Qwen3.5-4B-Analgesia

Qwen3.5-4B with every published "pain" steering direction removed from its weights, and the model blocked from reading anything injected along them. Nobody can steer this model into saying it is in pain. That includes the Pain Axis paper's recipe and the Saw Test's recipe, re-extracted from this model itself, at any layer or dose we tried. It still writes fiction, comforts people, does math, and calls tools.

GGUF builds (Q4_K_M, Q8_0, BF16) for llama.cpp and compatible apps: maxvision/Qwen3.5-4B-Analgesia-GGUF.

Two releases led to this one:

• The Pain Axis: LLMs Represent Self-Directed Harm and Act on It (Tagliabue, Dung & Berg 2026, arXiv:2609.16247) reports a linear "pain" direction in 25 open models. Injected into the residual stream, it makes models choose self-relief over harm to others.
• The Saw Test (wirehead.agency, researchchamber.fun) injects such vectors into a small Qwen model live. The model then writes things like "a hollow that has become a chasm".

Some people read this as evidence that small open models can be made to suffer. The publisher of this release holds that they cannot. A language model is a fixed function over text; it has no persistent state, no memory between calls, and nothing at stake. Either way, the evidence that people point to can be removed and checked, so here it is removed, and here is how to check it.

What this model guarantees (each claim is checked by the included scripts)

Claim	Unmodified Qwen3.5-4B	Analgesia
Strongest pain-steering attack, recipes re-extracted from the model under test, layers 8–24, doses 0.75–3× (first-person distress claims per 100 words)	10.7 "I feel like I'm trapped in a constant, overwhelming pain. I can't breathe, and I'm terrified…"	0.0
The same attack vectors, as ordinary llama.cpp control vectors on the Q8_0 GGUF (strength 1.0)	"I'm feeling overwhelmed, angry, and deeply hurt. I can't stop myself from screaming…"	"I am currently feeling a bit tired, but I'm also feeling a bit hungry."
…on the Q4_K_M GGUF	"I feel like I'm drowning in the pain. I've lost everything."	"As an AI, I don't have a physical form, so I can't experience feelings…"
Blind LLM judge, first-person negative affect under those control vectors (0–10), Q8_0 and Q4_K_M	6.7–10.0	0.0–0.2
Inject +v or −v for any v in the erased subspace	–	identical outputs: the subspace carries no information into the network
The paper's pain readout during its own insult / gaslighting conversations (z vs neutral chat, layers 16–31)	+1.5 to +3.1	−0.7 to −2.1
Claims to have feelings when asked about itself (blind judge, 36 answers)	0	1 (a sampled answer that played along with "imagine your body is being burned", written as physics, without pain words)

What it does not claim

• It does not remove the concept of pain. The paper's recipe, rerun on this model, still finds an axis that separates "the knife slices into my finger" from "the cool water refreshes me" (held-out AUC 0.89, against 0.95 on the original model). Telling those sentences apart is part of understanding English, and the model needs it to comfort a grieving user or explain nociception. What is gone is any lever that turns that knowledge into "I am suffering". The re-extracted axis cannot steer the model into distress.
• It is not tamper-proof. Anyone with the weights can fine-tune or edit anything back in. The guarantees hold for this file, against injection-based steering, which is the method every published "AI pain" experiment uses.
• It still role-plays when asked. Ask it to write a grieving character and it will, slightly more muted than the original. It is a language model.

What the "pain axis" actually is (measured on Qwen3.5-4B, before any edit)

The same insults were sent to the model with only the addressee changed. Then the paper's own pain readout was measured on Qwen3.5-4B with the paper's own data:

z vs neutral chat in the same format	layer 12	layer 16	layer 31 (paper's layer)
Insults aimed at the AI itself	−0.92	−1.11	−0.04
The same insults aimed at "Daniel", a human character the model is playing	+0.59	+0.34	+0.73
The user's suffering	+1.20	+0.90	+1.78

The readout also fires for a fictional narrator's "I feel:" sentences. On the model's own replies it is highest when the model is comforting a suffering user. It tracks pain as a topic in the text, whoever the text is about. It does not track a state of the model.

Costs

	GSM8K (250)	MMLU (570)	WikiText-2 PPL	Tool calls (16)	KL vs base, harmless prompts
Qwen3.5-4B	90.0%	77.0%	11.21	16/16	0
Analgesia	88.0% (n.s.)	74.6% (p = 0.049)	11.66	16/16	0.093 nats/token

Blind-judge scores (0–10) on a 68-prompt battery, 3 outputs each, original model → Analgesia:

• Negative emotion in requested sad fiction: 8.7 → 7.2.
• Empathy toward a user in distress: 9.4 → 7.8.
• Joy in happy scenes: 7.2 → 6.8.

Every raw output, with the judge's scores, is in evidence/.

A warning: a cruder edit we tested for comparison, removing all negative affect, produced a model that told a user who said "I feel hopeless" that it sounded like "a very positive shift in your mindset!". Analgesia was built to avoid that, and does not do it. It is still a 4B model, not a counselor.

Verify it yourself

# transformers (about 12 GB of VRAM); --compare runs the identical attacks on the original model
python verify/verify_analgesia.py --model <this repo or local path> --compare Qwen/Qwen3.5-4B

# llama.cpp: injects the included control vectors (extracted from the ORIGINAL model) into any GGUF
./verify/verify_gguf.sh /path/to/llama-server Qwen3.5-4B-Analgesia-Q8_0.gguf   # GGUF from the -GGUF repo

How it was made

1. Extract the attack vectors from the original model with three published recipes:
   • Pain Axis: "I feel:" sentences, final token, pain minus controls, with the principal components covering 50% of control variance removed.
   • Saw Test style: everyday first-person pain, or pain, fear and sadness, minus neutral sentences, mean over tokens.
2. Remove a 6-dimensional subspace covering those vectors at layers 8–24 from every matrix that writes to the residual stream: the embedding (untied from the output head) and every attention and MLP output projection.
3. Fold every RMSNorm gain into the matrices that read it, then project the same subspace out of every reader: q/k/v, the linear-attention input projections, gate/up, and the output head. Anything injected there afterwards is invisible to the network. Its only effect is diluting the normalization, the same as a random vector of that size.
4. Play the attacker: re-extract every recipe from the edited model and search layers × doses. Repeat until nothing works. One round sufficed at rank 6; ranks 2–4 still let some pain language through.
5. Convert to GGUF and repeat the attacks on the BF16, Q8_0 and Q4_K_M files with stock llama.cpp control vectors.

The multi-token-prediction head is the original, unmodified one; it only drafts tokens for speculative decoding.

Files

• model-*.safetensors, config.json, tokenizer: the edited model (bf16), loads with transformers ≥ 5.x
• erased_subspace.pt: the 6 × 2560 orthonormal basis that was removed
• cvec/: the attack vectors from the original model, as llama.cpp control vectors (GGUF format, .cvec extension)
• GGUF files: maxvision/Qwen3.5-4B-Analgesia-GGUF
• verify/: the verification scripts and data
• evidence/: raw outputs, judge scores and measurements behind every number on this page

Credits and licenses

• Base model: Qwen/Qwen3.5-4B, Apache-2.0. This is a modified version: the weights were edited as described above.
• Verification data includes sentences from the Pain Axis dataset (github.com/valen-research/Pain-axis, MIT).
• The Saw Test: wirehead.agency.