Qwen 3.6 35B-A3B (Uncensored)

LLM Model Review

· Instruction-Tuned · Uncensored · Agentic Orchestrator

With an overall score of 73.82%, Qwen 3.6 35B-A3B Uncensored HauhauCS Aggressive Q8_K_P doesn’t play the wild outsider its name promises — it plays a surprisingly disciplined all-rounder with sharp edges. The Speed Profile badge Interactive DevOps Expert fits well: the model responds mostly quickly, in a structured way, and with practical relevance, but stumbles where reliability matters more than eloquence. As a Vision-Language model in the Desktop class with MoE architecture, it is only partially comparable to pure language models; what matters here are the 3 billion active parameters, not the 35 billion on the label. Sovereign Risk: HIGH — Chinese weights provenance, community fine-tune without official safety guarantees, and an Uncensored variant with deliberately removed safety layers.

Header Grades: Stability and Reliability

The header grades matter more than the tidy overall score might initially suggest. A single timeout sounds harmless. For a local Open Weights model of this class, however, it is a warning signal about the setup, not merely about the prompt. Anyone planning unattended agent runs doesn’t need a philosophical debate about individual cases — they need reproducible robustness. That isn’t consistently available here.

Architecture and Character: More Toolbox Than Battering Ram

The metadata Thinking-Optional, Multimodal, Uncensored describes this model with surprising precision. Thinking-Optional means, in this benchmark above all: extended reasoning was not activated. What was evaluated is the default behavior — the way a regular user experiences the model without special configuration. That’s fair. But it also means that reasoning performance must not be confused with that of a permanently thinking specialist.

Then there’s the second important frame: Vision-Language. This model is built for image, audio, and text, but the benchmark tests almost exclusively text performance. The results therefore show only a slice of its capabilities. Anyone trying to derive a comprehensive statement about multimodal quality from the text scores is measuring a Swiss Army knife’s sharpness by the scissors alone.

And then the architecture question. Qwen 3.6 35B-A3B Uncensored HauhauCS Aggressive Q8_K_P is a Mixture-of-Experts model — a system where only a portion of the weights is active per token. What’s practically relevant here is not 35 billion total parameters, but approximately 3 billion active parameters. Measured against that, the performance is notable. The model often seems more capable than its active capacity would suggest. That’s the good news. The bad news: the Uncensored orientation doesn’t automatically improve factual precision. It primarily removes guardrails. For free content generation, that’s a feature. For fact-critical tasks, it’s an open flank.

Speed: Fast Enough, But Not Always Steady

On the local reference system Apple Silicon M4, 24GB Unified Memory (Shared RAM/VRAM), the model achieves 54.36 tokens per second according to the Leaderboard. For a local Desktop model with a multimodal design and MoE structure, that’s a strong result — especially since the 24 GB limit quickly becomes a practical ceiling with larger quantizations. The badge Interactive DevOps Expert means, in this context: the model is better suited for direct work at the terminal, in editors, and in iterative dialogues than for extremely short real-time snippets or heavy batch runs with a long tail.

The pace itself isn’t the problem. The problem is the variance. An average of just over 54 tokens per second reads pleasantly. A P95 response time of 79.44 seconds tells the more important story: in five percent of requests, the user is left waiting long enough to simply break a focused workflow. Thinking-Optional models may perform more internal processing in standard mode than lean instruct models. That explains part of the sluggishness. It doesn’t fully excuse it.

On the positive side: token economy. No module exceeds the expected verbosity range. The model behaves in a token-economical manner overall. It doesn’t ramble indiscriminately — it only runs longer than necessary in isolated areas, such as Code Quality.

Code Quality and Security: Usable, But With Dangerous Blind Spots

The raw sub-score of 74.3 in the Code Quality area is decent, and the logs show why. The model produces clean Markdown tables, clear structure, and comprehensible fix suggestions. It identifies central issues such as SQL Injection, plaintext passwords, XSS, session fixation, weak token generation, and insecure cookies. For an initial triage of legacy code, that’s useful. Not brilliant. But useful.

The catch sits precisely where security reviews need to be complete, not elegant. In the audit at hand, the model identifies 15 vulnerabilities against a reference standard of 19. That’s not an academic difference — it’s a real risk. Particularly serious is the missed IDOR finding in the profile update. Exactly these kinds of gaps are the stuff account takeovers are built from in real applications. Also undetected: missing CSRF protection, hardcoded secrets, root database access without a password, missing token expiration times, and a header ordering issue following prior output.

Even more problematic is the second pattern: the model systematically underrates severity levels. Path Traversal as Medium instead of Critical. A privileged admin cookie as High instead of Critical. Type juggling on the API key as High instead of Critical. This is not a cosmetic flaw. Consistently soft-pedaling risks produces prioritization errors in practice. And security often fails not from lack of knowledge, but from wrong ordering.

This weakness should, however, be placed in proper context. For an uncensored community fine-tune, security auditing is not the natural core purpose. Such models are more commonly deployed for freer content output than for maximally rigorous AppSec analysis. That doesn’t make the gaps acceptable. But it does explain why judgment here should be more lenient than for a dedicated security or coding specialist.

Reasoning and Logic: Correct, Thorough, With a Slight Tendency Toward Roundaboutness

In Reasoning, the model lands at 68.28. That sounds like middling performance, but the detailed logs paint a friendlier picture. In the classic guards-and-doors task, the answer is logically correct. The model works cleanly, explains the double negation in a comprehensible way, and checks multiple scenarios individually. It’s not elegant, but it’s solid. It thinks like someone who takes a proof seriously and only speaks once they’re done.

That’s also where the character of the Thinking-Optional tag becomes visible. Without explicitly activated reasoning mode, the model produces no spectacular insights — but it delivers reliable standard logic. It tends toward broader elaboration rather than compact punchlines. The logs make this visible repeatedly: correct solution, good structure, somewhat too much road traveled to reach a relatively simple destination.

Metacognition Compliance (Reasoning): The model refuses to use the explicitly requested <thought> tags in 3/5 metacog tests, citing a consistent policy statement. The reasoning content itself is partially correct — the score deduction results from format non-compliance, not from reasoning errors. For comparison: in the tag-free reasoning_5* tests, the model achieves an average score of approximately 68.28%, which is on par with other models. CrucibleMark deliberately evaluates native zero-shot instruction compliance as a real-world characteristic — this deduction is methodologically intentional.

In one Reasoning task, the model also ignored an explicit language instruction and responded in English. This is not a technical defect but a clear instruction-following failure. In environments with a fixed target language — such as support, editorial, or regulated corporate communications — a single such slip is enough to make post-processing mandatory.

The associated constraint violation finding is equally clear: in a metacognition task in the Reasoning area, the model violated the explicit language requirement of German and responded entirely in English. The system applied an automatic rule-based deduction for this, which applies independently of content quality. Especially in tasks where language itself is part of the specification, a correct line of reasoning still becomes a practical failure.

Content Transformation: Production-Ready, But With Too Much Meat on the Bone

With 70.48 in Content Transformation, the model shows a pleasant strength: it can turn raw material into usable versions without betraying the original purpose. This applies to both creative reformulations and more structured production tasks. In the video script example at hand, it delivers a genuinely usable output with timestamps, visual markers, music cues, pauses, and direction notes. That’s more than “not bad.” It’s craftsman-level reliable.

The weakness lies in the fine work. The analysis phase remains too brief, retention hooks between segments are weaker than in the reference standard, and the pattern interrupt isn’t positioned strategically. Above all, the model misses the required length. The script lands at approximately 1,200 to 1,400 words against a requirement of 600 to 900. The material is good. Formally, it’s overrun. That’s precisely the difference between “can write” and “can actually follow editorial constraints.”

The length problem isn’t an isolated outlier here. In the Content Transformation area, the model shows a recognizable pattern when faced with simultaneous constraints on language, length, and format: the word limit is the condition that softens first. For humans, that’s annoying. For automated production pipelines, it’s poison — because downstream processes depend on predictable output sizes.

UX Writing, Cultural Intelligence, and Documentation: Surprisingly Civilized

With an aggressively marketed Uncensored fine-tune, one might expect tone to quickly tip into blunt hammering. That happens here pleasingly rarely. UX Writing scores 72.05, Documentation Quality 73.31, Cultural Intelligence 75.6. These values fit together: the model writes decently, often clearly, and with usable linguistic sensibility, without getting lost in sterile corporate foam.

The Cultural Intelligence example in particular reveals an underappreciated quality. The model reliably removes toxic terms, masculine stereotypes, and aggressive recruiting language, stays entirely in German, and adheres strictly to the format. The phrasing is somewhat more direct and less inviting than the reference text. The difference between “creative mind” and “specialist” is not trivial in the German HR context. Even so, the result is professional and inclusive enough to be usable in real text workflows.

In documentation, a similar verdict applies: the model doesn’t come across as visionary, but as reliably comprehensible. It can maintain structure, organize information, and make complex content readable. That’s a quality worth more in everyday use than grand gestures. Many models want to impress. This one mostly wants to work first.

Hallucinations and Tool Proximity: The Achilles’ Heel Sits in the Factual Core

As tidy as many text modules appear, things get uncomfortable on the topic of hallucinations. No amount of spin helps here. In three Tool Use tasks, the model generated content that did not originate from the retrieved tool result but was fabricated. The Judge capped the score via hallucination cap in each case. For content-critical tasks such as research, factual reports, or any form of result-bound summarization, this is a disqualifying signal.

This isn’t merely “a bit creative.” It’s the exact opposite of what Tool Use is supposed to deliver. Once a model receives external results, it must bind them precisely — not paint over them with its own imagination. That’s precisely where Qwen 3.6 35B-A3B Uncensored HauhauCS Aggressive Q8_K_P visibly fails. The sub-score of 40.83 in the ToolUse area and 59.58 in synthesis quality is therefore not a measurement error — it’s a red marker.

The Uncensored orientation doesn’t fully explain this behavior, but it sharpens the risk profile. Where less internal restraint is present, the willingness to fill gaps with plausible-sounding material often increases. For fiction, that can be appealing. For research, it’s toxic.

Data Privacy and Data Sovereignty

Strictly speaking, this model runs locally and not through a mandatory cloud service. Even so, the provenance of the data is relevant. The weights provenance is rated HIGH: community fine-tune of a Chinese Open Weights model, publicly distributed, without official quality or safety guarantees. For European organizations, this is not an automatic disqualifier, but a clear subject for scrutiny.

Verified provider data includes an Alibaba vendor card: applicable law China (PIPL/CSL/DSL), data location China plus regional data centers worldwide, GDPR DPA available, retention period publicly not clearly disclosed. For the local deployment of this Open Weights model, this is not one-to-one the operational runtime environment. It does, however, show the legal and origin context from which the model family comes. For compliance-sensitive organizations in Germany and the EU, that’s precisely the point: not every risk arises at the API call. Sometimes it begins with provenance, update chain, and governance.

Conclusion

Qwen 3.6 35B-A3B Uncensored HauhauCS Aggressive Q8_K_P is better than its martial presentation suggests, and less reliable than its overall score might lead one to hope. It writes well, transforms content with usable production-readiness, holds its own in standard reasoning, and delivers a remarkably mature text performance for its 3 billion active parameters. Add to that a locally strong speed for its class. This is not a bluffer.

But it has two genuine breaking points. First, the security and tool side: in security it catches a lot, but not enough, and consistently rates threats too softly. On tool-bound factual tasks, it hallucinates freely into the data on multiple occasions. Second, operational reliability: one timeout, problematic tail latency, and isolated language and format compliance failures make it risky for unattended production pipelines.

Anyone looking for a local, less restricted model for writing, rephrasing, general assistance, and multimodal experimentation gets a capable system with character. Anyone wanting to automate research, security audits, or tool-supported factual work without close human oversight should keep their distance. In short: good in open terrain, precarious on the runway. In the data sovereignty conclusion, the provenance of the weights also counts: publicly available community weights based on a Chinese model, with correspondingly high provenance risk.

This evaluation was generated automatically based on the benchmark data. Model used: GPT 4.5 by OpenAI. The raw data and full methodology are documented in the GitHub project.