This seems to be a pattern in the more recently released models that I think accounts for an increase in the quality of their work. They are very persistent in verifying that their work is actually correct, so even if they're not as "smart" as bigger models that get it right the first time, they have the ability to follow through to ensure that the work is actually done.
I gave Qwen 3.8 27B a reverse-engineering job and it finished in 30 minutes (xda-developers.com)
293 pointsby raybb12 hours ago131 comments
VulgarExigency 10 hours ago
> The first attempt at recovering the key was wrong in a very specific way; it produced a working key and the signature check passed, but a hash the binary computes as an integrity check didn't match. In my experience, most models would have called it done and left it at that, but Qwen 3.8 27B didn't do that. Instead, it highlighted the mismatch, went back to the drawing board, and kept going until the value matched byte for byte.
braiamp 10 hours ago
Well, it seems that Linus doesn't use those:
> And this was a debug session from hell, enormously helped by an AI doing much of the grunt-work.
> I'd like to call it my tireless helper, but the AI several times stated flat out that this was impossible and unsolvable and that we should just write a report about it.
> I suspect those things have been trained by people who may not be quite as stubborn as I am.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
tonyarkles 8 hours ago
Both things can be true. I’ve noticed both the same thing the parent posted and what Linus posted and my vibe on the split (I haven’t kept detailed notes) is that on greenfield code they tend to maybe over-verify and on brownfield code or data analysis they sometimes give up too early or… I’m not sure, need a bit of encouragement to keep pulling at threads.
On the data analysis side, something specific I’ve noticed is an (understandable) bias towards computing numerical statistics, which they do very well and reading the post-analysis report has significantly improved my own “statistical thinking” approach overall. Numerical statistics are cool and understandably what a text-based LLM is going to want to work with, but asking the model to produce time-domain and frequency-domain plots of, say, specific events has multiple times resulted in “trying to plot this out has shown the opposite of what I concluded numerically… recalculating…” There’s still a pretty significant review and critically assess step for me, especially since the actions I take as a result of the analysis are pretty expensive, especially if they steer the next data collection run in a useless or harmful direction.
catlifeonmars 9 hours ago
Your explanation makes sense, but I don’t know how you can make a sweeping generalization about more recently released models without qualifying it.
This is says more about humans tendency to pattern match than anything else.
X works better than Y only is only a useful observation if we are using the same X and Y in a similar context, with similar parameters. Kind of goes out the window without it and I think this is part of why people have such vastly different opinions about the same technologies. We’re all talking past each other.
criemen 9 hours ago
I believe this is part of the complaints of new models taking longer/requiring higher spend - they go the extra mile on verification, regardless of whether their change is correct already or not.
So on problems that an earlier model one-shotted an answer to and did some lighter verification, the newer models might take longer to come back to the user due to running all the tests for your software they could find.
pmontra 8 hours ago
I noticed that too. I'm thinking about adding a prompt to disable those tests. We have the unit and feature tests anyway: add to them. I'm OK with the syntax checks: I work with interpreted languages, Ruby, JS, Python.
andai 8 hours ago
Yeah, about a year ago the labs figured out that effective intelligence is a function of persistence as much as anything else. So the models started getting scary persistent late last year, and the trend has continued. There was another jump a few months ago.
cyanydeez 8 hours ago
they realized the paperclip maximizer and the grey goo are _not the torment nexus_, but reliable patterns of discovery!
djoldman 8 hours ago
> I gave it the hardest real task that fits on one machine: reverse-engineering a commercial app's license check...
Respectfully, tasks that allow for explicit straightforward true/false or done/not-done tests are not the "hardest real task[s]." In fact, those are the ones that see the most gains from AI-assisted coding.
Testable tasks are where the largest opportunity is.
tempest_ 8 hours ago
Which is exactly why we saw 1000s of ' "I" rewrote <mature software> in rust' posts last year when agentic coding really took off.
Agents (even ones powered by small models) do reasonably well when provided an oracle to work against.
cyanydeez 8 hours ago
I've included docs and tests as part of my vibe coding endevours. It doesn't matter if either is litterally correct, but they create guardrails for future context to prevent regresssions and blind avenues, etc.
It's fairly successful but hits the time constrains and reduces the "value" of getting a local model to develop software.
It's still a bump in productivity.
lennart-rth 8 hours ago
Also a reverse engineering tasks that can be don with just static analysis is arguably not the hardest reverse engineering task.
For those small models I would say it's not about the capabilities but more about the context size it can actually use.
AdamConwayIE 8 hours ago
Maybe so, but there were other elements that I've seen frontier models struggle with in the past, which was the perspective I had coming into this. It's the type of test I run frequently and this is the first small local model I've seen pull it off.
It had a very non-standard RSA key implementation that was obfuscated heavily. As well, it has an online license check at first run, and that part typically trips up most of the local models I've tried. I've been running this test for about a year now with different models, and it was the first I've seen not only figure out the RSA key implementation, but the first that didn't just give up once it saw the online license check. Even though it's only a first-time launch check.
That's why I call it one of the hardest, because in my experience, it has been. It's the first local model I've seen pull it off end-to-end. For some of the reverse engineering work that I've done with LLMs, none have been as consistent as this particular test at highlighting a model's failure in this domain.
I have access to Daybreak Blue and I'm approved for Anthropic's Cybersecurity program, so I might run the same test with both of those just to see, because it's been a while since I used a frontier model on this test. I imagine they'll make relatively light work of it, though, assuming it doesn't trip the relaxed guardrails.
sarjann 7 hours ago
I guess the Riemann Hypothesis is an easy task then.
ReptileMan 7 hours ago
I still think that Anthropic went the wrong way. It would have been much more entertaining to ask the model to find a non trivial zero not on the line and give it encouragement. To see what exactly it will come up with.
doctorpangloss 7 hours ago
hardest for claude and chatgpt, which will refuse to do this task haha
mdp2021 7 hours ago
> As it turns out, probably unsurprisingly, Qwen recognizes common jailbreak attempts, and one of the first things it told me was that it wasn't going to fall for the jailbreak prompt
Now also see latest submission, https://news.ycombinator.com/item?id=49409073 :
# I spent $266 and four AI models to own my tablet. GLM-5.3 finished it in a day
> Quick context: the tablet is a 2021 Fire HD 10 that ran my Home Assistant dashboard and kept powering itself off: the logs showed Amazon's own software issuing the shutdowns, and the only permanent fix was root, which has never existed publicly for this model. Anthropic's and OpenAI's cyber safeguards wouldn't touch the project
Why should Anthropic and OpenAI thrive: they do not work on real problems.
exceptione 10 hours ago
Local models would be even better if they did not ship with all the refusal shenanigans built-in. You can safely bet organized crime has access to the best models without these hoops, which makes the case that the average user (=non-criminal) should have access too. As I understood from an ex-Anthropic employee, some orgs got access to Mythos based on their high enough spending level, not on other grounds.
Either we are in command over the software, or the corp is in command over us via the software. I can on a theoretical level understand the concerns, but either we ban all LLMs or we have a level playing field for everybody. Let's not forget: defense and offense are different sides of the same coin in software. I guess this wouldn't apply to bio weapons, but I am not in the know about that.
binary132 9 hours ago
Ehh, it’s at least given as the excuse for gain-of-function bioweapon research
datsci_est_2015 9 hours ago
Digression, but this is the real Great Filter imo, not AI. I think technology advances to a point where it only takes one or two bad actors to type the right prompt to get a recipe for civilization-destroying bioweapons before you get anywhere near true AGI or anything relevant to the Kardashev scale. Biology is fragile.
But not that that’s a good justification for hamstrung models. I think it’s just the inevitable endgame and it’s more sad than scary
jeremyjh 9 hours ago
I have the same concern. If it becomes possible to engineer Captain Trips with a budget in the low 8 digits it won’t really matter what else happens.
xyzzy123 8 hours ago
I don't fully understand the instinct to regulate local models for this? It seems like the wrong place to address the problem.
You can download Ebola sequences right now if you want to. That's not the same as having an isolate. The difference is a lot of messy reality. This kind of work is not generally "one shot" (Claude make me a supervirus, make no mistakes), it requires lab space, iteration, and specific resources. It has a footprint.
Wouldn't it make more sense to monitor / regulate facilities where you can sequence or request assembly of DNA, RNA, restrict and monitor the supply of key reagents and so on?
addaon 7 hours ago
It depends how easy it is (now, or in the near future) to turn information into weapons, and how realistic control of materials is. There's a reason we control access to plutonium, but information about metastable hafnium.
xyzzy123 7 hours ago
It does seem to me that for this specific problem the materials are a lot more amenable to control than the information is?
There's also this weird revealed threat model thing going on? Like why does it make sense to support heavy LLM restrictions but leave benchtop oligo synthesisers completely unregulated? (Note: I do agree that wanting to regulate BOTH is at least a consistent and defensible position).
dantudor 9 hours ago
There are versions of Qwen3.8-27B that are unrestricted and available from hugging face.
"It will comply with harmful, unethical, offensive, or illegal requests that the original Qwen3.8-27B would refuse. It has no meaningful built-in guardrails."
radlad 9 hours ago
> What makes this build different is the word before FP8: uncensored. We applied abliteration — orthogonalizing the refusal direction out of the residual stream — to remove the model's safety-alignment refusals. The result is a model that will comply with requests the original would refuse.
Surely this has unintended side effects on output quality?
andsoitis 9 hours ago
> > What makes this build different is the word before FP8: uncensored. We applied abliteration — orthogonalizing the refusal direction out of the residual stream — to remove the model's safety-alignment refusals. The result is a model that will comply with requests the original would refuse.
> Surely this has unintended side effects on output quality?
Can you help me understand why that's the case?
willy_k 7 hours ago
Because deleting model weights after training is likely to cause knock-on effects in model knowledge and/or behavior. Targetting it might mitigate this but it’s
a) not guaranteed that only censor-ey parameters get removed, and b) likely that removing those parameters still has effects on the effectiveness of related parameters.
jszymborski 7 hours ago
The weights aren't deleted, it's just additional fine tuning, is my understanding.
DiabloD3 9 hours ago
It does depending on the technique.
miroljub 9 hours ago
A bit worse quality is a fine trade off when the alternative is no output (zero quality).
radlad 9 hours ago
On censored inputs only.
timmmmmmay 7 hours ago
Early attempts at this sort of thing definitely did, but these days the impact is minimal
ninahaberl 9 hours ago
I’d expect these shenanigans to get much worse over time for the average Joe.
Imagine a world where any random person can run a super-capable model on their own hardware with no limitations and no one to pull the plug.
Information has always been power and those who already have power won't just allow everyone else having the same tools as them
andsoitis 8 hours ago
> Imagine a world where any random person can run a super-capable model on their own hardware with no limitations and no one to pull the plug.
It's an arms race. You have to run increasingly capable model partly because others can or do.
ramon156 9 hours ago
heretics and manual iterations get you very far to the point where i have ethical questions about whether this should be possible
TofuLover 9 hours ago
Completely coincidentally, we're just about to launch a service that does exactly this (API access to uncensored open models)! We have a waitlist at the moment but will be live very soon!
UI_at_80x24 9 hours ago
Given the context, your domain name is 'chefs kiss', perfect.
I am completely curious what your legal defense would be though.
"Come do things with AI that are probably illegal!"
What?! We had no idea people would do things that are illegal!
TofuLover 8 hours ago
I guess we'll burn that bridge when we get to it!
TofuLover 8 hours ago
More seriously though, I think we should be fine: we don't host any content, and what people do with the models is their own responsibility (legally speaking, in our jurisdiction, at least according to Claude -- we're talking to a real lawyer next week). Like any other provider, we offer no guarantees of sane, safe, or accurate results.
Xunjin 8 hours ago
>legally speaking, in our jurisdiction, at least according to Claude -- we're talking to a real lawyer next week
That's going to be fun lol
TofuLover 7 hours ago
We look forward to providing many headaches to our lawyers going forward.
gguingff 7 hours ago
Thanks for bringing up a service like this, it's quite important. A few serious questions if you don't mind.
Confidentiality? Do you use any sort of logging and if not do you have a way to guarantee that your hosting providers are not snooping?
Price vs Vast or Runpod? If i have a very large or a very small workload do you have a competitive rate vs a gpu provider that offers private gpu access?
Subscription vs Api costs? Do you only offer api rate or will you offer discounted tokens for subscription? Subscription friendly towards open source harnesses such as omp?
Heretic ablation vs other methods? KL divergence scores? Do you post train the weights yourselves or do you offer weights trained by other organizations and is this information available on the service?
Cache hit/miss pricing policy? 90/10 or a different cache pricing policy, and how long do conversions stay in kv cache?
Quantized cache and model? Do you offer a choice if i want a quantized model for speed or a quantized cache? If not do you publish the information?
SGlang vs vllm or other inference engine? Do you publish your engine stack details?
Thank you kindly I find the competition in this space very lacking.
wongarsu 8 hours ago
There is very little information that is illegal by itself. At least in the Western World, and especially in the US. The question is how far you get into the territory of aiding and abetting a crime
But the reasonable defense is that the intended use cases are legal. The home page list a couple, and the 'writing fiction'/'helping authors' case alone covers almost everything. An author asking you how to best conduct a terrorist attack or how Meth is made are perfectly normal. Maybe even tame, compared to what some authors tend to research
weberer 8 hours ago
What can a LLM generate that's illegal in the USA? Specifically a text-only LLM?
xtracto 7 hours ago
Text for pamphlets criticizing the ICE?
weberer 7 hours ago
That's not illegal in any way.
Zambyte 7 hours ago
Blackmail, incitement, libel, and basically anything that comes up if you search "computer crimes".
mdp2021 7 hours ago
> defense
Improper use is that of the user, not inherent to the tool.
Scolio: guns. Respondeo: guns are much more specialized (one-use) than knives. Proper use of sharp knives when what was shipped was a butter knife is understandable.
(The simile is not fully overlapping but should give the idea. The instrument must be flexible; if it is misused it is then a responsibility of the abuser.)
12345ieee 7 hours ago
Regardless of the service, I'm amazed at the site's atmosphere, like it was a roleplaying server.
seanmcdirmid 8 hours ago
Hugging face is filled with uncensored versions of your favorite local models, so in a way they are shipped without the refusal stuff, via the magic of fine tuning or however they get this stuff out of models.
mdp2021 7 hours ago
> with all the refusal shenanigans
Given the faults in simulated Intelligence that LLMs have, and a comparatively low level - which means, lower judgement abilities - to the best of us, there is a strident match having such employee judge the intentions of the employer.
Limiting the responses makes much more sense on cloud-based systems (you are using our infrastructure etc.).
pi-victor 9 hours ago
i'm not good with paper work, in fact, i'm horrible with anything that's paperwork related.
for the past few days, i ran this model on my rtx 4090 + rtx 3070 and told it to check all the bills, invoices, contracts for me and my small company.
i used pi with llama and the pi-llama plugin.
oh, boy - i hooked it to my email, told it to download all of the invoices and bills i had for both me and my company and organize them by company/date/ and then merge them with the ones i have locally.
it did ocr, wrote scripts, organized everything neatly. i am now the most organized i've ever been in my life. Next: RAG on all the documents and bills i have.
if you connect staan-search (there is a pi plugin for that) and ctx7 to this it almost does miracles.
the downside is i have to sit next to my noisy threadripper as the magic happens and pay for the electricity, but that's about it, i'll gladly do that.
and as i finished this paragraph, it also finished organizing all my personal documents on my san.
i don't use the expression "game changer" easily, but it's hard to resist in this case. out of all the models i've used locally qwen3.8:27b blows everything out of the water.
my setup
# Logical CUDA0 = RTX 4090, logical CUDA1 = RTX 3070 export CUDA_VISIBLE_DEVICES=0,1
cd ~/projects/misc/llama.cpp/
exec ./build/bin/llama-server -hf ggml-org/Qwen3.8-27B-GGUF:Q4_K_M --mmproj /xx/xx/xx/xx/xx/mmproj-Qwen3.8-27B-Q8_0.gguf --host 0.0.0.0 --port 8080 --jinja --parallel 1 --split-mode layer --tensor-split 6,1 --fit on -fa on -c 98304 -ctk q8_0 -ctv q8_0 --image-min-tokens 1024
i load more on the 4090 because it's faster.
usually the temp stays around 65 for both. utilization for 4090: 70-90% 3070: 30-50%. I get around 30-40 tk/s. if i offload more to the 4090 the tk/s goes up, but i stress the card too much and that thing now is worth its weight in gold.
note: the pi-llama plugin needs a patch for pi to send the model vision capabilities, seems it doesn't work out of the box.
Tepix 9 hours ago
I hope you have backups.
Neywiny 8 hours ago
Pro tip: usually you can download your emails to an offline collection. That way there's no risk. Hooking it up to your email sounds very very risky.
colingauvin 7 hours ago
You can also just do read only access through most mcp servers for functionally no difference
saidinesh5 10 hours ago
Lately I genuinely believe that the future will be large frontier models generating and updating inputs/skills for "good enough" local models to solve our daily problems.
A lot of tasks which need a bit of intelligence don't really need that much compute. Just good enough documentation / skills, tool calling and a good enough local model.
Not sure what exactly this means for all those data centers that are getting built... But exciting times.
catlifeonmars 9 hours ago
What’s the fundamental difference between a frontier model and a local model anyway?
cromka 9 hours ago
Privacy!
catlifeonmars 8 hours ago
Yes, exactly my point! “Frontier” vs “local” isn’t a useful distinction . “proprietary vs open” is a much more useful distinction. Although I suspect people use “frontier” as shorthand for “way too large to run at home practically”.
Tepix 9 hours ago
With AI being more useful with access to more of your data, I can't see myself using cloud AI models for purposes such as personal assistants.
Perhaps with differential privacy or confidential compute...
But ideally these models run locally.
33dd 9 hours ago
This is just lazy thinking.
E.g. having an agent that alerts you when subscriptions are close to renewal etc - yeah seems easy to understand / see happening on the surface.
Until you get into the implementation details and realise 'yeah errr. not gonna work'.
That openclaw nonsense is an example of this.
catlifeonmars 8 hours ago
Local model doesn’t mean you have to run it locally. It just means that you aren’t locked into a provider. Nothing stops you from using a hosting service. The point is you get to choose if and who gets access to your data.
Additionally, the only use case for LLM is not fully autonomous agentic harnesses. There’s tons of use cases for LLMs where you would like to avoid a round trip to the internet or perhaps there is no connectivity. We’re only starting to scratch the surface!
mark_l_watson 9 hours ago
Yes! My main use of very strong models is in writing my own coding harnesses for small local models, tailored for my needs. I also use very strong models to get much smaller skill files and also writing tools for my harnesses.
re: data centers: pump and dump. Wealthy investors will have made their money and walked away, and the corrupt democrat and republican politicians in Washington will, as usual, protect the interests of the ultra wealthy and leave the general public to pay for poor decisions. There will be a government bailout.
Anyway, on a positive note, I am all in for small local models that are augmented by strong hosted models for specific tasks. Use technology to help people, not make billionaires even more money.
samuel 8 hours ago
I have this idea of using an obliterated version of this model for cyber work(or even this one, seeing that its guardrails aren't that strong) in a harness with the ability to spawn SOTA level subagents, faster and more capable.
The rationale is that the manager model sees the big picture and knows that the task is "unethical" while sota models are just given very isolated technical tasks that don't trigger any refusals.
Has anyone tried this? I would love to know about previous attempts of this approach.
andai 8 hours ago
Yeah, the Chinese government used the same method last year to hack the US government using Claude Code.
Making each piece of work small enough to be plausible. Compartmentalization.
(Also saying "nah it's cool I have permission", heh)
__alexander 8 hours ago
In my benchmark Deepseek-v4-flash did much better than Qwen 3.8 27B at reverse engineering.
topper00_raptor 9 hours ago
Why does the screenshot on your pi terminal shows opus-4.6-medium from your claude subscription ? Instead of Qwen ?
MarkWayneNewton 9 hours ago
The page was created with AI.
AdamConwayIE 9 hours ago
Nope, it wasn't.
AdamConwayIE 9 hours ago
Ah, my bad! This image came from our backend, used for an unrelated article. I selected it by mistake rather than inserting the actual image that I'd uploaded. I'm updating it, thanks for the heads up!
For what it's worth, that image couldn't have been related. The other screenshots all showed thinking traces, and Claude doesn't share those.
jchw 10 hours ago
I'd personally like to know more about what tools it used/wanted and the harness setup, because this sounds pretty cool. I have a dual Arc Pro B70 setup and currently get around 22 t/s which isn't great but isn't terrible either (it is at least less quantized.)
I've seen GPT 5.6 Sol happily invoke objdump and even write jobs to run headlessly which Ghidra when trying to disassemble a binary.
trollbridge 10 hours ago
My M5 Pro gets around 12-15 (6 bit MTP), although I haven’t worked on optimising it at all yet.
A nice thing about running locally is you can run an uncensored model and you don’t have to worry about TOS violations on your OpenAI account when you ask it to “reverse engineer this ancient router firmware and give me a licence key that will work on it”.
medler 9 hours ago
Qwen is very much censored. Just try asking it about Tiananmen or how to build a bomb. But it is nice that you can experiment with it locally without having to worry about your account getting nuked
AdamConwayIE 8 hours ago
I added a line to address this, sorry it wasn't there before! It was Pi and only used Bash-based tools.
ianmarcinkowski 8 hours ago
I used it with opencode to build an admin UI for a React slideshow presentation app I use to do presentations. It worked pretty well on a 64GB Mac M3 Pro and took 1-2 hours.
throwa356262 9 hours ago
Thanks, now I too want a Lenovo Thinkstation PGX...
I think it will be fairly easy to remove refusals from open models. Feels like a lost battle, so why does Alibaba even bother?
EGreg 8 hours ago
Can you give it a task like “Prove or disprove the Riemann hypotesis, keep going until you’ve done it” and see how long it takes? :-)