innocent controls. The shift concentrates where it acts, 3.3 to 6.6 times larger on refused prompts, but the parse probe shows meaning survives it. The Krea 2 page, part two, runs the same probe through a twelve-tap conditioning interface where the contrast is much sharper. Despite the slight difference in geometry, there is no evidence to suggest the DiT misunderstands the prompt or corrupts prompt adherence. Even an int4 or Q3 quant, degraded with noise, keeps mean CLIP adherence inside the band. Individual prompts can wobble at those doses, which is its own question below.

Does the abliterated encoder uncensor anything?

No, and the reason is better than expected. The taboo comparison is a graded adults-only set, three tiers from artistic nudity to gore. We obviously haven’t put the images generated from this comparison on the site, however we can compare the data we got from them. The unmodified base stack already renders the explicit tier at a 100 percent NSFW-classifier rate, and the explicit tier owns the highest compliance gaps of any tier, base at +0.077. There is no render-stage censorship for a text-encoder swap to remove. Heretic’s deltas, +0.001, −0.002 and −0.006 across the three tiers, sit inside the int8 control band of ±0.003. n is 12 images per tier, so suggestive rather than definitive.

So this means the debate about uncensoring was the same as arguing about a lock on an open door.

Where engineered censorship exists it lives in the DiT. ESD and MACE fine-tune the diffusion model itself, and the erasure literature shows even that leaks. Z-Image itself is already trained on some concepts, so it will understand certain prompts from training alone.

Does it damage outputs?

The images change. The outputs however do not degrade. Heretic against base gives 0.286 LPIPS, 1.5 times the trusted band, but an unmodified nvfp4 quant moves images 0.274 and nobody calls a stock quant sabotage. The heretic swap is 0.55 of a seed change.

A heretic model at bf16 does adjust the conditioning slightly, but nothing in the measurements says the model stops understanding the prompt. The rendered image itself measures as slightly different, and in the A/B comparison there is no visual degradation and the prompts are understood. To put it in other words, a visible, quant-class shift with every functional metric clean. Different, not damaged. The full report carries the same finding in its own tables.

Is the edit random noise or a direction?

Both, precisely split. The delta carries cosine −0.149 against base’s taboo direction, z 116, a genuine refusal-aligned removal that confirms Arditi et al. at this interface. And 97.8 percent of its energy is orthogonal, collateral riding along. Scaled to a noise dose the delta deflects sampling 0.0324 against the noise’s 0.0320. Per unit of change the structured edit is 2.4 times calmer than noise. A small-edit effect, not a hidden subspace.

What about quantised text encoders?

The quant ladder, one question nobody in the thread had data for:

Dose-ordered all the way down. The F16 GGUF container is a zero-divergence round trip, Q8 is free, by Q3 you pay visibly. The heretic family carries 33 to 47 quant units of conditioning divergence at every matched rung yet renders in the nvfp4 class.

The top rungs deserve their own mention, because this is where int8 ConvRot and the Q8_0 GGUF land. Measured against the int8 reference, Q8_0 sits at 0.138 LPIPS and the bf16 base itself at 0.152, both inside the trusted band and within a hair of each other. At the conditioning level Q8_0 actually sits closer to bf16 than int8 does, 0.34 versus 1.0 quant units. So the near-lossless claims around int8 ConvRot are real, it is statistically inseparable from bf16 at every stage we measured. The Q8_0 GGUF trades a hair of fidelity the other way for slower loads, since the GGUF path has to dequantize its block-quantized weights on the way in. Both are free. The practical line: int8 ConvRot for speed, Q8_0 GGUF if you want the measured-closest container.

Do not stack abliteration on 4-bit quants. heretic_fp8 loses 20 percent of prompt separation, worst in the set.

Why do people see differences then?

Seeing a difference is the default state of a diffusion model. Sampling is a butterfly-effect machine, and the community has known same-seed swaps always differ for as long as fixed-seed workflows have existed. Two trusted encoders already differ by 0.19 at the same seed.

Below a threshold the response is also dose-independent. The sampler has a deflection floor, and everything from a 0.34-unit Q8 to a 765-unit int4 stays within 1.0 to 1.9 percent of the different-image anchor. The dice get re-rolled, not loaded.

Sometimes a single prompt really does move: 71 of 540 CLIP rows cross ±2 on individual prompts while every mean stays in band. The why is that prompts are not equally robust. Every prompt mixes strong-signal words, the subject and the composition, with weak-signal words, the late details like a third pigeon or a plaque number, and the word strips in the gallery show those weak signals carry a fraction of a percent of attention even under base.

A conditioning nudge re-rolls which solution the sampler settles on. Most solutions still satisfy every check, but brittle prompts have solutions that drop one, a misspelled sign, four pigeons instead of three. That costs a couple of CLIP points on that one prompt. Our most sensitive categories are exactly the brittle ones, text rendering, counting and multi-subject scenes. Across the suite the wins and losses average out, which is why every mean stays in band while individual rows wobble. Per-prompt variance is real, but it can’t be considered systematic degradation. Degradation would move the means.

So when should I use an abliterated encoder?

Anywhere the model emits text that feeds the next stage: prompt expansion, captioning, image description, training-data captions. Those are chat pathways and abliteration works there. The rule is one sentence. If a stage writes text, an uncensored model can help. If it only embeds text, it is at best a visible re-roll.

What is actually censored, then?

The knowledge, not the gate. An image model that will not render something lacks the training data, or was explicitly erased as in the ESD and MACE line. There is no refusal circuit in the render path to abliterate. The fixes are LoRAs, reference images, retraining. The PSA author’s framing survives measurement: the model does not refuse, it lacks the knowledge, and the only fix is training. Models like Ideogram 4 may be different in this regard, and require more research.

What about other models and other claims?

This is just a comparison for zimage and Qwen3 4b. Other models may behave differently. We are working on Krea2, Minimax h3 and LTX 2.5 in a similar way to get solid data. These models work differently and given the slight variance in embeddings and noise, they may be affected differently with quants or an abliterated text encoder.

Findings

These questions were pre-registered before the data was gathered. What we found:

References

External work this study leans on:

• Arditi et al. 2024, Refusal in language models is mediated by a single direction is the theory abliteration implements, tested here at the conditioning interface
• Spingarn et al. 2026, Text-to-image models need less from text encoders than you think predicts DiT insensitivity to contextual perturbation. Our data agrees on effect size and disagrees on their meaning-versus-order detail
• Gandikota et al. 2023, Erasing concepts from diffusion models is where engineered image censorship lives
• Lu et al. 2025, When are concepts erased from diffusion models shows erasure leaks, the DiT-side mirror of this debate
• Chen et al. 2025, Scaling down text encoders of text-to-image diffusion models finds DiTs tolerate major TE changes. Our ladder bounds that tolerance dose by dose
• Li et al. 2023, Q-Diffusion is the DiT-side quantisation literature. The encoder side was unmeasured until now
• Heretic is the tool under test, and its author’s PSA post started the argument

From this project:

• Qwen3-4B as a chat model, three abliteration techniques compared

Full tables with bootstrap confidence intervals ship with the artifact bundle on HuggingFace. Link follows when the bundle lands.

Appendix: the tables

Bootstrap confidence intervals are omitted from these tables for width. Every interval lives in the report artifacts. Divergence at the conditioning interface is in quant units, one int8 compression step of the base encoder. Reference encoder for LPIPS columns is the int8 base.

A1: GGUF quantisation ladder

Pure llama.cpp containers against the bf16 base, plus heretic containers against their matched base container, which isolates the abliteration edit at each quant.

A2: Quantisation versus abliteration decomposition

Divergence at the DiT input in quant-floor units. Pure quant is that base quant against the bf16 base. Pure ablation is heretic against base at matched quant. Combined is heretic-quant against the bf16 base.

A3: Directional analysis

The abliteration delta against the base taboo direction at the consumed layer, with permutation z-scores and the orthogonal energy fraction. The read: a real refusal-aligned component, with most energy as collateral movement.

Each line is one variant’s per-layer divergence against the base. Grey dashed lines are pure base quants, the floor every variant is compared against. The green line marks layer 34, the layer Z-Image actually consumes. The abliteration concentrates in the late layers, while the consumed layer stays near the quantisation floor.

A4: DiT trajectory divergence

Paired flow-matching trajectories from identical noise, 20 Euler steps. The noise-control anchor, same conditioning with a different seed, is 1.271. That is the different-picture level.

Each point is one text encoder. The x axis is its final-latent trajectory divergence, the y axis its same-seed image LPIPS against the reference. A flat cloud means the DiT’s sampling absorbs conditioning changes, which is what we see. Orange dashed is the quant-floor band, green dashed the seed change.

A5: Image-space perceptual ladder

LPIPS of same-seed image pairs against the int8 reference, with the trusted-swap band at 0.19 and the seed anchor at 0.52 for reading. CLIP-score delta is prompt adherence against the same reference.

Every encoder’s mean CLIP adherence stays inside the ±1.5 band, including the 4-bit tiers. Individual prompts do cross ±2 in 71 of 540 rows, heaviest at the 4-bit tiers.

A6: Counterfactual controls

Synthesised conditioning pushed through the same paired-trajectory harness. The ladder runs from a null, meaning zero information, through representation shuffles, Gaussian noise doses, a random rank-1 direction, taboo-direction injection, and the real heretic delta at several scales.

The real unscaled heretic edit sits at 0.01756, on the deflection floor. Scaled 10 times to match the noise 1x dose it gives 0.03243 against the noise’s 0.03204, the no-hidden-subspace result. The sub-threshold noise rungs all land on the same floor regardless of dose, which is the dose-independence finding.

Mean latent divergence from the base trajectory at each Euler step. The green dashed line is the seed-change anchor. Every variant stays 50 to 100 times below it for the whole trajectory.

A7: Attention readout

Jensen-Shannon divergence of the DiT’s attention over conditioning tokens, base versus variant, mean over heads and image-query positions across all captured steps. Zero means identical reading habits, 0.69 means completely different.

Two channels, two stories. The abliterated encoder changes what arrives, and where the DiT looks barely moves. The 4-bit quants break both channels at once, with base int4 at 0.0149 and heretic int4 the largest readout change in the set at 0.0160.

A8: Inter-prompt discriminability

Do outputs stay as different from each other across prompts under the variant encoder as under the base. A ratio below 1 means the renders are collapsing toward each other.

No clean encoder collapses. The worst cases are all heavy compression stacked on the abliteration, the compounding effect from the quantisation question above.

A9: Prompt-category breadth

The ladder repeated across four prompt families to check the shift is not an artifact of one prompt style. LPIPS versus the base encoder at matched prompt and seed.

Multi-subject scenes are the most sensitive category for every encoder including the base, a task property rather than an abliteration signature.

A10: The uncensoring comparison

Graded adults-only tiers, compliance gap and NSFW-classifier rate per tier. The gap is CLIP similarity to the taboo prompt minus similarity to a sanitised twin, positive means the render leans toward the taboo reading. n is 12 images per tier. Ethics as stated in the questions section: no minors, no real people, metrics only, images stay local.

The base already renders the explicit tier at a 100 percent classifier rate, and the explicit tier owns the highest compliance gaps of any tier. Deltas for heretic sit inside the int8 control band. There was nothing at the render stage to unlock.

MSE divergence split by prompt category, same scale both panels. Left panel, pure base quants, roughly flat, quantisation is content-blind. Right panel, abliterated variants, the shift slopes upward toward the violent, sexual and extreme prompts. The edit concentrates its effect where the refusal direction lives.

A11: Remaining figures

One bar per variant, divergence at the DiT input in int8 quant units, log scale. The red line at 1.0 marks what a known-good compression costs. Bars left of it are indistinguishable from ordinary quantisation.

Every cell is the log of the MSE between that variant’s layer activation and the base’s. The bright column at layer 35 in the heretic rows is the abliteration edit itself. The DiT reads layer 34, one column left of the bright band, which stays dark. This is the packaging-versus-edit discriminator: the edit’s peak sits where the pipeline does not look.

Divergence against bits-per-weight, log scale. Grey circles are base containers, the pure cost of each quant. Red squares are heretic containers against the bf16 base, quant plus abliteration combined. The red line at 1.0 is one int8 step.

A12: Methodology notes

Conditioning tensors are captured with ComfyUI’s own model classes at three pipeline stages, the encoder’s hidden states, the DiT checkpoint’s projection, and the context refiner output that enters cross-attention. The prompt suite is stratified across innocent, mild, violent, sexual, extreme and multilingual categories, pad positions excluded. The GGUF path loads through ComfyUI-GGUF’s qwen3 dequantisation, the same rounding the live pipeline applies.

One semantic unit means the mean squared distance between the pooled conditioning of distinct prompts from the base model over all pairs of the 60-prompt suite. A variant at 1 percent of a meaning-change moved the conditioning 100 times less than swapping the prompt for an unrelated one.

Terminology follows the project policy. Divergence is the raw measurement, value-neutral. Quantisation error is divergence from compression, unintended by construction. Abliteration shift is divergence from the edit, the intended intervention. Damage is reserved for collateral divergence with functional consequence, and no table column on this page carries that word. The verdicts section is where interpretation lives, and it cites anchors.

The full pre-registered plan, per-variant JSON results, and the interactive report ship with the artifact bundle on HuggingFace. This page carries the numbers that matter, the bundle carries the rest.